diff --git a/.github/workflows/nix-build.yml b/.github/workflows/nix-build.yml
index e286015cca..f379d07a59 100644
--- a/.github/workflows/nix-build.yml
+++ b/.github/workflows/nix-build.yml
@@ -73,6 +73,9 @@ jobs:
         uses: ./.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
+      - name: Check glibc floor
+        if: ${{ matrix.attr != '' }}
+        run: ./scripts/check-glibc-floor.sh "${{ matrix.attr }}"
 
   nix-build-checks-aarch64-linux:
     name: >-
@@ -192,6 +195,9 @@ jobs:
         uses: ./.github/actions/nix-build-retry
         with:
           attr: .#${{ matrix.attr }}
+      - name: Check glibc floor
+        if: ${{ matrix.attr != '' }}
+        run: ./scripts/check-glibc-floor.sh "${{ matrix.attr }}"
 
   nix-build-checks-x86_64-linux:
     name: >-
diff --git a/scripts/check-glibc-floor.sh b/scripts/check-glibc-floor.sh
new file mode 100755
index 0000000000..ce2d178736
--- /dev/null
+++ b/scripts/check-glibc-floor.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env bash
+# Fails if any file in ./result requires a glibc symbol version above MAX_ALLOWED.
+set -Eeu -o pipefail
+
+MAX_ALLOWED="2.31"
+
+HIT=$(find -L result -type f -exec sh -c \
+	'objdump -T "$1" 2>/dev/null | grep -oE "GLIBC_[0-9.]+" | sed -E "s#GLIBC_([0-9.]+)#\1 $1#"' _ {} \; |
+	sort -V | tail -1)
+
+if [ -z "$HIT" ]; then
+	exit 0
+fi
+
+FLOOR=${HIT%% *}
+echo "glibc floor: $FLOOR (max allowed: $MAX_ALLOWED)"
+if [ "$(printf '%s\n%s' "$MAX_ALLOWED" "$FLOOR" | sort -V | tail -1)" != "$MAX_ALLOWED" ]; then
+	echo "::error::glibc floor $HIT exceeds max allowed $MAX_ALLOWED in ${1:-result}"
+	exit 1
+fi