diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 404adb9e4..b70f17e89 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,10 @@ updates:
   directory: "/"
   schedule:
     interval: daily
+- package-ecosystem: "docker"
+  directory: "/.github/workflows"
+  schedule:
+    interval: daily
 - package-ecosystem: npm
   directory: "/"
   schedule:
diff --git a/.github/workflows/actionlint.dockerfile b/.github/workflows/actionlint.dockerfile
new file mode 100644
index 000000000..a215b2590
--- /dev/null
+++ b/.github/workflows/actionlint.dockerfile
@@ -0,0 +1,4 @@
+# Workaround for https://github.com/dependabot/dependabot-core/issues/8362.
+# Once that is fixed, remove this file and replace the Docker build and run
+# lines in `.github/workflows/main.yml` with a `uses: docker://rhysd/…` line.
+FROM rhysd/actionlint:1.6.26@sha256:2362769b1d75056da70e7af1b12d9e52746f3a123b8f22a4322869e8f2cd45f2
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7626ff22e..ca96ae75e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -7,6 +7,12 @@ jobs:
     steps:
       - uses: linz/action-typescript@v3
 
+      - name: Download actionlint
+        run: docker build --tag actionlint - < .github/workflows/actionlint.dockerfile
+
+      - name: Run actionlint to check workflow files
+        run: docker run --volume="${PWD}:/repo" --workdir=/repo actionlint -color
+
   deploy-prod:
     runs-on: ubuntu-latest
     concurrency: deploy-prod-${{ github.ref }}