diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1609db2a8a43..3f6ded7e16be 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -57,6 +57,17 @@ After running for a while, the command should print
 ```
 ALL TESTS PASSED
 ```
+## Vendoring
+
+We keep a cached copy of dependencies within the `vendor/` directory,
+managing updates via [govendor](http://github.com/kardianos/govendor).
+
+Pull requests should only include `vendor/` updates if they are
+part of the same change, be it a bugfix or a feature addition.
+
+The `vendor/` update needs to be justified as part of the PR description,
+and must be verified by the reviewers and/or merger to always reference
+an existing upstream commit.
 
 ## Code review