diff --git a/.github/workflows/github_hooks_ip_ranges.yml b/.github/workflows/github_hooks_ip_ranges.yml
new file mode 100644
index 0000000000..751c072b5d
--- /dev/null
+++ b/.github/workflows/github_hooks_ip_ranges.yml
@@ -0,0 +1,61 @@
+name: Check GitHub webhook IP ranges
+
+on:
+  schedule:
+    - cron: "42 6 * * *"   # daily, 06:42 UTC
+  workflow_dispatch:
+  pull_request:
+    types: [opened]
+
+permissions:
+  contents: read
+
+env:
+  # Path (in this repo) to the file listing the GitHub IP ranges we accept webhooks from
+  GITHUB_WEBHOOK_IP_RANGES_FILE: .github/workflows/github_hooks_ip_ranges_file.cfg
+
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Compare GitHub hooks ranges with accepted webhook IPv4 ranges
+        run: |
+          set -euo pipefail
+
+          curl -fsSL https://api.github.com/meta \
+            | jq -r '.hooks[] | select(contains(":") | not)' \
+            | sort -u > current_ip_ranges_hooks_are_sent_from.txt
+
+          echo "Current GitHub hooks IPv4 ranges:"
+          cat current_ip_ranges_hooks_are_sent_from.txt
+
+          missing=0
+          while read -r github_cidr; do
+            if ! grep -qxF "$github_cidr" "$GITHUB_WEBHOOK_IP_RANGES_FILE"; then
+              echo "::error::Missing from accepted GitHub webhook IP ranges: $github_cidr"
+              missing=1
+            fi
+          done < current_ip_ranges_hooks_are_sent_from.txt
+
+          if [ "$missing" -eq 1 ]; then
+            echo "Accepted GitHub webhook IPv4 ranges are out of date. Add the ranges above to $GITHUB_WEBHOOK_IP_RANGES_FILE."
+            exit 1
+          fi
+          echo "All current GitHub hooks IPv4 ranges are accepted."
+
+          additional=0
+          while read -r accepted_cidr; do
+            if ! grep -qxF "$accepted_cidr" current_ip_ranges_hooks_are_sent_from.txt; then
+              echo "::error::Accepted IPv4 range, but not used by GitHub: $accepted_cidr"
+              additional=1
+            fi
+          done < "$GITHUB_WEBHOOK_IP_RANGES_FILE"
+
+          if [ "$additional" -eq 1 ]; then
+            echo "Accepted GitHub webhook IPv4 ranges are out of date. Remove the ranges above from $GITHUB_WEBHOOK_IP_RANGES_FILE."
+            exit 1
+          fi
+          echo "All currently accepted IPv4 ranges are used by GitHub to send hooks from."
diff --git a/.github/workflows/github_hooks_ip_ranges_file.cfg b/.github/workflows/github_hooks_ip_ranges_file.cfg
new file mode 100644
index 0000000000..e10a072195
--- /dev/null
+++ b/.github/workflows/github_hooks_ip_ranges_file.cfg
@@ -0,0 +1,7 @@
+140.82.112.0/20
+143.55.64.0/20
+185.199.108.0/22
+192.30.252.0/22
+9.234.106.48/28
+9.234.98.160/28
+9.234.98.176/28