diff --git a/.github/workflows/dbt-factory-vendor-sync.yml b/.github/workflows/dbt-factory-vendor-sync.yml
new file mode 100644
index 0000000..7ecf435
--- /dev/null
+++ b/.github/workflows/dbt-factory-vendor-sync.yml
@@ -0,0 +1,108 @@
+name: dbt-factory vendor sync
+
+# Verifies the vendored copy of databricks-dbt-factory has not drifted:
+#   1. each vendored core file is byte-identical to the upstream release named in NOTICE;
+#   2. the example and template copies are byte-identical to each other;
+#   3. both NOTICE files cite the same upstream commit.
+# The upstream commit is read from contrib/dbt_factory/NOTICE, so bumping the vendored
+# version is a one-line NOTICE change and this check re-pins to it automatically.
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+    paths:
+      - 'contrib/dbt_factory/**'
+      - 'contrib/templates/dbt-factory/**'
+      - '.github/workflows/dbt-factory-vendor-sync.yml'
+  merge_group:
+    types: [checks_requested]
+
+jobs:
+  byte-identical:
+    runs-on:
+      group: databricks-protected-runner-group
+      labels: linux-ubuntu-latest
+
+    env:
+      UPSTREAM_REPO: https://github.com/mwojtyczka/databricks-dbt-factory
+      EXAMPLE_CORE: contrib/dbt_factory/src/databricks_dbt_factory
+      TEMPLATE_CORE: contrib/templates/dbt-factory/template/{{.project_name}}/src/databricks_dbt_factory
+      EXAMPLE_NOTICE: contrib/dbt_factory/NOTICE
+      TEMPLATE_NOTICE: contrib/templates/dbt-factory/template/{{.project_name}}/NOTICE
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Verify vendored core is byte-identical to upstream
+        shell: bash
+        run: |-
+          set -euo pipefail
+
+          # --- 1. Read the pinned upstream commit from the example NOTICE ---
+          notice_sha() { grep -oE 'commit [0-9a-f]{40}' "$1" | head -1 | awk '{print $2}'; }
+          sha="$(notice_sha "$EXAMPLE_NOTICE")"
+          if [ -z "$sha" ]; then
+            echo "::error file=$EXAMPLE_NOTICE::could not find an 'Adapted from: commit <40-hex>' line"
+            exit 1
+          fi
+          version="$(grep -oE '\(v[0-9]+\.[0-9]+\.[0-9]+\)' "$EXAMPLE_NOTICE" | head -1 | tr -d '()')"
+          echo "Vendored upstream commit: $sha (${version:-unknown version})"
+
+          # --- 2. Both NOTICE files must cite the same commit ---
+          tpl_sha="$(notice_sha "$TEMPLATE_NOTICE")"
+          if [ "$sha" != "$tpl_sha" ]; then
+            echo "::error::NOTICE files disagree on the upstream commit:"
+            echo "  $EXAMPLE_NOTICE  -> $sha"
+            echo "  $TEMPLATE_NOTICE -> ${tpl_sha:-<none>}"
+            exit 1
+          fi
+
+          # --- 3. Fetch upstream at exactly that commit ---
+          up="$(mktemp -d)"
+          git init --quiet "$up"
+          git -C "$up" remote add origin "$UPSTREAM_REPO"
+          git -C "$up" fetch --quiet --depth 1 origin "$sha"
+          git -C "$up" checkout --quiet FETCH_HEAD
+          up_core="$up/src/databricks_dbt_factory"
+
+          fail=0
+
+          # --- 4. The two vendored copies must contain the same set of files ---
+          if ! diff <(cd "$EXAMPLE_CORE" && find . -type f | sort) \
+                    <(cd "$TEMPLATE_CORE" && find . -type f | sort) >/dev/null; then
+            echo "::error::example and template vendored copies contain different files:"
+            diff <(cd "$EXAMPLE_CORE" && find . -type f | sort) \
+                 <(cd "$TEMPLATE_CORE" && find . -type f | sort) || true
+            fail=1
+          fi
+
+          # --- 5. Every vendored file: identical to upstream, and identical across copies ---
+          while IFS= read -r rel; do
+            ex="$EXAMPLE_CORE/$rel"
+            tpl="$TEMPLATE_CORE/$rel"
+            upf="$up_core/$rel"
+
+            if [ ! -f "$upf" ]; then
+              echo "::error file=$ex::vendored file '$rel' does not exist in upstream $sha"
+              fail=1
+              continue
+            fi
+            if ! cmp -s "$ex" "$upf"; then
+              echo "::error file=$ex::'$rel' differs from upstream $sha"
+              diff -u "$upf" "$ex" | head -40 || true
+              fail=1
+            fi
+            if ! cmp -s "$ex" "$tpl"; then
+              echo "::error file=$tpl::template copy of '$rel' differs from the example copy"
+              diff -u "$ex" "$tpl" | head -40 || true
+              fail=1
+            fi
+          done < <(cd "$EXAMPLE_CORE" && find . -type f | sed 's|^\./||' | sort)
+
+          if [ "$fail" -ne 0 ]; then
+            echo "::error::vendored databricks-dbt-factory has drifted from upstream $sha."
+            echo "Re-vendor from upstream at that commit (or update NOTICE if the version changed) so the copies match."
+            exit 1
+          fi
+          echo "OK: both vendored copies are byte-identical to upstream $sha and to each other."