diff --git a/.github/workflows/generate_test.yml b/.github/workflows/generate_test.yml
new file mode 100644
index 0000000..c6abc52
--- /dev/null
+++ b/.github/workflows/generate_test.yml
@@ -0,0 +1,28 @@
+name: generate_test
+
+on:
+  schedule:
+    - cron: "0 0 * * *"
+  workflow_call:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  check_generate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out source code
+        uses: actions/checkout@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: '1.22.4'
+
+      - name: Run go generate
+        run: go generate ./...
+
+      - name: Check diff
+        run: git diff --quiet . || (git --no-pager diff . && exit 1 || exit 1)
diff --git a/README.md b/README.md
index 805677e..fd6c749 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,8 @@
 ## AWS Region Certificates for Go
 
+[![GHA](https://github.com/rspamd/awsregioncertificates/actions/workflows/ci.yml/badge.svg)](https://github.com/rspamd/awsregioncertificates/actions/workflows/ci.yml)
+[![GHA](https://github.com/rspamd/awsregioncertificates/actions/workflows/generate_test.yml/badge.svg)](https://github.com/rspamd/awsregioncertificates/actions/workflows/generate_test.yml)
+
 Embeds region certificates from AWS (run `go generate ./...` to refresh them) - AFAIU they can only be downloaded as part of documentation.
 
 Can be used to validate EC2 [instance identity documents](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html) using the `rsa`/`base64-encoded signature`.
diff --git a/generator/main.go b/generator/main.go
index d1313d4..aa2ab11 100644
--- a/generator/main.go
+++ b/generator/main.go
@@ -77,7 +77,7 @@ func main() {
 		}
 		if tt == html.TextToken && wantText {
 			token := tokenizer.Token()
-			regionCertMap[region] = token.String()
+			regionCertMap[region] = strings.ReplaceAll(token.String(), "\t", "")
 			wantText = false
 		}
 	}