diff --git a/.github/workflows/guardrail_matching_pentester_email_addresses.yml b/.github/workflows/guardrail_matching_pentester_email_addresses.yml
new file mode 100644
index 000000000..cd3face5c
--- /dev/null
+++ b/.github/workflows/guardrail_matching_pentester_email_addresses.yml
@@ -0,0 +1,57 @@
+name: "Guardrail: Matching pentester email addresses"
+
+on:
+  pull_request:
+    paths:
+      - "infra/deployments/forms/account/tfvars/staging.tfvars"
+      - "infra/deployments/deploy/engineer-access/roles.tf"
+      - ".github/workflows/guardrail_matching_pentester_email_addresses.yml"
+env:
+  HCL2JSON_VERSION: "v0.6.1"
+jobs:
+  check_for_matching_email_addresses:
+    runs-on: ubuntu-24.04-arm
+    permissions:
+      contents: read
+      pull-requests: write
+
+    name: Check for matching email addresses
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      - name: Install `hcl2json` with mise
+        uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
+        with:
+          install_args: hcl2json
+
+      - name: Check email addresses match everywhere
+        run: |
+          hcl2json infra/deployments/forms/account/tfvars/staging.tfvars | jq -rc '.pentester_email_addresses' > forms_acct_tfvars_staging
+          hcl2json infra/deployments/deploy/engineer-access/roles.tf | jq -rc '.module.engineer_access[0].pentesters' > deploy_engineer_access_roles
+
+          if ! cmp --silent forms_acct_tfvars_staging deploy_engineer_access_roles; then
+            cat <<EOF
+              If you're setting pen tester email addresses, make sure you set them the same everywhere
+              * infra/deployments/forms/account/tfvars/staging.tfvars
+              * infra/deployments/deploy/engineer-access/roles.tf
+          EOF
+
+            echo "infra/deployments/forms/account/tfvars/staging.tfvars"
+            cat forms_acct_tfvars_staging
+
+            echo "infra/deployments/deploy/engineer-access/roles.tf"
+            cat deploy_engineer_access_roles
+            exit 1
+          fi
+
+      - name: Check email addresses are only set in staging
+        run: |
+          while IFS= read -r file
+          do
+            if [ "$(hcl2json "${file}" | jq -rc '.pentester_email_addresses')" != "[]" ]; then
+              echo "Pentester email addresses should not be set outside of staging"
+              echo "Guilty file: ${file}"
+              exit 1
+            fi
+          done < <(find infra/deployments/forms/account/tfvars -maxdepth 1 -mindepth 1 -not -name "staging.tfvars"  -name "*.tfvars")