diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index a95ad8a56c7..76614325a27 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -79,6 +79,8 @@ jobs:
               - 'docs/pages/reference/infrastructure-as-code/terraform-modules/**'
               - 'examples/chart/teleport-cluster/charts/teleport-operator/operator-crds'
               - 'build.assets/tooling/cmd/resource-ref-generator/**'
+              - 'buf-go.gen.yaml'
+              - 'buf.yaml'
             has_ui:
               - '.github/workflows/lint.yaml'
               - 'web/**'
diff --git a/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go b/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go
index fa36bfd6a0b..5ff2f19fd78 100644
--- a/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go
+++ b/build.assets/tooling/cmd/resource-ref-generator/resource/resource.go
@@ -109,6 +109,14 @@ func NewSourceData(prefix string, rootPath string) (SourceData, error) {
 			return nil
 		}
 
+		// Skip protoopaque files. For API_HYBRID proto files, two versions are
+		// generated: a regular .pb.go with exported fields and a
+		// _protoopaque.pb.go with hidden fields. We only want to document the
+		// regular version with exported fields.
+		if strings.HasSuffix(info.Name(), "_protoopaque.pb.go") {
+			return nil
+		}
+
 		// Find the Go package path corresponding to the current file.
 		rel, err := filepath.Rel(rootPath, currentPath)
 		if err != nil {