diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 40be26efb..e8e70797f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -29,6 +29,15 @@ jobs:
           name: 1lab
           authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
 
+      - name: Check that imports are sorted
+        if: github.event_name == 'pull_request'
+        run: |
+          nix run -f . sort-imports
+          if ! git diff --quiet; then
+            echo 'Imports are not sorted. Please run `support/sort-imports.hs`.'
+            exit 1
+          fi
+
       - name: Build the Shakefile 🧰
         run: |
           hash=$(nix-build -A shakefile --no-out-link)
diff --git a/default.nix b/default.nix
index a50cd36df..c406f918f 100644
--- a/default.nix
+++ b/default.nix
@@ -85,5 +85,16 @@ in
       inherit deps shakefile;
       texlive = our-texlive;
       ghc = our-ghc;
+
+      sort-imports = let
+        script = builtins.readFile support/sort-imports.hs;
+        # Extract the list of dependencies from the stack shebang comment.
+        deps = lib.concatLists (lib.filter (x: x != null)
+          (map (builtins.match ".*--package +([^[:space:]]*).*")
+            (lib.splitString "\n" script)));
+      in pkgs.writers.writeHaskellBin "sort-imports" {
+        ghc = pkgs.labHaskellPackages.ghc;
+        libraries = lib.attrVals deps pkgs.labHaskellPackages;
+      } script;
     };
   }