diff --git a/.github/workflows/check-sdist.yml b/.github/workflows/check-sdist.yml
new file mode 100644
index 00000000000..d295ad0ccca
--- /dev/null
+++ b/.github/workflows/check-sdist.yml
@@ -0,0 +1,82 @@
+name: Check sdist
+
+# See: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency.
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+on:
+  push:
+    paths-ignore:
+      - "doc/**"
+      - "**/README.md"
+      - "CONTRIBUTING.md"
+    branches:
+      - master
+  pull_request:
+    paths-ignore:
+      - "doc/**"
+      - "**/README.md"
+      - "CONTRIBUTING.md"
+  release:
+    types:
+      - created
+
+jobs:
+
+  # Dogfood the generated sdist, to avoid bugs like https://github.com/haskell/cabal/issues/9833
+  # No caching, since the point is to verify they can be installed "from scratch"
+  # Don't run on master or a PR targeting master, because there's never an installable Cabal
+  dogfood-sdists:
+    name: Dogfood sdist on ${{ matrix.os }} ghc-${{ matrix.ghc }}
+    if: github.ref != 'refs/heads/master' && github.base_ref != 'master'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        # this should be kept up to date with the list in validate.yml, but should be the
+        # *first* compiler release so we validate against what is hopefully the first
+        # release of a corresponding Cabal and friends. it can also be short since it's
+        # highly unlikely that we are releasing really old branches.
+        ghc:
+          [
+            "9.10.1",
+            "9.8.1",
+            "9.6.1",
+            "9.4.1",
+          ]
+
+    steps:
+
+      - uses: haskell-actions/setup@v2
+        id: setup-haskell
+        with:
+          ghc-version: ${{ matrix.ghc }}
+          cabal-version: latest
+
+      - uses: actions/checkout@v4
+
+      - name: Make sdist
+        run: cabal sdist cabal-install
+
+      - name: Install from sdist
+        run: |
+          # skip if a suitable Cabal isn't in this ghc's bootlibs, since that's the case
+          # that causes failures for users (otherwise cabal-install will install a matching
+          # version itself)
+          # we only want to test cabal-install, to ensure that it works with existing Cabals
+          # (don't look at this too closely)
+          sdist="$(ls dist-newstyle/sdist/cabal-install-*.tar.gz | sed -n '\,^dist-newstyle/sdist/cabal-install-[0-9.]*\.tar\.gz$,{;p;q;}')"
+          # extract the cabal-install major version
+          ver="$(echo "$sdist" | sed -n 's,^dist-newstyle/sdist/cabal-install-\([0-9][0-9]*\.[0-9][0-9]*\)\.[0-9.]*$,\1,p')"
+          # dunno if this will ever be extended to freebsd, but grep -q is a gnu-ism
+          if ghc-pkg --global --simple-output list Cabal | grep "^Cabal-$cbl\\." >/dev/null; then
+            # sigh, someone broke installing from tarballs
+            rm -rf cabal*.project Cabal Cabal-syntax cabal-install-solver cabal-install
+            tar xfz "$sdist"
+            cd "cabal-install-$cbl"*
+            cabal install
+          else
+            echo No matching bootlib Cabal version to test against.
+            exit 0
+          fi