diff --git a/Makefile b/Makefile
index 0408cf500eea..37fa33e1dfea 100644
--- a/Makefile
+++ b/Makefile
@@ -1560,17 +1560,7 @@ bin/.docgen_http: bin/docgen bin/.bootstrap
 .PHONY: docs/generated/redact_safe.md
 
 docs/generated/redact_safe.md:
-	@(echo "The following types are considered always safe for reporting:"; echo; \
-	  echo "File | Type"; echo "--|--") >$@.tmp || { rm -f $@.tmp; exit 1; }
-	@git grep --recurse-submodules -n '^func \(.*\) SafeValue\(\)' | \
-	  grep -v '^vendor/github.com/cockroachdb/redact' | \
-	  sed -E -e 's/^([^:]*):[0-9]+:func \(([^ ]* )?(.*)\) SafeValue.*$$/\1 | \`\3\`/g' | \
-	  sort >>$@.tmp || { rm -f $@.tmp; exit 1; }
-	@git grep --recurse-submodules -n 'redact\.RegisterSafeType' | \
-	  grep -vE '^([^:]*):[0-9]+:[ 	]*//' | \
-	  grep -v '^vendor/github.com/cockroachdb/redact' | \
-	  sed -E -e 's/^([^:]*):[0-9]+:.*redact\.RegisterSafeType\((.*)\).*/\1 | \`\2\`/g' | \
-	  sort  >>$@.tmp || { rm -f $@.tmp; exit 1; }
+	./build/bazelutil/generate_redact_safe.sh >$@.tmp || { rm -f $@.tmp; exit 1; }
 	@mv -f $@.tmp $@
 
 EVENTLOG_PROTOS = \
diff --git a/build/bazelutil/generate_redact_safe.sh b/build/bazelutil/generate_redact_safe.sh
new file mode 100755
index 000000000000..b4dedbdbeea2
--- /dev/null
+++ b/build/bazelutil/generate_redact_safe.sh
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+echo "The following types are considered always safe for reporting:"
+echo
+echo "File | Type"; echo "--|--"
+git grep --recurse-submodules -n '^func \(.*\) SafeValue\(\)' | \
+    grep -v '^vendor/github.com/cockroachdb/redact' | \
+    sed -E -e 's/^([^:]*):[0-9]+:func \(([^ ]* )?(.*)\) SafeValue.*$$/\1 | \`\3\`/g' | \
+    sort
+git grep --recurse-submodules -n 'redact\.RegisterSafeType' | \
+    grep -vE '^([^:]*):[0-9]+:[ 	]*//' | \
+    grep -v '^vendor/github.com/cockroachdb/redact' | \
+    sed -E -e 's/^([^:]*):[0-9]+:.*redact\.RegisterSafeType\((.*)\).*/\1 | \`\2\`/g' | \
+    sort
diff --git a/build/teamcity/cockroach/ci/builds/build_linux_x86_64.sh b/build/teamcity/cockroach/ci/builds/build_linux_x86_64.sh
index 4190340fb318..a5f863d7203b 100755
--- a/build/teamcity/cockroach/ci/builds/build_linux_x86_64.sh
+++ b/build/teamcity/cockroach/ci/builds/build_linux_x86_64.sh
@@ -25,6 +25,7 @@ do
     then
         echo "File $FILE does not match with checked-in version. Got diff:"
         echo "$RESULT"
+	echo "Run './dev generate docs'"
         FAILED=1
     fi
 done
@@ -47,6 +48,12 @@ do
         FAILED=1
     fi
 done
+REAL_REDACT_SAFE=$($root/build/bazelutil/generate_redact_safe.sh)
+RESULT=$(diff <(echo "$REAL_REDACT_SAFE") $root/docs/generated/redact_safe.md)
+if [[ ! $? -eq 0 ]]
+then
+    echo "docs/generated/redact_safe.md is not up-to-date. Run './dev generate docs'"
+fi
 
