diff --git a/.github/workflows/validate-changelog.yml b/.github/workflows/validate-changelog.yml
new file mode 100644
index 00000000..f07e22b3
--- /dev/null
+++ b/.github/workflows/validate-changelog.yml
@@ -0,0 +1,13 @@
+name: Validate CHANGELOG
+on:
+  pull_request:
+    branches: [develop]
+    paths:
+      - 'CHANGELOG.md'
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: ./tools/validate-changelog.sh
diff --git a/tools/validate-changelog.sh b/tools/validate-changelog.sh
new file mode 100755
index 00000000..df645879
--- /dev/null
+++ b/tools/validate-changelog.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+
+# check that all `# headers` are formatted as a version, e.g. v1.2.3
+# this should be sufficient to validate the CHANGELOG for our CI, provided that
+# every new tag has a corresponding CHANGELOG update, as we always parse the
+# CHANGELOG between two headers with a tagged version.
+if diff <(grep -ne '^# ' CHANGELOG.md) <(grep -ne '^# v[0-9]\+\.[0-9]\+\.[0-9]\+' CHANGELOG.md); then
+  echo "CHANGELOG validation PASSED!"
+else
+  echo "CHANGELOG validation FAILED! Headers must match the regex '^# v[0-9]\+\.[0-9]\+\.[0-9]\+.'"
+  exit 1
+fi