diff --git a/.github/workflows/check-sdist.yml b/.github/workflows/check-sdist.yml
new file mode 100644
index 00000000000..04865ab9a0c
--- /dev/null
+++ b/.github/workflows/check-sdist.yml
@@ -0,0 +1,83 @@
+name: Check sdist
+
+# See: https://docs.github.com/en/actions/reference/workflow-syntax-for-github-actions#concurrency.
+concurrency:
+  group: ${{ github.ref }}-${{ github.workflow }}
+  cancel-in-progress: true
+
+on:
+  push:
+    paths-ignore:
+      - "doc/**"
+      - "**/README.md"
+      - "CONTRIBUTING.md"
+    branches:
+      - master
+  pull_request:
+    paths-ignore:
+      - "doc/**"
+      - "**/README.md"
+      - "CONTRIBUTING.md"
+  release:
+    types:
+      - created
+
+jobs:
+
+  # Dogfood the generated sdist, to avoid bugs like https://github.com/haskell/cabal/issues/9833
+  # No caching, since the point is to verify they can be installed "from scratch"
+  # Don't run on master or a PR targeting master, because there's never an installable Cabal
+  dogfood-sdists:
+    name: Dogfood sdist on ${{ matrix.os }} ghc-${{ matrix.ghc }}
+    if: github.ref != 'refs/heads/master' && github.base_ref != 'master'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest]
+        # this should be kept up to date with the list in validate.yml
+        # sharing these with the main validate job is possible but extremely painful; sadly,
+        # you can't simply reference another job's matrix
+        ghc:
+          [
+            "9.10.1",
+            "9.8.2",
+            "9.6.4",
+            "9.4.8",
+            "9.2.8",
+            "9.0.2",
+            "8.10.7",
+            "8.8.4",
+          ]
+
+    steps:
+
+      - uses: haskell-actions/setup@v2
+        id: setup-haskell
+        with:
+          ghc-version: ${{ matrix.ghc }}
+          cabal-version: latest
+
+      - uses: actions/checkout@v4
+
+      - name: Make sdist
+        run: cabal sdist cabal-install
+
+      - name: Install from sdist
+        run: |
+          # skip if a suitable Cabal isn't in the index (i.e. new major version, not released yet)
+          # we only want to test cabal-install, to ensure that it works with existing Cabals
+          # (don't look at this too closely)
+          sdist="$(ls dist-newstyle/sdist/cabal-install-*.tar.gz | sed -n '\,^dist-newstyle/sdist/cabal-install-[0-9.]*\.tar\.gz$,{;p;q;}')"
+          # extract the cabal-install major version
+          ver="$(echo "$sdist" | sed -n 's,^dist-newstyle/sdist/cabal-install-\([0-9][0-9]*\.[0-9][0-9]*\)\.[0-9.]*$,\1,p')"
+          # why does `cabal list` force me to do this???
+          if cabal list --simple-output Cabal | grep -q "^Cabal $cbl\\."; then
+            # sigh, someone broke installing from tarballs
+            rm -rf cabal*.project Cabal Cabal-syntax cabal-install-solver cabal-install
+            tar xfz "$sdist"
+            cd "cabal-install-$cbl"*
+            cabal install --prefer-oldest
+          else
+            echo No released Cabal version to test against.
+            exit 0
+          fi