diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
index fd97e0f3..2b2c1672 100755
--- a/hack/update-codegen.sh
+++ b/hack/update-codegen.sh
@@ -11,7 +11,22 @@ CODEGEN_IMAGE=${CODEGEN_IMAGE:-gcr.io/tanzu-user-authentication/k8s-code-generat
 function codegen() {
     PKG="$1"
     shift 1
-    docker run --rm -v "$ROOT:/go/src/$BASE_PKG" -w "/go/src/$BASE_PKG/$PKG" "${CODEGEN_IMAGE}" "$@" 2>&1 | sed "s|^|$1 ($PKG) > |"
+    if [[ ${IN_DOCKER:-0} -eq 1 ]]; then
+        # Already in a container ($CODEGEN_IMAGE).
+        mkdir -p "$(dirname /go/src/$BASE_PKG/$PKG)"
+        ln -sf "$ROOT" "/go/src/$BASE_PKG/$PKG"
+        cd "/go/src/$BASE_PKG/$PKG"
+        /codegen/entrypoint.sh "$@" 2>&1 | sed "s|^|$1 ($PKG) > |"
+    else
+        # Local workstation.
+        docker run \
+          --rm \
+          --volume "$ROOT:/go/src/$BASE_PKG" \
+          --workdir "/go/src/$BASE_PKG/$PKG" \
+          "${CODEGEN_IMAGE}" \
+          /codegen/entrypoint.sh "$@" 2>&1 \
+          | sed "s|^|$1 ($PKG) > |"
+    fi
 }
 
 codegen kubernetes/1.19/api generate-groups deepcopy,defaulter \
diff --git a/hack/verify.sh b/hack/verify.sh
index d23e3896..375242d1 100755
--- a/hack/verify.sh
+++ b/hack/verify.sh
@@ -6,6 +6,4 @@ set -euo pipefail
 ROOT="$(realpath "$(dirname "${BASH_SOURCE[0]}")/..")"
 
 "$ROOT/hack/module.sh" lint
-
-# TODO: re-enable once we figure out how to run docker in CI
-#"$ROOT/hack/verify-codegen.sh"
+"$ROOT/hack/verify-codegen.sh"