 if [[ ! -z "$FAILED" ]]
 then
diff --git a/pkg/cmd/dev/generate.go b/pkg/cmd/dev/generate.go
index a1248fe93cc8..d4a3bdc595d4 100644
--- a/pkg/cmd/dev/generate.go
+++ b/pkg/cmd/dev/generate.go
@@ -129,7 +129,12 @@ func (d *dev) generateDocs(cmd *cobra.Command) error {
 			}
 		}
 	}
-	return nil
+	// docs/generated/redact_safe.md needs special handling.
+	output, err := d.exec.CommandContextSilent(ctx, filepath.Join(workspace, "build", "bazelutil", "generate_redact_safe.sh"))
+	if err != nil {
+		return err
+	}
+	return d.os.WriteFile(filepath.Join(workspace, "docs", "generated", "redact_safe.md"), string(output))
 }
 
 func (*dev) generateUnimplemented(*cobra.Command) error {
diff --git a/pkg/cmd/dev/io/os/os.go b/pkg/cmd/dev/io/os/os.go
index b8f46b24d37e..7fedaf839ad3 100644
--- a/pkg/cmd/dev/io/os/os.go
+++ b/pkg/cmd/dev/io/os/os.go
@@ -186,6 +186,21 @@ func (o *OS) ReadFile(filename string) (string, error) {
 	return ret, err
 }
 
+// WriteFile wraps around ioutil.ReadFile, writing the given contents to
+// the given file on disk.
+func (o *OS) WriteFile(filename, contents string) error {
+	command := fmt.Sprintf("echo %s > %s", strings.TrimSpace(contents), filename)
+	o.logger.Print(command)
+
+	if o.Recording == nil {
+		// Do the real thing.
+		return ioutil.WriteFile(filename, []byte(contents), 0666)
+	}
+
+	_, err := o.replay(command)
+	return err
+}
+
 // CopyFile copies a file from one location to another.
 func (o *OS) CopyFile(src, dst string) error {
 	command := fmt.Sprintf("cp %s %s", src, dst)
diff --git a/pkg/cmd/dev/testdata/generate.txt b/pkg/cmd/dev/testdata/generate.txt
index 992ffca29471..bde75d022497 100644
--- a/pkg/cmd/dev/testdata/generate.txt
+++ b/pkg/cmd/dev/testdata/generate.txt
@@ -24,3 +24,5 @@ cp /private/var/tmp/_bazel/99e666e4e674209ecdb66b46371278df/execroot/cockroach/b
 cp /private/var/tmp/_bazel/99e666e4e674209ecdb66b46371278df/execroot/cockroach/bazel-out/darwin-fastbuild/bin/docs/generated/sql/functions.md go/src/github.com/cockroachdb/cockroach/docs/generated/sql/functions.md
 cp /private/var/tmp/_bazel/99e666e4e674209ecdb66b46371278df/execroot/cockroach/bazel-out/darwin-fastbuild/bin/docs/generated/sql/operators.md go/src/github.com/cockroachdb/cockroach/docs/generated/sql/operators.md
 cp /private/var/tmp/_bazel/99e666e4e674209ecdb66b46371278df/execroot/cockroach/bazel-out/darwin-fastbuild/bin/docs/generated/sql/window_functions.md go/src/github.com/cockroachdb/cockroach/docs/generated/sql/window_functions.md
+go/src/github.com/cockroachdb/cockroach/build/bazelutil/generate_redact_safe.sh
+echo MOCK_REDACT_SAFE_OUTPUT > go/src/github.com/cockroachdb/cockroach/docs/generated/redact_safe.md
diff --git a/pkg/cmd/dev/testdata/recording/generate.txt b/pkg/cmd/dev/testdata/recording/generate.txt
index 48d5904815ab..1eb632ce7b4b 100644
--- a/pkg/cmd/dev/testdata/recording/generate.txt
+++ b/pkg/cmd/dev/testdata/recording/generate.txt
@@ -124,3 +124,10 @@ cp /private/var/tmp/_bazel/99e666e4e674209ecdb66b46371278df/execroot/cockroach/b
 
 cp /private/var/tmp/_bazel/99e666e4e674209ecdb66b46371278df/execroot/cockroach/bazel-out/darwin-fastbuild/bin/docs/generated/sql/window_functions.md go/src/github.com/cockroachdb/cockroach/docs/generated/sql/window_functions.md
 ----
+
+go/src/github.com/cockroachdb/cockroach/build/bazelutil/generate_redact_safe.sh
+----
+MOCK_REDACT_SAFE_OUTPUT
+
+echo MOCK_REDACT_SAFE_OUTPUT > go/src/github.com/cockroachdb/cockroach/docs/generated/redact_safe.md
+----