In many developing countries where formal institutions fail to guarantee rule of law, criminal organisations have emerged as intermediaries between citizens and the state. In some cases, these armed non-state actors adopt repressive strategies to govern their territories and local populations. This study asks under what circumstances local actors mobilise against criminal governance. Focusing on the case of Michoacán, Mexico, I argue that the emergence of vigilante groups, known as autodefensas, was prompted by the breaching of a social contract – a set of formal and informal agreements and obligations – between organised crime and civil society. As criminal governance spread in Michoacán, so did predatory behaviour against local communities, which gave way to an elite-organised social movement structured by rural inequalities.