diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c08533b447..5df96325a0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -60,6 +60,27 @@ jobs:
           }
           exit $process.ExitCode
 
+  verify-test-doesnt-use-internal-apis:
+    runs-on: 'windows-2019'
+    env:
+      GOPROXY: "https://proxy.golang.org,direct"
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-go@v2
+        with:
+          go-version: '^1.15.0'
+      - name: Validate test module doesn't use internal APIs
+        shell: powershell
+        run: |
+          $currentPath = (Get-Location).Path
+          $failures = & ${currentPath}/test/scripts/Verify-NoInternalImports.ps1 "${currentPath}/test"
+          if ($failures.Length -gt 0) {
+            Write-Error ("Test module should not depend on github.com/Microsoft/hcsshim/internal/... to function." + "`r`n" + $failures)
+          }
+          exit $failures.Length
+        # TODO: Remove this once this test succeeds.
+        continue-on-error: true
+
   test:
     runs-on: 'windows-2019'
     steps:
diff --git a/test/scripts/Verify-NoInternalImports.ps1 b/test/scripts/Verify-NoInternalImports.ps1
new file mode 100644
index 0000000000..0f3005dd01
--- /dev/null
+++ b/test/scripts/Verify-NoInternalImports.ps1
@@ -0,0 +1,7 @@
+$FOUND = 0
+Get-ChildItem -Path $args[0] -Recurse -Include '*.go' | Where-Object { $_.Directory -NotMatch 'vendor|internal' } | ForEach-Object {
+    $LISTDATA = (go list -tags functional -json $_.FullName | ConvertFrom-Json)
+    $INTERNALS = $LISTDATA.Imports.Where({ $_.StartsWith("github.com/Microsoft/hcsshim/internal") }) + $LISTDATA.TestImports.Where({ $_.StartsWith("github.com/Microsoft/hcsshim/internal") })
+    if ($INTERNALS.Length -gt 0) { Write-Output "$_ contains one or more imports from github.com/Microsoft/hcsshim/internal/..."; $FOUND += 1 }
+}
+exit $FOUND