diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
new file mode 100644
index 00000000..ec3efc8f
--- /dev/null
+++ b/.github/workflows/cla.yml
@@ -0,0 +1,16 @@
+name: "CLA check"
+on: [pull_request, workflow_dispatch]
+
+permissions:
+  contents: read
+
+jobs:
+  cla-check:
+    permissions:
+      pull-requests: write  # for canonical/has-signed-canonical-cla to create & update comments
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if CLA signed
+        uses: canonical/has-signed-canonical-cla@1.2.3
+        with:
+          accept-existing-contributors: true