diff --git a/.github/workflows/check-sqlite-update.yml b/.github/workflows/check-sqlite-update.yml
new file mode 100644
index 0000000..1cbc09d
--- /dev/null
+++ b/.github/workflows/check-sqlite-update.yml
@@ -0,0 +1,34 @@
+name: check-sqlite-update
+
+# Re-runs update-sqlite.sh against the URL recorded in version-url.txt and
+# checks that it reproduces exactly what is checked in.
+
+on:
+  pull_request:
+    paths:
+      - check-sqlite-update.yml
+      - version-url.txt
+      - update-sqlite.sh
+      - cgosqlite/**
+
+permissions:
+  contents: read
+
+jobs:
+  reproducible:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+    - name: Run update-sqlite.sh
+      run: ./update-sqlite.sh
+
+    - name: Check the working tree is unchanged
+      run: |
+        if [[ -n "$(git status --porcelain)" ]]; then
+          echo "::error::update-sqlite.sh did not reproduce the checked-in files"
+          git status --porcelain
+          git diff --stat
+          echo "::error::Please update version-url.txt and/or run update-sqlite.sh and commit the changes."
+          exit 1
+        fi
diff --git a/README.md b/README.md
index d944265..52d3549 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,8 @@ Work in progress. Nothing to see here.
 ## Updating SQLite
 
 The script `update-sqlite.sh` at the top of the repository partially automates
-this process. It expects a SQLite amalgamation URL as the first argument:
+this process. It accepts a SQLite amalgamation URL as the first argument, or
+otherwise uses the URL recorded in [version-url.txt](./version-url.txt):
 
 ```
 ./update-sqlite.sh https://sqlite.org/2024/sqlite-amalgamation-3460100.zip
diff --git a/update-sqlite.sh b/update-sqlite.sh
index e22a3a9..4dfd0e0 100755
--- a/update-sqlite.sh
+++ b/update-sqlite.sh
@@ -1,11 +1,17 @@
 #!/bin/bash
 
+repodir="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
+
 usage() {
 	echo "$0 [sqlite-amalgamation-url]"
 	echo
 	echo "Lookup the URL to a SQLite amalgamation zip on https://sqlite.org"
 	echo "Pass that URL to this tool, e.g."
 	echo "  $0 https://sqlite.org/2024/sqlite-amalgamation-3460100.zip"
+	echo
+	echo "With no argument, re-runs against the URL already recorded in"
+	echo "version-url.txt, which should leave the tree unchanged. CI does"
+	echo "this to prove the vendored files are exactly the script's output."
 }
 
 fatal() {
@@ -14,7 +20,13 @@ fatal() {
 }
 
 case "$1" in
-	https://sqlite.org/*) ;;
+	https://sqlite.org/*)
+		url="$1"
+		;;
+	"")
+		url=$(tr -d '[:space:]' < "$repodir/version-url.txt") || exit 1
+		echo "$url"
+		;;
 	-h|--help|help)
 		usage
 		exit
@@ -25,9 +37,8 @@ case "$1" in
 		;;
 esac
 
-cd "$( dirname "${BASH_SOURCE[0]}" )"/cgosqlite || fatal "Not in correct directory"
+cd "$repodir/cgosqlite" || fatal "Not in correct directory"
 
-url="$1"
 filename=$(basename "$url")
 dirname=$(basename -s .zip "$filename")
 [[ -n "$filename" ]] || fatal "Could not extract filename from $url"
@@ -35,7 +46,7 @@ dirname=$(basename -s .zip "$filename")
 
 trap "rm -rf ./${filename} ./${dirname}" EXIT
 
-curl -O "$1" || fatal "Download of $url failed"
+curl -O "$url" || fatal "Download of $url failed"
 [[ -f "$filename" ]] || fatal "File $filename not found after download"
 unzip "$filename" || fatal "Unzip of $filename failed"
 [[ -d "$dirname" ]] || fatal "Directory $dirname missing after unzip"
diff --git a/version-url.txt b/version-url.txt
new file mode 100644
index 0000000..f28fac5
--- /dev/null
+++ b/version-url.txt
@@ -0,0 +1 @@
+https://sqlite.org/2026/sqlite-amalgamation-3530100.zip
\ No newline at end of file