diff --git a/.github/workflows/proto.yml b/.github/workflows/proto.yml
new file mode 100644
index 00000000..54cb691a
--- /dev/null
+++ b/.github/workflows/proto.yml
@@ -0,0 +1,65 @@
+on:
+  push:
+    paths:
+      - 'proto/**'
+      - '.github/workflows/proto.yml'
+  pull_request:
+    paths:
+      - 'proto/**'
+      - '.github/workflows/proto.yml'
+
+name: Proto
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  proto:
+    runs-on: ubuntu-latest
+    env:
+      BUF_VERSION: 1.55.1
+      PROTOC_GEN_GO_VERSION: v1.36.11
+      PROTOC_GEN_GO_GRPC_VERSION: v1.6.1
+    steps:
+      # actions/checkout v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Fetch main for breaking baseline
+        if: github.ref != 'refs/heads/main'
+        run: git fetch --no-tags --prune origin +refs/heads/main:refs/heads/buf-breaking-base
+      # actions/setup-go v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
+        with:
+          go-version-file: 'go.mod'
+      - name: Install buf
+        run: go install github.com/bufbuild/buf/cmd/buf@v${{ env.BUF_VERSION }}
+      - name: Install protoc-gen-go
+        run: go install google.golang.org/protobuf/cmd/protoc-gen-go@${{ env.PROTOC_GEN_GO_VERSION }}
+      - name: Install protoc-gen-go-grpc
+        run: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@${{ env.PROTOC_GEN_GO_GRPC_VERSION }}
+      - name: buf breaking (against main)
+        if: github.ref != 'refs/heads/main'
+        working-directory: proto
+        run: buf breaking --against '../.git#subdir=proto,branch=buf-breaking-base'
+      - name: Clean generated proto outputs
+        run: find proto -maxdepth 1 -type f \( -name '*.pb.go' -o -name '*_grpc.pb.go' \) -delete
+      - name: buf generate
+        working-directory: proto
+        run: buf generate
+      - name: Fail on regenerated diff
+        run: |
+          # intent-to-add surfaces newly generated .pb.go that would
+          # otherwise be invisible to `git diff` (adding a .proto without
+          # committing its generated .pb.go must fail this gate).
+          git add -N proto/
+          if ! git diff --exit-code -- proto/; then
+            echo "::error::Generated proto files differ from committed output. Run 'make -C proto gen' and commit the result."
+            exit 1
+          fi
+      - name: go build
+        run: go build ./...
diff --git a/proto/Makefile b/proto/Makefile
index 35abb0dc..8a3e1e0b 100644
--- a/proto/Makefile
+++ b/proto/Makefile
@@ -1,48 +1,69 @@
-PROTOC_VERSION := libprotoc 29.3
-PROTOC_GEN_GO_VERSION := protoc-gen-go v1.36.11
-PROTOC_GEN_GO_GRPC_VERSION := protoc-gen-go-grpc 1.6.1
+BUF_VERSION := 1.55.1
+PROTOC_GEN_GO_VERSION := 1.36.11
+PROTOC_GEN_GO_GRPC_VERSION := 1.6.1
 
-.PHONY: all gen check-tools
+BUF ?= buf
+# BREAKING_AGAINST lets callers override the auto-detected baseline.
+BREAKING_AGAINST ?=
+
+.PHONY: all gen check-tools breaking clean-generated
 
