diff --git a/.github/workflows/test-db-changes.yml b/.github/workflows/test-db-changes.yml
index bef39197e2..e00e8af549 100644
--- a/.github/workflows/test-db-changes.yml
+++ b/.github/workflows/test-db-changes.yml
@@ -82,3 +82,13 @@ jobs:
           fi
           index=$((index+1))
         done
+
+    - name: Prevent hosts foreign keys
+      run: |
+        MATCHES=$(git diff --name-only origin/main | grep "migrations/" | xargs grep -i -E 'references\s*hosts\s*\(\s*id\s*\)' )
+        if [ -n "$MATCHES" ]; then
+          echo "❌ fail: hosts foreign keys are not allowed"
+          echo "$MATCHES"
+          echo "Ref: https://github.com/fleetdm/fleet/blob/main/handbook/engineering/scaling-fleet.md#foreign-keys-and-locking"
+          exit 1
+        fi