diff --git a/apis/workloads/v1alpha1/console_authorisation_types.go b/apis/workloads/v1alpha1/console_authorisation_types.go
index d4517a87..08c370aa 100644
--- a/apis/workloads/v1alpha1/console_authorisation_types.go
+++ b/apis/workloads/v1alpha1/console_authorisation_types.go
@@ -21,6 +21,8 @@ type ConsoleAuthorisationStatus struct{}
 // +kubebuilder:object:root=true
 // +kubebuilder:storageversion
 
+// +genclient
+// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
 // ConsoleAuthorisation is the Schema for the consoleauthorisations API
 type ConsoleAuthorisation struct {
 	metav1.TypeMeta   `json:",inline"`
diff --git a/apis/workloads/v1alpha1/doc.go b/apis/workloads/v1alpha1/doc.go
new file mode 100644
index 00000000..e2854f44
--- /dev/null
+++ b/apis/workloads/v1alpha1/doc.go
@@ -0,0 +1,4 @@
+// +k8s:deepcopy-gen=package,register
+// Package v1 is the v1 version of the API.
+// +groupName=workloads.crd.gocardless.com
+package v1alpha1
diff --git a/apis/workloads/v1alpha1/groupversion_info.go b/apis/workloads/v1alpha1/groupversion_info.go
index 13cc3d09..777769e4 100644
--- a/apis/workloads/v1alpha1/groupversion_info.go
+++ b/apis/workloads/v1alpha1/groupversion_info.go
@@ -1,6 +1,3 @@
-// Package v1alpha1 contains API Schema definitions for the workloads v1alpha1 API group
-// +kubebuilder:object:generate=true
-// +groupName=workloads.crd.gocardless.com
 package v1alpha1
 
 import (
diff --git a/go.sum b/go.sum
index db504028..f8745000 100644
--- a/go.sum
+++ b/go.sum
@@ -654,3 +654,4 @@ sigs.k8s.io/yaml v1.2.0 h1:kr/MCeFWJWTwyaHoR9c8EjH9OumOmoF9YGiZd7lFm/Q=
 sigs.k8s.io/yaml v1.2.0/go.mod h1:yfXDCHCao9+ENCvLSE62v9VSji2MKu5jeNfTrofGhJc=
 vbom.ml/util v0.0.0-20160121211510-db5cfe13f5cc h1:MksmcCZQWAQJCTA5T0jgI/0sJ51AVm4Z41MrmfczEoc=
 vbom.ml/util v0.0.0-20160121211510-db5cfe13f5cc/go.mod h1:so/NYdZXCz+E3ZpW0uAoCj6uzU2+8OWDFv/HxUSs7kI=
+
diff --git a/hack/generate-groups.sh b/hack/generate-groups.sh
new file mode 100755
index 00000000..005c6864
--- /dev/null
+++ b/hack/generate-groups.sh
@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This is a snapshot of https://github.com/kubernetes/code-generator/blob/50b561225d70b3eb79a1faafd3dfe7b1a62cbe73/generate-groups.sh
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+# generate-groups generates everything for a project with external types only, e.g. a project based
+# on CustomResourceDefinitions.
+
+if [ "$#" -lt 4 ] || [ "${1}" == "--help" ]; then
+  cat <<EOF
+Usage: $(basename "$0") <generators> <output-package> <apis-package> <groups-versions> ...
+  <generators>        the generators comma separated to run (deepcopy,defaulter,client,lister,informer) or "all".
+  <output-package>    the output package name (e.g. github.com/example/project/pkg/generated).
+  <apis-package>      the external types dir (e.g. github.com/example/api or github.com/example/project/pkg/apis).
+  <groups-versions>   the groups and their versions in the format "groupA:v1,v2 groupB:v1 groupC:v2", relative
+                      to <api-package>.
+  ...                 arbitrary flags passed to all generator binaries.
