diff --git a/CHANGELOG_PENDING.md b/CHANGELOG_PENDING.md
index 0cd8bd2fe..faaf17562 100644
--- a/CHANGELOG_PENDING.md
+++ b/CHANGELOG_PENDING.md
@@ -38,6 +38,7 @@ IMPROVEMENTS:
 - [consensus] [\#2169](https://github.com/cosmos/cosmos-sdk/issues/2169) add additional metrics
 - [p2p] [\#2169](https://github.com/cosmos/cosmos-sdk/issues/2169) add additional metrics
 - [config] \#2232 added ValidateBasic method, which performs basic checks
+- [tools] \#2238 Binary dependencies are now locked to a specific git commit
 - [crypto] \#2099 make crypto random use chacha, and have forward secrecy of generated randomness
 
 BUG FIXES:
diff --git a/Makefile b/Makefile
index 5711e4317..0b78574b9 100644
--- a/Makefile
+++ b/Makefile
@@ -1,16 +1,17 @@
 GOTOOLS = \
 	github.com/mitchellh/gox \
 	github.com/golang/dep/cmd/dep \
-	gopkg.in/alecthomas/gometalinter.v2 \
+	github.com/alecthomas/gometalinter \
 	github.com/gogo/protobuf/protoc-gen-gogo \
 	github.com/square/certstrap
+GOBIN?=${GOPATH}/bin
 PACKAGES=$(shell go list ./...)
 
 INCLUDE = -I=. -I=${GOPATH}/src -I=${GOPATH}/src/github.com/gogo/protobuf/protobuf
 BUILD_TAGS?='tendermint'
 BUILD_FLAGS = -ldflags "-X github.com/tendermint/tendermint/version.GitCommit=`git rev-parse --short=8 HEAD`"
 
-LINT_FLAGS = --exclude '.*\.pb\.go' --vendor --deadline=600s
+LINT_FLAGS = --exclude '.*\.pb\.go' --exclude 'vendor/*' --vendor --deadline=600s
 
 all: check build test install
 
@@ -75,12 +76,13 @@ check_tools:
 
 get_tools:
 	@echo "--> Installing tools"
-	go get -u -v $(GOTOOLS)
-	@gometalinter.v2 --install
+	./scripts/get_tools.sh
+	@echo "--> Downloading linters (this may take awhile)"
+	$(GOPATH)/src/github.com/alecthomas/gometalinter/scripts/install.sh -b $(GOBIN)
 
 update_tools:
 	@echo "--> Updating tools"
-	go get -u -v $(GOTOOLS)
+	./scripts/get_tools.sh
 
 #Update dependencies
 get_vendor_deps:
@@ -227,7 +229,7 @@ fmt:
 
 metalinter:
 	@echo "--> Running linter"
-	@gometalinter.v2 $(LINT_FLAGS) --disable-all  \
+	@gometalinter $(LINT_FLAGS) --disable-all  \
 		--enable=deadcode \
 		--enable=gosimple \
 	 	--enable=misspell \
@@ -256,7 +258,7 @@ metalinter:
 
 metalinter_all:
 	@echo "--> Running linter (all)"
-	gometalinter.v2 $(LINT_FLAGS) --enable-all --disable=lll ./...
+	gometalinter $(LINT_FLAGS) --enable-all --disable=lll ./...
 
 DESTINATION = ./index.html.md
 
diff --git a/scripts/get_tools.sh b/scripts/get_tools.sh
new file mode 100755
index 000000000..955ec943a
--- /dev/null
+++ b/scripts/get_tools.sh
@@ -0,0 +1,53 @@
+#!/usr/bin/env bash
+set -e
+
+# This file downloads all of the binary dependencies we have, and checks out a
+# specific git hash.
+#
+# repos it installs:
+#   github.com/mitchellh/gox
+#   github.com/golang/dep/cmd/dep
+#   gopkg.in/alecthomas/gometalinter.v2
+#   github.com/gogo/protobuf/protoc-gen-gogo
+#   github.com/square/certstrap
+
+## check if GOPATH is set
+if [ -z ${GOPATH+x} ]; then
+	echo "please set GOPATH (https://github.com/golang/go/wiki/SettingGOPATH)"
+	exit 1
+fi
+
+mkdir -p "$GOPATH/src/github.com"
+cd "$GOPATH/src/github.com" || exit 1
+
+installFromGithub() {
+	repo=$1
+	commit=$2
+	# optional
+	subdir=$3
+	echo "--> Installing $repo ($commit)..."
+	if [ ! -d "$repo" ]; then
+		mkdir -p "$repo"
+		git clone "https://github.com/$repo.git" "$repo"
+	fi
+	if [ ! -z ${subdir+x} ] && [ ! -d "$repo/$subdir" ]; then
+		echo "ERROR: no such directory $repo/$subdir"
+		exit 1
+	fi
+	pushd "$repo" && \
+		git fetch origin && \
+		git checkout -q "$commit" && \
+		if [ ! -z ${subdir+x} ]; then cd "$subdir" || exit 1; fi && \
+		go install && \
+		if [ ! -z ${subdir+x} ]; then cd - || exit 1; fi && \
+		popd || exit 1
+	echo "--> Done"
+	echo ""
+}
+
+installFromGithub mitchellh/gox 51ed453898ca5579fea9ad1f08dff6b121d9f2e8
+installFromGithub golang/dep 22125cfaa6ddc71e145b1535d4b7ee9744fefff2 cmd/dep
+## gometalinter v2.0.11
+installFromGithub alecthomas/gometalinter 17a7ffa42374937bfecabfb8d2efbd4db0c26741
+installFromGithub gogo/protobuf 61dbc136cf5d2f08d68a011382652244990a53a9 protoc-gen-gogo
+installFromGithub square/certstrap e27060a3643e814151e65b9807b6b06d169580a7