 all: gen
 
 check-tools:
-	@if [ "$$(protoc --version)" != "$(PROTOC_VERSION)" ]; then \
-		echo "expected $(PROTOC_VERSION), got $$(protoc --version)"; \
+	@command -v $(BUF) >/dev/null 2>&1 || { \
+		echo "buf not found; install with:"; \
+		echo "  go install github.com/bufbuild/buf/cmd/buf@v$(BUF_VERSION)"; \
+		exit 1; \
+	}
+	@installed=$$($(BUF) --version 2>/dev/null); \
+	if [ "$$installed" != "$(BUF_VERSION)" ]; then \
+		echo "buf version mismatch: expected $(BUF_VERSION), got $$installed"; \
+		echo "install with: go install github.com/bufbuild/buf/cmd/buf@v$(BUF_VERSION)"; \
 		exit 1; \
 	fi
-	@if [ "$$(protoc-gen-go --version)" != "$(PROTOC_GEN_GO_VERSION)" ]; then \
-		echo "expected $(PROTOC_GEN_GO_VERSION), got $$(protoc-gen-go --version)"; \
+	@command -v protoc-gen-go >/dev/null 2>&1 || { \
+		echo "protoc-gen-go not found; install with:"; \
+		echo "  go install google.golang.org/protobuf/cmd/protoc-gen-go@v$(PROTOC_GEN_GO_VERSION)"; \
+		exit 1; \
+	}
+	@installed=$$(protoc-gen-go --version 2>/dev/null); \
+	if [ "$$installed" != "protoc-gen-go v$(PROTOC_GEN_GO_VERSION)" ]; then \
+		echo "protoc-gen-go version mismatch: expected v$(PROTOC_GEN_GO_VERSION), got $$installed"; \
+		echo "install with: go install google.golang.org/protobuf/cmd/protoc-gen-go@v$(PROTOC_GEN_GO_VERSION)"; \
 		exit 1; \
 	fi
-	@if [ "$$(protoc-gen-go-grpc --version)" != "$(PROTOC_GEN_GO_GRPC_VERSION)" ]; then \
-		echo "expected $(PROTOC_GEN_GO_GRPC_VERSION), got $$(protoc-gen-go-grpc --version)"; \
+	@command -v protoc-gen-go-grpc >/dev/null 2>&1 || { \
+		echo "protoc-gen-go-grpc not found; install with:"; \
+		echo "  go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v$(PROTOC_GEN_GO_GRPC_VERSION)"; \
+		exit 1; \
+	}
+	@installed=$$(protoc-gen-go-grpc --version 2>/dev/null); \
+	if [ "$$installed" != "protoc-gen-go-grpc $(PROTOC_GEN_GO_GRPC_VERSION)" ]; then \
+		echo "protoc-gen-go-grpc version mismatch: expected $(PROTOC_GEN_GO_GRPC_VERSION), got $$installed"; \
+		echo "install with: go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v$(PROTOC_GEN_GO_GRPC_VERSION)"; \
 		exit 1; \
 	fi
 
-gen: check-tools
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    service.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    internal.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    distribution.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    admin.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    dynamodb_internal.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    redis_internal.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    etcd_raft.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    admin_forward.proto
-	protoc --go_out=. --go_opt=paths=source_relative \
-	    --go-grpc_out=. --go-grpc_opt=paths=source_relative \
-	    encryption_admin.proto
+breaking: check-tools
+	@baseline='$(BREAKING_AGAINST)'; \
+	if [ -z "$$baseline" ]; then \
+		if git -C .. rev-parse --verify origin/main >/dev/null 2>&1; then \
+			git -C .. branch --force buf-breaking-base origin/main >/dev/null; \
+			baseline='../.git#subdir=proto,branch=buf-breaking-base'; \
+		elif git -C .. rev-parse --verify main >/dev/null 2>&1; then \
+			baseline='../.git#subdir=proto,branch=main'; \
+		else \
+			echo "no breaking baseline found: neither 'main' nor 'origin/main' is reachable"; \
+			echo "fetch main first (git fetch origin main) or override with BREAKING_AGAINST=..."; \
+			exit 1; \
+		fi; \
+	fi; \
+	$(BUF) breaking --against "$$baseline"
+
+clean-generated:
+	find . -maxdepth 1 -type f \( -name '*.pb.go' -o -name '*_grpc.pb.go' \) -delete
+
+gen: check-tools breaking
+	$(MAKE) clean-generated
+	$(BUF) generate
diff --git a/proto/admin.pb.go b/proto/admin.pb.go
index 68a86fd9..1467c563 100644
--- a/proto/admin.pb.go
+++ b/proto/admin.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.34.0
+// 	protoc        (unknown)
 // source: admin.proto
 
 package proto
diff --git a/proto/admin_forward.pb.go b/proto/admin_forward.pb.go
index 67865005..f7d6ac70 100644
--- a/proto/admin_forward.pb.go
+++ b/proto/admin_forward.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v5.29.3
+// 	protoc        (unknown)
 // source: admin_forward.proto
 
 package proto
diff --git a/proto/admin_forward_grpc.pb.go b/proto/admin_forward_grpc.pb.go
index 78356d82..bb23be58 100644
--- a/proto/admin_forward_grpc.pb.go
+++ b/proto/admin_forward_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v5.29.3
+// - protoc             (unknown)
 // source: admin_forward.proto
 
 package proto
diff --git a/proto/admin_grpc.pb.go b/proto/admin_grpc.pb.go
index 379805d3..021b1e83 100644
--- a/proto/admin_grpc.pb.go
+++ b/proto/admin_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v7.34.0
+// - protoc             (unknown)
 // source: admin.proto
 
