diff --git a/Makefile b/Makefile
index 0aa4e7c77cd..316576123b7 100644
--- a/Makefile
+++ b/Makefile
@@ -85,7 +85,7 @@ help:
 	@echo '    tarball-release   - build Tetragon release tarball'
 	@echo 'Generated files:'
 	@echo '    codegen           - generate code based on .proto files'
-	@echo '    generate          - generate kubebuilder files'
+	@echo '    crds              - generate kubebuilder files'
 	@echo 'Linting and chores:'
 	@echo '    vendor            - tidy and vendor Go modules'
 	@echo '    clang-format      - run code formatter on BPF code'
@@ -290,8 +290,9 @@ tarball-clean:
 fetch-testdata:
 	wget -nc -P testdata/btf 'https://github.com/cilium/tetragon-testdata/raw/main/btf/vmlinux-5.4.104+'
 
-.PHONY: generate codegen protoc-gen-go-tetragon
-generate:
+.PHONY: crdgen generate codegen protoc-gen-go-tetragon
+generate: | crds
+crds:
 	# Need to call vendor twice here, once before and once after generate, the reason
 	# being we need to grab changes first plus pull in whatever gets generated here.
 	$(MAKE) vendor
diff --git a/docs/content/en/docs/contribution-guide/development-setup.md b/docs/content/en/docs/contribution-guide/development-setup.md
index 8ad53a42ecf..52929880c3e 100644
--- a/docs/content/en/docs/contribution-guide/development-setup.md
+++ b/docs/content/en/docs/contribution-guide/development-setup.md
@@ -70,7 +70,7 @@ make codegen
 
 And to run k8s CRD generation, run the following command from the root of the repository:
 ```shell
-make generate
+make crds
 ```
 
 Finally, should you wish to modify any of the resulting codegen files (ending
diff --git a/pkg/k8s/Makefile b/pkg/k8s/Makefile
index 0d3e5af0cbf..8df9acba95f 100644
--- a/pkg/k8s/Makefile
+++ b/pkg/k8s/Makefile
@@ -1,3 +1,5 @@
+# renovate: datasource=docker
+BUILDER_IMAGE=docker.io/library/golang:1.20.5@sha256:fd9306e1c664bd49a11d4a4a04e41303430e069e437d137876e9290a555e06fb
 GO ?= go
 VERSION=$(shell git describe --tags --always)
 GO_GCFLAGS ?= ""
@@ -10,18 +12,26 @@ GOLANGCILINT_VERSION = $(shell golangci-lint version 2>/dev/null)
 
 all: generate
 
-.PHONY: generate
-
 .PHONY: help
 help:
 	@echo 'Generated files:'
-	@echo '    generate          - genereate kubebuilder files'
+	@echo '    generate          - generate kubebuilder files'
 
 ifeq (1,$(NOOPT))
 GO_GCFLAGS = "all=-N -l"
 endif
 
+.PHONY: generate
 generate:
+	docker container run --rm \
+		--volume $(CURDIR)/../..:/src \
+		--user "$(shell id -u):$(shell id -g)" \
+		--env GOCACHE=/go/.cache \
+		$(BUILDER_IMAGE) \
+		make -C /src/pkg/k8s __do_generate
+
+.PHONY: __do_generate
+__do_generate:
 	./tools/controller-gen crd paths=./apis/... output:dir=apis/cilium.io/client/crds/v1alpha1
 	# Do two invocations of generate-groups.sh, one with --plural-exceptions, one without
 	export GOPATH=$$(go env GOPATH); \