diff --git a/.github/workflows/validate-pull-request-refs.yaml b/.github/workflows/validate-pull-request-refs.yaml
new file mode 100644
index 00000000..eba8077a
--- /dev/null
+++ b/.github/workflows/validate-pull-request-refs.yaml
@@ -0,0 +1,20 @@
+name: Validate Pull Request Refs
+
+on:
+  workflow_call:
+
+jobs:
+  validate-pr-refs:
+    runs-on: ubuntu-latest
+    env:
+      PROD_REF: production
+      STAGING_REF: staging
+      DEV_REF: development
+    steps:
+      - name: Merge into "${{ env.STAGING_REF }}" from "${{ env.DEV_REF }}"
+        if: github.event.pull_request.base.ref == env.STAGING_REF
+        run: if [ ${{ github.event.pull_request.head.ref }} != ${{ env.DEV_REF }} ]; then exit 1; fi
+
+      - name: Merge into "${{ env.PROD_REF }}" from "${{ env.STAGING_REF }}"
+        if: github.event.pull_request.base.ref == env.PROD_REF
+        run: if [ ${{ github.event.pull_request.head.ref }} != ${{ env.STAGING_REF }} ]; then exit 1; fi