diff --git a/.kazelcfg.json b/.kazelcfg.json
new file mode 100644
index 0000000000..34ea2976fe
--- /dev/null
+++ b/.kazelcfg.json
@@ -0,0 +1,4 @@
+{
+	"GoPrefix": "k8s.io/kops",
+	"AddSourcesRules": true
+}
diff --git a/hack/go_install_from_commit.sh b/hack/go_install_from_commit.sh
new file mode 100755
index 0000000000..ee6fd0d9c1
--- /dev/null
+++ b/hack/go_install_from_commit.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+PKG=$1
+COMMIT=$2
+export GOPATH=$3
+export GOBIN="$GOPATH/bin"
+
+go get -d -u "${PKG}"
+cd "${GOPATH}/src/${PKG}"
+git checkout -q "${COMMIT}"
+go install "${PKG}"
diff --git a/hack/update-bazel.sh b/hack/update-bazel.sh
new file mode 100755
index 0000000000..983acdabc9
--- /dev/null
+++ b/hack/update-bazel.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KOPS_ROOT=$(git rev-parse --show-toplevel)
+# https://github.com/kubernetes/test-infra/issues/5699#issuecomment-348350792
+cd ${KOPS_ROOT}
+TMP_GOPATH=$(mktemp -d)
+
+# manually remove BUILD file for k8s.io/apimachinery/pkg/util/sets/BUILD if it
+# exists; there is a specific set-gen rule that breaks importing
+# ref: https://github.com/kubernetes/kubernetes/blob/4e2f5e2212b05a305435ef96f4b49dc0932e1264/staging/src/k8s.io/apimachinery/pkg/util/sets/BUILD#L23-L49
+# rm -f ${KOPS_ROOT}/vendor/k8s.io/apimachinery/pkg/util/sets/{BUILD,BUILD.bazel}
+
+"${KOPS_ROOT}/hack/go_install_from_commit.sh" \
+  github.com/bazelbuild/bazel-gazelle/cmd/gazelle \
+  eaa1e87d2a3ca716780ca6650ef5b9b9663b8773 \
+  "${TMP_GOPATH}"
+
+"${TMP_GOPATH}/bin/gazelle" fix \
+  -external=vendored \
+  -mode=fix \
+  -proto=disable \
+  -repo_root="${KOPS_ROOT}"
diff --git a/hack/verify-bazel.sh b/hack/verify-bazel.sh
index d9c687f83a..10e720919a 100755
--- a/hack/verify-bazel.sh
+++ b/hack/verify-bazel.sh
@@ -17,49 +17,37 @@ set -o errexit
 set -o nounset
 set -o pipefail
 
-export KUBE_ROOT=$(dirname "${BASH_SOURCE}")/..
+KOPS_ROOT=$(git rev-parse --show-toplevel)
+TMP_GOPATH=$(mktemp -d)
+cd "${KOPS_ROOT}"
 
-# Example:  kube::util::trap_add 'echo "in trap DEBUG"' DEBUG
-# See: http://stackoverflow.com/questions/3338030/multiple-bash-traps-for-the-same-signal
-trap_add() {
-  local trap_add_cmd
-  trap_add_cmd=$1
-  shift
+"${KOPS_ROOT}/hack/go_install_from_commit.sh" \
+  github.com/bazelbuild/bazel-gazelle/cmd/gazelle \
+  eaa1e87d2a3ca716780ca6650ef5b9b9663b8773 \
+  "${TMP_GOPATH}"
 
-  for trap_add_name in "$@"; do
-    local existing_cmd
-    local new_cmd
 
-    # Grab the currently defined trap commands for this trap
-    existing_cmd=`trap -p "${trap_add_name}" |  awk -F"'" '{print $2}'`
+gazelle_diff=$("${TMP_GOPATH}/bin/gazelle" fix \
+  -external=vendored \
+  -mode=diff \
+  -proto=disable \
+  -repo_root="${KOPS_ROOT}")
 
-    if [[ -z "${existing_cmd}" ]]; then
-      new_cmd="${trap_add_cmd}"
-    else
-      new_cmd="${trap_add_cmd};${existing_cmd}"
-    fi
-
-    # Assign the test
-    trap "${new_cmd}" "${trap_add_name}"
-  done
-}
-
-_tmpdir="$(mktemp -d -t verify-bazel.XXXXXX)"
-trap_add "rm -rf ${_tmpdir}" EXIT
-
-_tmp_gopath="${_tmpdir}/go"
-_tmp_kuberoot="${_tmp_gopath}/src/k8s.io/kops"
-mkdir -p "${_tmp_kuberoot}/.."
-cp -a "${KUBE_ROOT}" "${_tmp_kuberoot}/.."
-
-cd "${_tmp_kuberoot}"
-GOPATH="${_tmp_gopath}" bazel run //:gazelle
-
-diff=$(diff -Naupr "${KUBE_ROOT}" "${_tmp_kuberoot}" || true)
-
-if [[ -n "${diff}" ]]; then
-  echo "${diff}"
-  echo
-  echo "Run make bazel-gazelle"
+if [[ -n "${gazelle_diff}" ]]; then
+  echo "${gazelle_diff}" >&2
+  echo >&2
+  echo "Run ./hack/update-bazel.sh" >&2
+  exit 1
+fi
+
+# Make sure there are no BUILD files outside vendor - we should only have
+# BUILD.bazel files.
+old_build_files=$(find . -name BUILD \( -type f -o -type l \) \
+  -not -path './vendor/*' | sort)
+if [[ -n "${old_build_files}" ]]; then
+  echo "One or more BUILD files found in the tree:" >&2
+  echo "${old_build_files}" >&2
+  echo >&2
+  echo "Only BUILD.bazel is allowed." >&2
   exit 1
 fi