diff --git a/Dockerfile b/Dockerfile
index a0192c4e45..4ebd4e3ead 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -49,8 +49,12 @@ ADD .htmltest.yml .htmltest.yml
 RUN htmltest
 
 FROM build-base as update-modules
-ARG MODULE="-u"
-RUN hugo mod get ${MODULE}
+ARG MODULE
+RUN if [ -n "$MODULE" ]; then \
+        hugo mod get ${MODULE}; \
+    else \
+        echo "no module set"; \
+    fi
 RUN hugo mod vendor
 
 FROM scratch as vendor
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000000..6acc177631
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,3 @@
+.PHONY: vendor
+vendor: ## vendor hugo modules
+	./scripts/vendor.sh
diff --git a/docker-bake.hcl b/docker-bake.hcl
index 9bc8c8fcdb..71036457da 100644
--- a/docker-bake.hcl
+++ b/docker-bake.hcl
@@ -141,10 +141,14 @@ target "aws-cloudfront-update" {
   output = ["type=cacheonly"]
 }
 
+variable "VENDOR_MODULE" {
+  default = null
+}
+
 target "vendor" {
   target = "vendor"
   args = {
-    MODULE = null
+    MODULE = VENDOR_MODULE
   }
   output = ["."]
 }
diff --git a/scripts/vendor.sh b/scripts/vendor.sh
new file mode 100755
index 0000000000..c580ccc30a
--- /dev/null
+++ b/scripts/vendor.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -eu -o pipefail
+
+output=$(mktemp -d -t hugo-vendor-output.XXXXXXXXXX)
+
+function clean {
+  rm -rf "$output"
+}
+
+trap clean EXIT
+
+docker buildx bake vendor \
+	"--set=*.output=type=local,dest=${output}"
+rm -r _vendor
+cp -R $output/* .