diff --git a/.github/workflows/.dco.yml b/.github/workflows/.dco.yml
new file mode 100644
index 0000000000..34b3206b9a
--- /dev/null
+++ b/.github/workflows/.dco.yml
@@ -0,0 +1,48 @@
+# reusable workflow
+name: .dco
+
+# TODO: hide reusable workflow from the UI. Tracked in https://github.com/community/community/discussions/12025
+
+on:
+  workflow_call:
+
+env:
+  ALPINE_VERSION: 3.16
+
+jobs:
+  run:
+    runs-on: ubuntu-20.04
+    steps:
+      -
+        name: Checkout
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+      -
+        name: Dump context
+        uses: actions/github-script@v6
+        with:
+          script: |
+            console.log(JSON.stringify(context, null, 2));
+      -
+        name: Get base ref
+        id: base-ref
+        uses: actions/github-script@v6
+        with:
+          result-encoding: string
+          script: |
+            if (/^refs\/pull\//.test(context.ref) && context.payload?.pull_request?.base?.ref != undefined) {
+              return context.payload.pull_request.base.ref;
+            }
+            return context.ref.replace(/^refs\/heads\//g, '');
+      -
+        name: Validate
+        run: |
+          docker run --rm \
+            -v "$(pwd):/workspace" \
+            -e VALIDATE_REPO \
+            -e VALIDATE_BRANCH \
+            alpine:${{ env.ALPINE_VERSION }} sh -c 'apk add --no-cache -q bash git openssh-client && git config --system --add safe.directory /workspace && cd /workspace && hack/validate/dco'
+        env:
+          VALIDATE_REPO: ${{ github.server_url }}/${{ github.repository }}.git
+          VALIDATE_BRANCH: ${{ steps.base-ref.outputs.result }}
diff --git a/.github/workflows/.windows.yml b/.github/workflows/.windows.yml
index cd9ee88832..e1c740d982 100644
--- a/.github/workflows/.windows.yml
+++ b/.github/workflows/.windows.yml
@@ -1,6 +1,8 @@
 # reusable workflow
 name: .windows
 
+# TODO: hide reusable workflow from the UI. Tracked in https://github.com/community/community/discussions/12025
+
 on:
   workflow_call:
     inputs:
diff --git a/.github/workflows/buildkit.yml b/.github/workflows/buildkit.yml
index f4a20003e7..9f1442a8ce 100644
--- a/.github/workflows/buildkit.yml
+++ b/.github/workflows/buildkit.yml
@@ -16,8 +16,13 @@ env:
   BUNDLES_OUTPUT: ./bundles
 
 jobs:
+  validate-dco:
+    uses: ./.github/workflows/.dco.yml
+
   build:
     runs-on: ubuntu-20.04
+    needs:
+      - validate-dco
     steps:
       -
         name: Checkout
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abadd40246..655cf7b22f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,8 +18,13 @@ env:
   BUNDLES_OUTPUT: ./bundles
 
 jobs:
+  validate-dco:
+    uses: ./.github/workflows/.dco.yml
+
   build:
     runs-on: ubuntu-20.04
+    needs:
+      - validate-dco
     strategy:
       fail-fast: false
       matrix:
@@ -54,6 +59,8 @@ jobs:
 
   cross:
     runs-on: ubuntu-20.04
+    needs:
+      - validate-dco
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0f3628f323..701df02002 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,8 +24,13 @@ env:
   DOCKER_GRAPHDRIVER: overlay2
 
 jobs:
+  validate-dco:
+    uses: ./.github/workflows/.dco.yml
+
   build-dev:
     runs-on: ubuntu-20.04
+    needs:
+      - validate-dco
     strategy:
       fail-fast: false
       matrix:
@@ -91,23 +96,6 @@ jobs:
         uses: actions/checkout@v3
         with:
           fetch-depth: 0
-      -
-        name: Dump context
-        uses: actions/github-script@v6
-        with:
-          script: |
-            console.log(JSON.stringify(context, null, 2));
-      -
-        name: Get base ref
-        id: base-ref
-        uses: actions/github-script@v6
-        with:
-          result-encoding: string
-          script: |
-            if (/^refs\/pull\//.test(context.ref) && context.payload?.pull_request?.base?.ref != undefined) {
-              return context.payload.pull_request.base.ref;
-            }
-            return context.ref.replace(/^refs\/heads\//g, '');
       -
         name: Set up runner
         uses: ./.github/actions/setup-runner
@@ -125,15 +113,11 @@ jobs:
         name: Validate
         run: |
           make -o build validate-${{ matrix.script }}
-        env:
-          VALIDATE_REPO: ${{ github.server_url }}/${{ github.repository }}.git
-          VALIDATE_BRANCH: ${{ steps.base-ref.outputs.result }}
 
   unit:
     runs-on: ubuntu-20.04
     needs:
       - build-dev
-      - validate
     steps:
       -
         name: Checkout
@@ -183,7 +167,6 @@ jobs:
     runs-on: ubuntu-20.04
     needs:
       - build-dev
-      - validate
     steps:
       -
         name: Checkout
@@ -231,7 +214,6 @@ jobs:
     runs-on: ubuntu-20.04
     needs:
       - build-dev
-      - validate
     steps:
       -
         name: Checkout
@@ -260,7 +242,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     needs:
       - build-dev
-      - validate
     strategy:
       fail-fast: false
       matrix:
@@ -343,6 +324,8 @@ jobs:
 
   integration-cli-prepare:
     runs-on: ubuntu-20.04
+    needs:
+      - validate-dco
     outputs:
       matrix: ${{ steps.tests.outputs.matrix }}
     steps:
@@ -377,7 +360,6 @@ jobs:
     runs-on: ubuntu-20.04
     needs:
       - build-dev
-      - validate
       - integration-cli-prepare
     strategy:
       fail-fast: false
diff --git a/.github/workflows/windows-2019.yml b/.github/workflows/windows-2019.yml
index 22100f69c5..4231ab2946 100644
--- a/.github/workflows/windows-2019.yml
+++ b/.github/workflows/windows-2019.yml
@@ -10,7 +10,12 @@ on:
   workflow_dispatch:
 
 jobs:
+  validate-dco:
+    uses: ./.github/workflows/.dco.yml
+
   run:
+    needs:
+      - validate-dco
     uses: ./.github/workflows/.windows.yml
     with:
       os: windows-2019
diff --git a/.github/workflows/windows-2022.yml b/.github/workflows/windows-2022.yml
index 29545f11f8..933ce5b0c9 100644
--- a/.github/workflows/windows-2022.yml
+++ b/.github/workflows/windows-2022.yml
@@ -13,7 +13,12 @@ on:
   pull_request:
 
 jobs:
+  validate-dco:
+    uses: ./.github/workflows/.dco.yml
+
   run:
+    needs:
+      - validate-dco
     uses: ./.github/workflows/.windows.yml
     with:
       os: windows-2022