diff --git a/pkgs/by-name/ud/udevCheckHook/hook.sh b/pkgs/by-name/ud/udevCheckHook/hook.sh
new file mode 100644
index 0000000000000..507e0292b8c89
--- /dev/null
+++ b/pkgs/by-name/ud/udevCheckHook/hook.sh
@@ -0,0 +1,27 @@
+# shellcheck shell=bash
+
+udevCheckHook() {
+    runHook preUdevCheck
+    echo Executing udevCheckPhase
+
+    # as per nixos/modules/services/hardware/udev.nix:
+    # - both /lib and /etc is valid paths for udev rules
+    # - udev rules are expected to be part of the $bin output
+    # However, not all udev rules are actually in $bin (some are in $lib or $out).
+    # This means we have to actually check all outputs here.
+    for output in $(getAllOutputNames); do
+        for path in etc lib ; do
+            if [ -d "${!output}/$path/udev/rules.d" ]; then
+                @udevadm@ verify --resolve-names=never --no-style "${!output}/$path/udev/rules.d"
+            fi
+        done
+    done
+
+    runHook postUdevCheck
+    echo Finished udevCheckPhase
+}
+
+if [[ -z "${dontUdevCheck-}" ]]; then
+    echo "Using udevCheckHook"
+    preInstallCheckHooks+=(udevCheckHook)
+fi
diff --git a/pkgs/by-name/ud/udevCheckHook/package.nix b/pkgs/by-name/ud/udevCheckHook/package.nix
new file mode 100644
index 0000000000000..61a82530cdd33
--- /dev/null
+++ b/pkgs/by-name/ud/udevCheckHook/package.nix
@@ -0,0 +1,16 @@
+{
+  lib,
+  makeSetupHook,
+  systemdMinimal,
+}:
+
+makeSetupHook {
+  name = "udev-check-hook";
+  substitutions = {
+    udevadm = lib.getExe' systemdMinimal "udevadm";
+  };
+  meta = {
+    description = "check validity of udev rules in outputs";
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+} ./hook.sh