diff --git a/Dockerfile b/Dockerfile
index 5e432e84..b8705d31 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -197,6 +197,11 @@ RUN --mount=type=bind,target=. \
     buf lint
 
 FROM proto-base AS do-proto-generate
+ARG CONNECT_GO_COMMIT
+RUN --mount=type=cache,target=/root/.cache/go-build \
+    --mount=type=cache,target=/go/pkg/mod \
+    --mount=type=tmpfs,target=/go/src/ \
+    go install "connectrpc.com/connect/cmd/protoc-gen-connect-go@${CONNECT_GO_COMMIT}"
 WORKDIR /src
 RUN mkdir -p /generate/out
 RUN --mount=type=bind,target=.,rw <<EOT
diff --git a/Makefile b/Makefile
index ca238126..9898f00f 100644
--- a/Makefile
+++ b/Makefile
@@ -3,6 +3,9 @@ GO_VERSION := $(shell sh -c "awk '/^go / { print \$$2 }' go.work")
 
 # For latest version, see: https://github.com/bufbuild/buf/tags
 export BUF_VERSION := v1.56.0
+# protoc-gen-connect-go, pinned by commit. Keep in step with connectrpc.com/connect in go.mod.
+# v1.19.1: https://github.com/connectrpc/connect-go/releases/tag/v1.19.1
+export CONNECT_GO_COMMIT := ad9598763248cc291416c2e956ecd50d128a19bf
 
 ifeq ($(OS),Windows_NT)
 	WINDOWS = $(OS)
@@ -25,6 +28,7 @@ BUILDER=buildx-multiarch
 DOCKER_BUILD_ARGS := --build-arg GO_VERSION \
           			--build-arg GOLANGCI_LINT_VERSION \
           			--build-arg BUF_VERSION \
+          			--build-arg CONNECT_GO_COMMIT \
           			--build-arg GIT_TAG
 
 GO_TEST := go test
diff --git a/buf.gen.yaml b/buf.gen.yaml
index 58342593..9156c251 100644
--- a/buf.gen.yaml
+++ b/buf.gen.yaml
@@ -8,7 +8,8 @@ plugins:
     opt:
       - paths=source_relative
       - default_api_level=API_OPAQUE
-  - remote: buf.build/connectrpc/go
+  # Installed in the Dockerfile, pinned by commit via CONNECT_GO_COMMIT in the Makefile.
+  - local: protoc-gen-connect-go
     out: x/api
     opt:
       - paths=source_relative