diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 824cf5b2..7682eb10 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -2,6 +2,9 @@ on: [push, pull_request]
 
 name: Continuous integration
 
+permissions:
+  contents: read
+
 jobs:
   Prepare:
     runs-on: ubuntu-24.04
@@ -37,6 +40,47 @@ jobs:
       - name: Running cargo fmt
         run: cargo fmt --all -- --check
 
+  symbol_versions:
+    name: Symbol Version Prefixes
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Crate
+        uses: actions/checkout@v4
+      - name: Check simplicity-sys symbol prefixes match its version
+        run: ./simplicity-sys/check-symbol-versions.sh
+
+  vendored_libsimplicity:
+    name: Vendored libsimplicity
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Crate
+        uses: actions/checkout@v4
+      - name: Read vendored libsimplicity revision
+        id: libsimplicity
+        run: |
+          set -euo pipefail
+          echo "rev=$(sed -n '2p' simplicity-sys/depend/simplicity-HEAD-revision.txt)" >> "$GITHUB_OUTPUT"
+      - name: Checkout libsimplicity
+        uses: actions/checkout@v4
+        with:
+          repository: BlockstreamResearch/simplicity
+          ref: ${{ steps.libsimplicity.outputs.rev }}
+          path: libsimplicity
+      - name: Re-vendor libsimplicity and check for differences
+        env:
+          LIBSIMPLICITY_REV: ${{ steps.libsimplicity.outputs.rev }}
+        run: |
+          set -euo pipefail
+          cd simplicity-sys
+          # vendor-simplicity.sh asks before deleting the existing vendored copy.
+          echo y | ./vendor-simplicity.sh depend ../libsimplicity
+          if [ -n "$(git status --porcelain --untracked-files=all -- .)" ]; then
+            echo "simplicity-sys does not match libsimplicity $LIBSIMPLICITY_REV re-vendored with vendor-simplicity.sh:"
+            git status --short --untracked-files=all -- .
+            git diff --stat -- .
+            exit 1
+          fi
+
   simpcli_test:
     name: SimpCLI Tests
     runs-on: ubuntu-latest
diff --git a/simplicity-sys/check-symbol-versions.sh b/simplicity-sys/check-symbol-versions.sh
new file mode 100755
index 00000000..9bba4a89
--- /dev/null
+++ b/simplicity-sys/check-symbol-versions.sh
@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Check that every versioned symbol prefix in simplicity-sys matches the crate version.
+#
+# vendor-simplicity.sh renames every libsimplicity symbol to `rustsimplicity_<major>_<minor>_*`
+# and the allocator hooks to `rust_<major>_<minor>_*`, so that semver-incompatible versions of
+# this crate can be linked into the same binary. A file that keeps an older prefix (for example
+# one copied in by hand instead of vendored) silently defeats that, so fail if any prefix other
+# than the current one appears.
+
+cd "$(dirname "$0")"
+
+VERSION_CODE=$(grep "^version" Cargo.toml | sed 's/\./_/g' | sed 's/.*"\(.*\)".*/\1/' | cut -d_ -f1-2)
+
+# Each output line is `file:line:match`; keep only matches that are not the current version.
+STALE=$(grep -rnoE '(rustsimplicity|rust)_[0-9]+_[0-9]+' Cargo.toml depend src \
+    | grep -vE ":(rustsimplicity|rust)_${VERSION_CODE}\$" || true)
+
+if [ -n "$STALE" ]; then
+    echo "Found symbol prefixes that do not match the simplicity-sys version code ${VERSION_CODE}:"
+    echo "$STALE"
+    echo
+    echo "Expected only rustsimplicity_${VERSION_CODE}_* and rust_${VERSION_CODE}_*."
+    echo "Re-run vendor-simplicity.sh rather than copying libsimplicity files in by hand."
+    exit 1
+fi
+
+echo "All symbol prefixes match version code ${VERSION_CODE}."