diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7682eb10..94618f71 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -55,6 +55,8 @@ jobs:
     steps:
       - name: Checkout Crate
         uses: actions/checkout@v4
+      - name: Check generated jets come from the vendored revision
+        run: ./update_jets.sh --check
       - name: Read vendored libsimplicity revision
         id: libsimplicity
         run: |
diff --git a/update_jets.lock b/update_jets.lock
new file mode 100644
index 00000000..9ab39713
--- /dev/null
+++ b/update_jets.lock
@@ -0,0 +1,15 @@
+# This file has been automatically generated by update_jets.sh. Do not edit it by hand.
+#
+# The libsimplicity line is the revision GenRustJets was run at, with a "-dirty" suffix
+# if that checkout had local changes. Each line after it is the SHA-256 hash of a
+# generated file followed by the file's path, as printed by sha256sum.
+#
+# "update_jets.sh --check" (run in CI) fails unless the revision matches
+# simplicity-sys/depend/simplicity-HEAD-revision.txt and every hash still matches.
+libsimplicity ba967b1a0d57e069c37cd4041b8bae53f12fd456
+074e3ed8f731fe0fbb76973877baed8a154b69aa51ccc728067cdc72206184ff  simplicity-sys/src/c_jets/jets_ffi.rs
+4789b5e12ac7b2e2753f1ec6731c0ea100724626d1a2658f713be9b175634086  simplicity-sys/src/c_jets/jets_wrapper.rs
+a1cd77affeedcce927fcc5c6078a045a0f22dae2d02382531d2b95b151e58276  simplicity-sys/depend/jets_wrapper.c
+f6589ae19ab945ffe6855c255914c1d244d8c2be90e9116741c2f6702ea8f146  src/jet/init/core.rs
+4c374312cfe20ff0fba15d8b9cdd4e52d946b062e76d176c94b5eda881687bae  src/jet/init/bitcoin.rs
+02b26a2225ef1135ac4d69bd3f570f21d1acdd930b8d076a387113abe4c42c3f  src/jet/init/elements.rs
diff --git a/update_jets.sh b/update_jets.sh
index 2156b35e..9fcdc52e 100755
--- a/update_jets.sh
+++ b/update_jets.sh
@@ -2,27 +2,101 @@
 set -e
 
 # Requires (nix-shell with) cabal
+#
+# Generate the jet files with GenRustJets from the libsimplicity checkout at $1, which
+# must be at the revision vendored in simplicity-sys/depend/simplicity-HEAD-revision.txt.
+# The revision used and the hash of every generated file are recorded in update_jets.lock.
+#
+# Set UPDATE_JETS_ALLOW_MISMATCH=1 to generate from another revision or from a dirty
+# checkout anyway, e.g. to try out a generator change. The lock file then records what
+# was really used.
+#
+# With --check instead of a path, only check that update_jets.lock names the vendored
+# revision and matches the generated files (no cabal needed). CI runs this.
 
 if [ -z "$1" ]; then
-  echo "\$1 path to libsimplicity repository root"
+  echo "\$1 path to libsimplicity repository root, or --check"
   exit 1
 fi
 
 C_DIR="$1"
 RUST_DIR="$(pwd)"
 VENDORED_HEAD=$(sed -n '2p' "$RUST_DIR"/simplicity-sys/depend/simplicity-HEAD-revision.txt)
+LOCK_FILE="update_jets.lock"
+
+# Files written by this script, as moved into place below.
+GENERATED_FILES=(
+    "simplicity-sys/src/c_jets/jets_ffi.rs"
+    "simplicity-sys/src/c_jets/jets_wrapper.rs"
+    "simplicity-sys/depend/jets_wrapper.c"
+    "src/jet/init/core.rs"
+    "src/jet/init/bitcoin.rs"
+    "src/jet/init/elements.rs"
+)
+
+sha256() {
+    if command -v sha256sum > /dev/null; then
+        sha256sum "$@"
+    else
+        shasum -a 256 "$@"
+    fi
+}
+
+# Contents of the lock file for jets generated from libsimplicity revision $1.
+lock_contents() {
+    cat <<EOF
+# This file has been automatically generated by update_jets.sh. Do not edit it by hand.
+#
+# The libsimplicity line is the revision GenRustJets was run at, with a "-dirty" suffix
+# if that checkout had local changes. Each line after it is the SHA-256 hash of a
+# generated file followed by the file's path, as printed by sha256sum.
+#
+# "update_jets.sh --check" (run in CI) fails unless the revision matches
+# simplicity-sys/depend/simplicity-HEAD-revision.txt and every hash still matches.
+libsimplicity $1
+EOF
+    sha256 "${GENERATED_FILES[@]}"
+}
+
+if [ "$1" = "--check" ]; then
+    if ! diff -u "$LOCK_FILE" <(lock_contents "$VENDORED_HEAD"); then
+        echo
+        echo "The generated jets do not match $LOCK_FILE for the vendored libsimplicity"
+        echo "${VENDORED_HEAD}. Re-run update_jets.sh with libsimplicity checked out at"
+        echo "that revision, and change the generator rather than its output."
+        exit 1
+    fi
+    echo "Generated jets match $LOCK_FILE and the vendored libsimplicity ${VENDORED_HEAD}."
+    exit 0
+fi
 
 cd "$C_DIR"
 REV=$(git rev-parse HEAD)
+GENERATED_REV="$REV"
+MISMATCH=
 
 if [ "$REV" != "$VENDORED_HEAD" ]; then
-    echo "WARNING: Haskell and Rust have different libsimplicity version"
+    echo "Haskell and Rust have different libsimplicity versions"
     echo "Haskell: $REV"
     echo "Rust:    $VENDORED_HEAD"
+    MISMATCH=1
 fi
 
 if test -n "$(git status --porcelain)"; then
-    echo "WARNING: libsimplicity repo is not clean"
+    echo "libsimplicity repo is not clean"
+    GENERATED_REV="$REV-dirty"
+    MISMATCH=1
+fi
+
+if [ -n "$MISMATCH" ]; then
+    if [ "${UPDATE_JETS_ALLOW_MISMATCH:-}" != 1 ]; then
+        echo
+        echo "Generate the jets from the vendored libsimplicity revision. If you need a"
+        echo "generator change, merge it into libsimplicity and re-vendor first."
+        echo "Set UPDATE_JETS_ALLOW_MISMATCH=1 to generate anyway."
+        exit 1
+    fi
+    echo "WARNING: continuing anyway since UPDATE_JETS_ALLOW_MISMATCH=1"
 fi
 
 cabal build -j8
@@ -46,3 +120,5 @@ sed -i -r "s/ rustsimplicity_[0-9]+_[0-9]+_/ rustsimplicity_${SIMPLICITY_ALLOC_V
 mv "${C_DIR}/core.rs" "./src/jet/init/"
 mv "${C_DIR}/bitcoin.rs" "./src/jet/init/"
 mv "${C_DIR}/elements.rs" "./src/jet/init/"
+
+lock_contents "$GENERATED_REV" > "$LOCK_FILE"