diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2e12bf4d5..1cd8b7ba7 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -42,7 +42,7 @@ jobs:
     - name: install-dependencies
       run: |
             sudo apt-get update -q -y
-            sudo apt-get install -q -y libsdl2-dev libsdl2-mixer-dev
+            sudo apt-get install -q -y libsdl2-dev libsdl2-mixer-dev valgrind
             .ci/riscv-toolchain-install.sh
       shell: bash
     - name: default build
@@ -73,6 +73,16 @@ jobs:
       run: |
             make clean && make ENABLE_UBSAN=1 check -j$(nproc)
             make clean && make ENABLE_JIT=1 ENABLE_UBSAN=1 check -j$(nproc)
+    - name: valgrind check (without JIT)
+      run: |
+            make clean && make ENABLE_SDL=0 ENABLE_JIT=0 ENABLE_VALGRIND=1
+            valgrind --leak-check=full --show-leak-kinds=all --error-exitcode=1 ./build/rv32emu ./build/hello.elf 
+            valgrind --leak-check=full --show-leak-kinds=all --error-exitcode=1 ./build/rv32emu ./build/aes.elf 
+    - name: valgrind check (with JIT)
+      run: |
+            make clean && make ENABLE_SDL=0 ENABLE_JIT=1 ENABLE_VALGRIND=1
+            valgrind --leak-check=full --show-leak-kinds=all --error-exitcode=1 ./build/rv32emu ./build/hello.elf 
+            valgrind --leak-check=full --show-leak-kinds=all --error-exitcode=1 ./build/rv32emu ./build/aes.elf 
 
   host-arm64:
     needs: [detect-code-related-file-changes]
diff --git a/Makefile b/Makefile
index e6c94b95e..1810b1535 100644
--- a/Makefile
+++ b/Makefile
@@ -11,6 +11,14 @@ CFLAGS = -std=gnu99 -O2 -Wall -Wextra
 CFLAGS += -Wno-unused-label
 CFLAGS += -include src/common.h
 
+ENABLE_VALGRIND ?= 0
+ifeq ("$(ENABLE_UBSAN)", "1")
+# according to gcc's man page: "If you use multiple -O options, with or without level numbers, the last such option is the one that is effective."
+# In order to use Valgrind, we need to compile with -g
+CFLAGS += -g
+LDFLAGS += -g
+endif
+
 # Enable link-time optimization (LTO)
 ENABLE_LTO ?= 1
 ifeq ($(call has, LTO), 1)