diff --git a/.github/workflows/signoffs.yml b/.github/workflows/signoffs.yml
new file mode 100644
index 000000000..6e0d14ea4
--- /dev/null
+++ b/.github/workflows/signoffs.yml
@@ -0,0 +1,27 @@
+name: Sign-offs
+
+on:
+  pull_request: {}
+
+permissions:
+  contents: read
+
+jobs:
+
+  signoffs:
+    runs-on: ubuntu-latest
+    steps:
+      - { name: Checkout, uses: actions/checkout@v4, with: { fetch-depth: 0 } }
+      - name: Check commit signatures
+        if: github.event_name == 'pull_request'
+        run: |
+          for commit in $(git rev-list "origin/${{ github.base_ref }}".."${{ github.event.pull_request.head.sha }}"); do
+            if ! git verify-commit --raw $commit 2>&1 | grep -q SIG; then
+              echo "--------------------------------------------------------------"
+              echo "Error: Commit $commit is not signed using GPG, SSH, or S/MIME"
+              echo "https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+              echo "--------------------------------------------------------------"
+              git log -1 --pretty=format:"%h %s" $commit
+              exit 1
+            fi
+          done
diff --git a/NATS.Net.sln b/NATS.Net.sln
index 81a6ce6a1..e983b72be 100644
--- a/NATS.Net.sln
+++ b/NATS.Net.sln
@@ -99,6 +99,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "workflows", "workflows", "{
 		.github\workflows\test_linux.yml = .github\workflows\test_linux.yml
 		.github\workflows\test_windows.yml = .github\workflows\test_windows.yml
 		.github\workflows\test_linux_core.yml = .github\workflows\test_linux_core.yml
+		.github\workflows\signoffs.yml = .github\workflows\signoffs.yml
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "examples", "examples", "{5BF3C0C5-94CA-4008-8DF5-890ED8E06990}"