diff --git a/.github/actionlint.yml b/.github/actionlint.yml
new file mode 100644
index 000000000..d6d5b9abd
--- /dev/null
+++ b/.github/actionlint.yml
@@ -0,0 +1,28 @@
+self-hosted-runner:
+  labels:
+    # Workaround for the outdated runner list in actionlint v1.7.7
+    # Ref: https://github.com/rhysd/actionlint/issues/533
+    - windows-11-arm
+
+config-variables:
+  - KEEP_CACHE_WARM
+  - PUSH_VERSION_COMMIT
+  - UPDATE_TO_VERIFICATION
+  - PYPI_PROJECT
+  - PYPI_SUFFIX
+  - NIGHTLY_PYPI_PROJECT
+  - NIGHTLY_PYPI_SUFFIX
+  - NIGHTLY_ARCHIVE_REPO
+  - BUILD_NIGHTLY
+  - MASTER_PYPI_PROJECT
+  - MASTER_PYPI_SUFFIX
+  - MASTER_ARCHIVE_REPO
+  - BUILD_MASTER
+  - ISSUE_LOCKDOWN
+  - SANITIZE_COMMENT
+
+paths:
+  .github/workflows/build.yml:
+    ignore:
+      # SC1090 "Can't follow non-constant source": ignore when using `source` to activate venv
+      - '.+SC1090.+'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index acedebd30..911bdaf6a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -81,7 +81,7 @@ jobs:
 
       - uses: actions/setup-python@v5
         with:
-          python-version: "3.10"
+          python-version: "3.10"  # Keep this in sync with test-workflows.yml
 
       - name: Process inputs
         id: process_inputs
diff --git a/.github/workflows/test-workflows.yml b/.github/workflows/test-workflows.yml
new file mode 100644
index 000000000..5025fe8e6
--- /dev/null
+++ b/.github/workflows/test-workflows.yml
@@ -0,0 +1,46 @@
+name: Test and lint workflows
+on:
+  push:
+    paths:
+      - .github/workflows/*
+      - devscripts/setup_variables.py
+      - devscripts/setup_variables_tests.py
+      - devscripts/utils.py
+  pull_request:
+    paths:
+      - .github/workflows/*
+      - devscripts/setup_variables.py
+      - devscripts/setup_variables_tests.py
+      - devscripts/utils.py
+permissions:
+  contents: read
+env:
+  ACTIONLINT_VERSION: "1.7.7"
+  ACTIONLINT_SHA256SUM: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
+  ACTIONLINT_REPO: https://github.com/rhysd/actionlint
+
+jobs:
+  check:
+    name: Check workflows
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"  # Keep this in sync with release.yml's prepare job
+      - name: Install requirements
+        env:
+          ACTIONLINT_TARBALL: ${{ format('actionlint_{0}_linux_amd64.tar.gz', env.ACTIONLINT_VERSION) }}
+        run: |
+          sudo apt -y install shellcheck
+          python -m pip install -U pyflakes
+          curl -LO "${ACTIONLINT_REPO}/releases/download/v${ACTIONLINT_VERSION}/${ACTIONLINT_TARBALL}"
+          printf '%s  %s' "${ACTIONLINT_SHA256SUM}" "${ACTIONLINT_TARBALL}" | sha256sum -c -
+          tar xvzf "${ACTIONLINT_TARBALL}" actionlint
+          chmod +x actionlint
+      - name: Run actionlint
+        run: |
+          ./actionlint -color
+      - name: Test GHA devscripts
+        run: |
+          python -m devscripts.setup_variables_tests