+Examples:
+  $(basename "$0") all             github.com/example/project/pkg/client github.com/example/project/pkg/apis "foo:v1 bar:v1beta1"
+  $(basename "$0") deepcopy,client github.com/example/project/pkg/client github.com/example/project/pkg/apis "foo:v1 bar:v1beta1"
+EOF
+  exit 0
+fi
+
+GENS="$1"
+OUTPUT_PKG="$2"
+APIS_PKG="$3"
+GROUPS_WITH_VERSIONS="$4"
+shift 4
+
+(
+  # To support running this script from anywhere, we have to first cd into this directory
+  # so we can install the tools.
+  cd "$(dirname "${0}")"
+  go install ./cmd/{defaulter-gen,client-gen,lister-gen,informer-gen,deepcopy-gen}
+)
+
+function codegen::join() { local IFS="$1"; shift; echo "$*"; }
+
+# enumerate group versions
+FQ_APIS=() # e.g. k8s.io/api/apps/v1
+for GVs in ${GROUPS_WITH_VERSIONS}; do
+  IFS=: read -r G Vs <<<"${GVs}"
+
+  # enumerate versions
+  for V in ${Vs//,/ }; do
+    FQ_APIS+=("${APIS_PKG}/${G}/${V}")
+  done
+done
+
+if [ "${GENS}" = "all" ] || grep -qw "deepcopy" <<<"${GENS}"; then
+  echo "Generating deepcopy funcs"
+  "${GOPATH}/bin/deepcopy-gen" --input-dirs "$(codegen::join , "${FQ_APIS[@]}")" -O zz_generated.deepcopy --bounding-dirs "${APIS_PKG}" "$@"
+fi
+
+if [ "${GENS}" = "all" ] || grep -qw "client" <<<"${GENS}"; then
+  echo "Generating clientset for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}"
+  "${GOPATH}/bin/client-gen" --clientset-name "${CLIENTSET_NAME_VERSIONED:-versioned}" --input-base "" --input "$(codegen::join , "${FQ_APIS[@]}")" --output-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}" "$@" -v8
+fi
+
+if [ "${GENS}" = "all" ] || grep -qw "lister" <<<"${GENS}"; then
+  echo "Generating listers for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/listers"
+  "${GOPATH}/bin/lister-gen" --input-dirs "$(codegen::join , "${FQ_APIS[@]}")" --output-package "${OUTPUT_PKG}/listers" "$@"
+fi
+
+if [ "${GENS}" = "all" ] || grep -qw "informer" <<<"${GENS}"; then
+  echo "Generating informers for ${GROUPS_WITH_VERSIONS} at ${OUTPUT_PKG}/informers"
+  "${GOPATH}/bin/informer-gen" \
+           --input-dirs "$(codegen::join , "${FQ_APIS[@]}")" \
+           --versioned-clientset-package "${OUTPUT_PKG}/${CLIENTSET_PKG_NAME:-clientset}/${CLIENTSET_NAME_VERSIONED:-versioned}" \
+           --listers-package "${OUTPUT_PKG}/listers" \
+           --output-package "${OUTPUT_PKG}/informers" \
+           "$@"
+fi
diff --git a/hack/update-codegen.sh b/hack/update-codegen.sh
new file mode 100755
index 00000000..c1c2a74e
--- /dev/null
+++ b/hack/update-codegen.sh
@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+SCRIPT_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+CODEGEN_PKG=${CODEGEN_PKG:-$(cd "${SCRIPT_ROOT}"; ls -d -1 ./vendor/k8s.io/code-generator 2>/dev/null || echo ../code-generator)}
+
+# generate the code with:
+# --output-base    because this script should also be able to run inside the vendor dir of
+#                  k8s.io/kubernetes. The output-base is needed for the generators to output into the vendor dir
+#                  instead of the $GOPATH directly. For normal projects this can be dropped.
+
+# go modules do not bring this file so we create a runtime symbolic link from our copy.
+cp "${SCRIPT_ROOT}"/hack/generate-groups.sh "${CODEGEN_PKG}"/generate-groups.sh
+"${CODEGEN_PKG}"/generate-groups.sh client,lister,informer \
+  github.com/gocardless/theatre/pkg/generated \
+  github.com/gocardless/theatre/v3/apis \
+  workloads:v1alpha1 \
+  --output-base "$(dirname "${BASH_SOURCE[0]}")/../../../.."