diff --git a/.github/workflows/submodule-pin-check.sh b/.github/workflows/submodule-pin-check.sh
new file mode 100755
index 0000000000..aecb287ce1
--- /dev/null
+++ b/.github/workflows/submodule-pin-check.sh
@@ -0,0 +1,26 @@
+#!/bin/bash
+
+declare -Ar exceptions=(
+	[contracts]=origin/develop
+	[nitro-testnode]=origin/master
+
+	#TODO Rachel to check these are the intended branches.
+	[arbitrator/langs/c]=origin/vm-storage-cache
+	[arbitrator/tools/wasmer]=origin/adopt-v4.2.8
+)
+
+divergent=0
+for mod in `git submodule --quiet foreach 'echo $name'`; do
+	branch=origin/HEAD
+	if [[ -v exceptions[$mod] ]]; then
+		branch=${exceptions[$mod]}
+	fi
+
+	if ! git -C $mod merge-base --is-ancestor HEAD $branch; then
+		echo $mod diverges from $branch
+		divergent=1
+	fi
+done
+
+exit $divergent
+
diff --git a/.github/workflows/submodule-pin-check.yml b/.github/workflows/submodule-pin-check.yml
new file mode 100644
index 0000000000..e459bad34d
--- /dev/null
+++ b/.github/workflows/submodule-pin-check.yml
@@ -0,0 +1,21 @@
+name: Submodule Pin Check
+
+on:
+  pull_request:
+    branches: [ master ]
+    types: [synchronize, opened, reopened]
+
+jobs:
+  submodule-pin-check:
+    name: Submodule Pin Check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          submodules: recursive
+
+      - name: Check all submodules are ancestors of origin/HEAD or configured branch
+        run: ${{ github.workspace }}/.github/workflows/submodule-pin-check.sh
+
diff --git a/arbitrator/langs/bf b/arbitrator/langs/bf
index 062b87bad1..cb5750580f 160000
--- a/arbitrator/langs/bf
+++ b/arbitrator/langs/bf
@@ -1 +1 @@
-Subproject commit 062b87bad1ec00d42b9cc2b5ee41e63cd6ff1cbb
+Subproject commit cb5750580f6990b5166ffce83de11b766a25ca31