diff --git a/ci/buildkite.yml b/ci/buildkite.yml
index bc04140936..1123bb8611 100644
--- a/ci/buildkite.yml
+++ b/ci/buildkite.yml
@@ -5,6 +5,9 @@
 # Release tags use buildkite-release.yml instead
 
 steps:
+  - command: "ci/test-sanity.sh"
+    name: "sanity"
+    timeout_in_minutes: 5
   - command: "ci/dependabot-pr.sh"
     name: "dependabot"
     timeout_in_minutes: 5
diff --git a/ci/test-checks.sh b/ci/test-checks.sh
index c470f4db20..7c39bf7974 100755
--- a/ci/test-checks.sh
+++ b/ci/test-checks.sh
@@ -10,9 +10,6 @@ source ci/rust-version.sh nightly
 export RUST_BACKTRACE=1
 export RUSTFLAGS="-D warnings"
 
-# Look for failed mergify.io backports
-_ git show HEAD --check --oneline
-
 if _ scripts/cargo-for-all-lock-files.sh +"$rust_nightly" check --locked --all-targets; then
   true
 else
@@ -29,10 +26,8 @@ _ cargo +"$rust_stable" clippy --workspace -- --deny=warnings
 
 _ cargo +"$rust_stable" audit --version
 _ scripts/cargo-for-all-lock-files.sh +"$rust_stable" audit --ignore RUSTSEC-2020-0002 --ignore RUSTSEC-2020-0008
-_ ci/nits.sh
 _ ci/order-crates-for-publishing.py
 _ docs/build.sh
-_ ci/check-ssh-keys.sh
 
 {
   cd programs/bpf
diff --git a/ci/test-sanity.sh b/ci/test-sanity.sh
new file mode 100755
index 0000000000..00ce062eb1
--- /dev/null
+++ b/ci/test-sanity.sh
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+set -e
+
+cd "$(dirname "$0")/.."
+
+source ci/_
+
+(
+  echo --- git show --check
+  set -x
+  # Look for failed mergify.io backports by searching leftover conflict markers
+  # Also check for any trailing whitespaces!
+  if [[ -n $BUILDKITE_PULL_REQUEST_BASE_BRANCH ]]; then
+    base_branch=$BUILDKITE_PULL_REQUEST_BASE_BRANCH
+  else
+    base_branch=$BUILDKITE_BRANCH
+  fi
+  git fetch origin "$base_branch"
+  git show "$(git merge-base HEAD "origin/$base_branch")..HEAD" --check --oneline
+)
+
+echo
+
+_ ci/nits.sh
+_ ci/check-ssh-keys.sh
+
+echo --- ok