diff --git a/.github/workflows/supply-chain-audit.yml b/.github/workflows/supply-chain-audit.yml
new file mode 100644
index 000000000..ffdd4b2e2
--- /dev/null
+++ b/.github/workflows/supply-chain-audit.yml
@@ -0,0 +1,55 @@
+name: Supply Chain Audit
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+  push:
+    branches:
+      - master
+
+jobs:
+  backend:
+    if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
+    runs-on: mempool-ci
+    name: Backend install-script audit
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.13.0"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install npm 11.12.0
+        run: npm install -g npm@11.12.0
+
+      - name: Audit backend install scripts
+        run: bash backend/meta/scripts/check-install-scripts.sh
+
+      - name: Run backend safe install
+        run: bash backend/meta/scripts/safe-install.sh
+
+  frontend:
+    if: "(github.event_name == 'pull_request' && !contains(github.event.pull_request.labels.*.name, 'ops') && !contains(github.head_ref, 'ops/')) || github.event_name == 'push'"
+    runs-on: mempool-ci
+    name: Frontend install-script audit
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Setup Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "24.13.0"
+          registry-url: "https://registry.npmjs.org"
+
+      - name: Install npm 11.12.0
+        run: npm install -g npm@11.12.0
+
+      - name: Audit frontend install scripts
+        run: bash frontend/meta/scripts/check-install-scripts.sh
+
+      - name: Run frontend safe install
+        run: bash frontend/meta/scripts/safe-install.sh