diff --git a/WORKSPACE b/WORKSPACE
index 6997cde27..3871b68aa 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -1,4 +1,4 @@
-# gazelle:repository_macro repos.bzl%go_repositories
+# gazelle:repository_macro hack/build/repos.bzl%go_repositories
 workspace(name = "com_github_jetstack_cert_manager")
 
 load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
@@ -126,6 +126,6 @@ load("@brodocs_modules//:install_bazel_dependencies.bzl", "install_bazel_depende
 
 install_bazel_dependencies()
 
-load("//:repos.bzl", "go_repositories")
+load("//hack/build:repos.bzl", "go_repositories")
 
 go_repositories()
diff --git a/repos.bzl b/hack/build/repos.bzl
similarity index 99%
rename from repos.bzl
rename to hack/build/repos.bzl
index 07e343b09..4505af5d9 100644
--- a/repos.bzl
+++ b/hack/build/repos.bzl
@@ -12,6 +12,8 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This file is automatically updated by hack/update-deps.sh
+
 load("@bazel_gazelle//:deps.bzl", "go_repository")
 
 def go_repositories():
diff --git a/hack/update-deps.sh b/hack/update-deps.sh
index b021ac330..4b84d23fb 100755
--- a/hack/update-deps.sh
+++ b/hack/update-deps.sh
@@ -89,7 +89,7 @@ esac
 rm -rf vendor
 "$go" mod tidy
 "$gazelle" update-repos \
-  --from_file=go.mod --to_macro=repos.bzl%go_repositories \
+  --from_file=go.mod --to_macro=hack/build/repos.bzl%go_repositories \
   --build_file_generation=on --build_file_proto_mode=disable
 "${update_bazel[@]}" # TODO(fejta): do we still need to do this?
 "${update_deps_licenses[@]}"