diff --git a/hack/module.sh b/hack/module.sh
index 665b9a34..1d3005d4 100755
--- a/hack/module.sh
+++ b/hack/module.sh
@@ -42,13 +42,21 @@ function with_modules() {
   local cmd_function="${1}"
   cmd="$(${cmd_function})"
 
+  # start the cache mutation detector by default so that cache mutators will be found
+  local kube_cache_mutation_detector="${KUBE_CACHE_MUTATION_DETECTOR:-true}"
+
+  # panic the server on watch decode errors since they are considered coder mistakes
+  local kube_panic_watch_decode_error="${KUBE_PANIC_WATCH_DECODE_ERROR:-true}"
+
+  env_vars="KUBE_CACHE_MUTATION_DETECTOR=${kube_cache_mutation_detector} KUBE_PANIC_WATCH_DECODE_ERROR=${kube_panic_watch_decode_error}"
+
   pushd "${ROOT}" >/dev/null
   for mod_file in $(find . -maxdepth 4 -not -path "./generated/*" -name go.mod | sort); do
     mod_dir="$(dirname "${mod_file}")"
     (
       echo "=> "
-      echo "   cd ${mod_dir} && ${cmd}"
-      cd "${mod_dir}" && ${cmd}
+      echo "   cd ${mod_dir} && ${env_vars} ${cmd}"
+      cd "${mod_dir}" && env ${env_vars} ${cmd}
     )
   done
   popd >/dev/null
diff --git a/internal/controller/controller_test.go b/internal/controller/controller_test.go
new file mode 100644
index 00000000..bfb35495
--- /dev/null
+++ b/internal/controller/controller_test.go
@@ -0,0 +1,27 @@
+// Copyright 2020 the Pinniped contributors. All Rights Reserved.
+// SPDX-License-Identifier: Apache-2.0
+
+package controller
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"k8s.io/client-go/tools/cache"
+)
+
+func TestCacheMutationDetectorEnabled(t *testing.T) {
+	// this is a bit of simplistic test to check if we have a real cache mutation detector.
+	// if we actually start mutating an informer cache in this test, the test will almost
+	// always fail because the go race detector will see the mutation.
+	// the cache mutation detector will certainly make certain races more common and thus
+	// easily detected by the race detector, but its real use is against a compiled binary
+	// such as pinniped-server running in a pod - that binary has no race detector at runtime.
+
+	c := cache.NewCacheMutationDetector("test pinniped")
+
+	type realCacheMutationDetector interface {
+		CompareObjects() // this is brittle, but this function name has never changed...
+	}
+	require.Implementsf(t, (*realCacheMutationDetector)(nil), c, "%T is not a real cache mutation detector", c)
+}