diff --git a/.github/workflows/ci-windows.yml b/.github/workflows/ci-windows.yml
index b0a9caa84..369512c47 100644
--- a/.github/workflows/ci-windows.yml
+++ b/.github/workflows/ci-windows.yml
@@ -240,6 +240,50 @@ jobs:
           ninja -C build
           echo "::remove-matcher owner=gcc::"
 
+      - name: Check Windows linkage
+        shell: msys2 {0}
+        run: |
+          set -euo pipefail
+
+          binaries=(
+            build/sunshine.exe
+            build/tools/audio-info.exe
+            build/tools/dxgi-info.exe
+            build/tools/sunshinesvc.exe
+            build/tests/test_sunshine.exe
+          )
+
+          unexpected_deps=""
+          for binary in "${binaries[@]}"; do
+            echo "::group::ldd ${binary}"
+            if ! linkage="$(ldd "${binary}")"; then
+              echo "${linkage}"
+              exit 1
+            fi
+            echo "${linkage}"
+            echo "::endgroup::"
+
+            unexpected_for_binary="$(awk '
+              BEGIN { IGNORECASE = 1 }
+              $1 == "zlib1.dll" { next }
+              $1 ~ /^minhook-detours\..*\.dll$/ { next }
+              $1 ~ /^api-ms-win-/ { next }
+              $1 ~ /^ext-ms-win-/ { next }
+              $0 ~ /=>[[:space:]]+not found/ { print }
+              $0 ~ /=>[[:space:]]+\/(clangarm64|clang64|mingw32|mingw64|ucrt64)\/bin\// { print }
+            ' <<< "${linkage}")"
+
+            if [[ -n "${unexpected_for_binary}" ]]; then
+              unexpected_deps="${unexpected_deps}"$'\n'"${binary}:"$'\n'"${unexpected_for_binary}"
+            fi
+          done
+
+          if [[ -n "${unexpected_deps}" ]]; then
+            echo "Unexpected non-packaged runtime dependencies were found:"
+            echo "${unexpected_deps}"
+            exit 1
+          fi
+
       - name: Sign Windows executables
         # ARM64 is not currently supported, see https://github.com/Azure/artifact-signing-action/issues/92
         if: inputs.publish_release == 'true' && inputs.azure_signing_account != '' && matrix.name != 'Windows-ARM64'