 package proto
diff --git a/proto/buf.gen.yaml b/proto/buf.gen.yaml
new file mode 100644
index 00000000..c5ca49b8
--- /dev/null
+++ b/proto/buf.gen.yaml
@@ -0,0 +1,8 @@
+version: v2
+plugins:
+  - local: protoc-gen-go
+    out: .
+    opt: paths=source_relative
+  - local: protoc-gen-go-grpc
+    out: .
+    opt: paths=source_relative
diff --git a/proto/buf.yaml b/proto/buf.yaml
new file mode 100644
index 00000000..e2420f96
--- /dev/null
+++ b/proto/buf.yaml
@@ -0,0 +1,6 @@
+version: v2
+modules:
+  - path: .
+breaking:
+  use:
+    - WIRE
diff --git a/proto/distribution.pb.go b/proto/distribution.pb.go
index de927c18..11eed115 100644
--- a/proto/distribution.pb.go
+++ b/proto/distribution.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v5.29.3
+// 	protoc        (unknown)
 // source: distribution.proto
 
 package proto
diff --git a/proto/distribution_grpc.pb.go b/proto/distribution_grpc.pb.go
index 6401c072..f8d9b82e 100644
--- a/proto/distribution_grpc.pb.go
+++ b/proto/distribution_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v5.29.3
+// - protoc             (unknown)
 // source: distribution.proto
 
 package proto
diff --git a/proto/dynamodb_internal.pb.go b/proto/dynamodb_internal.pb.go
index 13fb2468..2ad37852 100644
--- a/proto/dynamodb_internal.pb.go
+++ b/proto/dynamodb_internal.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v5.29.3
+// 	protoc        (unknown)
 // source: dynamodb_internal.proto
 
 package proto
diff --git a/proto/encryption_admin.pb.go b/proto/encryption_admin.pb.go
index f3a11b50..8511ea1a 100644
--- a/proto/encryption_admin.pb.go
+++ b/proto/encryption_admin.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v5.29.6
+// 	protoc        (unknown)
 // source: encryption_admin.proto
 
 package proto
diff --git a/proto/encryption_admin_grpc.pb.go b/proto/encryption_admin_grpc.pb.go
index d9c3e0c7..9a26ee0d 100644
--- a/proto/encryption_admin_grpc.pb.go
+++ b/proto/encryption_admin_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v5.29.6
+// - protoc             (unknown)
 // source: encryption_admin.proto
 
 package proto
diff --git a/proto/etcd_raft.pb.go b/proto/etcd_raft.pb.go
index bba5e791..39db618f 100644
--- a/proto/etcd_raft.pb.go
+++ b/proto/etcd_raft.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.34.0
+// 	protoc        (unknown)
 // source: etcd_raft.proto
 
 package proto
diff --git a/proto/etcd_raft_grpc.pb.go b/proto/etcd_raft_grpc.pb.go
index 8c0a5915..11a8bcb8 100644
--- a/proto/etcd_raft_grpc.pb.go
+++ b/proto/etcd_raft_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v7.34.0
+// - protoc             (unknown)
 // source: etcd_raft.proto
 
 package proto
diff --git a/proto/internal.pb.go b/proto/internal.pb.go
index 1d87a7e6..947ca994 100644
--- a/proto/internal.pb.go
+++ b/proto/internal.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v5.29.6
+// 	protoc        (unknown)
 // source: internal.proto
 
 package proto
diff --git a/proto/internal.proto b/proto/internal.proto
index 9a7d9db8..22fc686a 100644
--- a/proto/internal.proto
+++ b/proto/internal.proto
@@ -80,5 +80,3 @@ message RelayPublishResponse {
 }
 
 
-
-
diff --git a/proto/internal_grpc.pb.go b/proto/internal_grpc.pb.go
index 841cde9f..3828db02 100644
--- a/proto/internal_grpc.pb.go
+++ b/proto/internal_grpc.pb.go
@@ -1,8 +1,8 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v7.34.0
-// source: proto/internal.proto
+// - protoc             (unknown)
+// source: internal.proto
 
 package proto
 
@@ -157,5 +157,5 @@ var Internal_ServiceDesc = grpc.ServiceDesc{
 		},
 	},
 	Streams:  []grpc.StreamDesc{},
-	Metadata: "proto/internal.proto",
+	Metadata: "internal.proto",
 }
diff --git a/proto/redis_internal.pb.go b/proto/redis_internal.pb.go
index da8cec39..f017d77a 100644
--- a/proto/redis_internal.pb.go
+++ b/proto/redis_internal.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.34.0
+// 	protoc        (unknown)
 // source: redis_internal.proto
 
 package proto
diff --git a/proto/service.pb.go b/proto/service.pb.go
index a5cbe2d5..4fe4ebda 100644
--- a/proto/service.pb.go
+++ b/proto/service.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.36.11
-// 	protoc        v7.34.0
+// 	protoc        (unknown)
 // source: service.proto
 
 package proto
diff --git a/proto/service_grpc.pb.go b/proto/service_grpc.pb.go
index 2c581ccf..484d04c6 100644
--- a/proto/service_grpc.pb.go
+++ b/proto/service_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.6.1
-// - protoc             v7.34.0
+// - protoc             (unknown)
 // source: service.proto
 
 package proto