diff --git a/client/proto/generate.sh b/client/proto/generate.sh
index e659cef90..2ea9dc4bc 100755
--- a/client/proto/generate.sh
+++ b/client/proto/generate.sh
@@ -9,9 +9,21 @@ then
 fi
 
 old_pwd=$(pwd)
-script_path=$(dirname $(realpath "$0"))
+script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
-go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.6
-go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1
+
+repo_root=$(git rev-parse --show-toplevel)
+# shellcheck source=/dev/null
+. "$repo_root/proto-tools.env"
+
+actual_protoc=$(protoc --version | awk '{print $2}')
+if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+  echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
+  echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
+  exit 1
+fi
+
+go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}"
+go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}"
 protoc -I ./ ./daemon.proto --go_out=../ --go-grpc_out=../ --experimental_allow_proto3_optional
 cd "$old_pwd"
diff --git a/encryption/testprotos/generate.sh b/encryption/testprotos/generate.sh
index 0ce6ebdea..d4a969cf1 100755
--- a/encryption/testprotos/generate.sh
+++ b/encryption/testprotos/generate.sh
@@ -1,2 +1,28 @@
 #!/bin/bash
-protoc -I testprotos/ testprotos/testproto.proto --go_out=.
\ No newline at end of file
+set -e
+
+if ! which realpath > /dev/null 2>&1
+then
+  echo realpath is not installed
+  echo run: brew install coreutils
+  exit 1
+fi
+
+old_pwd=$(pwd)
+script_path=$(dirname "$(realpath "$0")")
+cd "$script_path/.."
+
+repo_root=$(git rev-parse --show-toplevel)
+# shellcheck source=/dev/null
+. "$repo_root/proto-tools.env"
+
+actual_protoc=$(protoc --version | awk '{print $2}')
+if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+  echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
+  echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
+  exit 1
+fi
+
+go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}"
+protoc -I testprotos/ testprotos/testproto.proto --go_out=.
+cd "$old_pwd"
diff --git a/flow/proto/generate.sh b/flow/proto/generate.sh
index 6bbf78e61..314d2aa2b 100755
--- a/flow/proto/generate.sh
+++ b/flow/proto/generate.sh
@@ -9,9 +9,21 @@ then
 fi
 
 old_pwd=$(pwd)
-script_path=$(dirname $(realpath "$0"))
+script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
-go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.26
-go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1
+
+repo_root=$(git rev-parse --show-toplevel)
+# shellcheck source=/dev/null
+. "$repo_root/proto-tools.env"
+
+actual_protoc=$(protoc --version | awk '{print $2}')
+if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+  echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
+  echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
+  exit 1
+fi
+
+go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}"
+go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}"
 protoc -I ./ ./flow.proto --go_out=../ --go-grpc_out=../
 cd "$old_pwd"
diff --git a/proto-tools.env b/proto-tools.env
new file mode 100644
index 000000000..a845f6c9e
--- /dev/null
+++ b/proto-tools.env
@@ -0,0 +1,14 @@
+# Pinned protobuf code-generation toolchain.
+# Sourced by every proto generate.sh and the proto-generation-check CI workflow.
+# When bumping a version, regenerate all *.pb.go files in the same PR.
+
+# protoc release tag from https://github.com/protocolbuffers/protobuf/releases
+# `protoc --version` reports `libprotoc ${PROTOC_VERSION}`.
+# Generated pb.go headers embed `protoc v6.${PROTOC_VERSION}`.
+PROTOC_VERSION="33.1"
+
+# google.golang.org/protobuf/cmd/protoc-gen-go
+PROTOC_GEN_GO_VERSION="v1.36.6"
+
+# google.golang.org/grpc/cmd/protoc-gen-go-grpc
+PROTOC_GEN_GO_GRPC_VERSION="v1.6.1"
diff --git a/shared/management/proto/generate.sh b/shared/management/proto/generate.sh
index 7cb0f75a5..753e5c244 100755
--- a/shared/management/proto/generate.sh
+++ b/shared/management/proto/generate.sh
@@ -9,10 +9,22 @@ then
 fi
 
 old_pwd=$(pwd)
-script_path=$(dirname $(realpath "$0"))
+script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
-go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.26
-go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1
+
+repo_root=$(git rev-parse --show-toplevel)
+# shellcheck source=/dev/null
+. "$repo_root/proto-tools.env"
+
+actual_protoc=$(protoc --version | awk '{print $2}')
+if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+  echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
+  echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
+  exit 1
+fi
+
+go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}"
+go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}"
 protoc -I ./ ./management.proto --go_out=../ --go-grpc_out=../
 protoc -I ./ ./proxy_service.proto --go_out=../ --go-grpc_out=../
 cd "$old_pwd"
diff --git a/shared/signal/proto/generate.sh b/shared/signal/proto/generate.sh
index 720a5ff66..7499adc6f 100755
--- a/shared/signal/proto/generate.sh
+++ b/shared/signal/proto/generate.sh
@@ -9,9 +9,21 @@ then
 fi
 
 old_pwd=$(pwd)
-script_path=$(dirname $(realpath "$0"))
+script_path=$(dirname "$(realpath "$0")")
 cd "$script_path"
-go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.26
-go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.1
+
+repo_root=$(git rev-parse --show-toplevel)
+# shellcheck source=/dev/null
+. "$repo_root/proto-tools.env"
+
+actual_protoc=$(protoc --version | awk '{print $2}')
+if [ "$actual_protoc" != "$PROTOC_VERSION" ]; then
+  echo "ERROR: protoc version $actual_protoc differs from pinned $PROTOC_VERSION" >&2
+  echo "Install protoc $PROTOC_VERSION from https://github.com/protocolbuffers/protobuf/releases" >&2
+  exit 1
+fi
+
+go install "google.golang.org/protobuf/cmd/protoc-gen-go@${PROTOC_GEN_GO_VERSION}"
+go install "google.golang.org/grpc/cmd/protoc-gen-go-grpc@${PROTOC_GEN_GO_GRPC_VERSION}"
 protoc -I ./ ./signalexchange.proto --go_out=../ --go-grpc_out=../
-cd "$old_pwd"
\ No newline at end of file
+cd "$old_pwd"
diff --git a/shared/signal/proto/signalexchange.pb.go b/shared/signal/proto/signalexchange.pb.go
index 0c80fb489..c573e9610 100644
--- a/shared/signal/proto/signalexchange.pb.go
+++ b/shared/signal/proto/signalexchange.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.26.0
-// 	protoc        v3.21.12
+// 	protoc        v6.33.1
 // source: signalexchange.proto
 
 package proto