diff --git a/.github/workflows/selfdrive_tests.yaml b/.github/workflows/selfdrive_tests.yaml
index 1e43e244e..cd6078c19 100644
--- a/.github/workflows/selfdrive_tests.yaml
+++ b/.github/workflows/selfdrive_tests.yaml
@@ -30,6 +30,9 @@ jobs:
     - uses: actions/checkout@v2
       with:
         submodules: true
+    - name: Check submodules
+      if: github.ref == 'refs/heads/master' && github.repository == 'commaai/openpilot'
+      run: release/check-submodules.sh
     - name: Cache dependencies
       id: dependency-cache
       uses: actions/cache@v2
diff --git a/release/check-submodules.sh b/release/check-submodules.sh
new file mode 100755
index 000000000..182042e6b
--- /dev/null
+++ b/release/check-submodules.sh
@@ -0,0 +1,12 @@
+#!/bin/bash
+
+while read hash submodule ref; do
+  git -C $submodule fetch --depth 100 origin master
+  git -C $submodule branch -r --contains $hash | grep "origin/master"
+  if [ "$?" -eq 0 ]; then
+    echo "$submodule ok"
+  else
+    echo "$submodule: $hash is not on master"
+    exit 1
+  fi
+done <<< $(git submodule status --recursive)