diff --git a/.github/workflows/jig-terraform-check.yml b/.github/workflows/jig-terraform-check.yml
new file mode 100644
index 0000000..ea46019
--- /dev/null
+++ b/.github/workflows/jig-terraform-check.yml
@@ -0,0 +1,76 @@
+name: jig-terraform-check
+
+on:
+  pull_request:
+    branches: [ main, master ]
+
+jobs:
+  check-module-versions:
+    name: jig-terraform-check
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout PR branch
+        uses: actions/checkout@v4
+
+      - name: Check Terraform module version compliance
+        shell: bash
+        run: |
+          MODULE_SOURCE="terraform-aws-modules/vpc/aws"
+          CHECK_TYPE="version"
+          DESIRED_VALUE="6.1.1"
+
+          FAILED=0
+
+          while IFS= read -r -d '' tf_file; do
+            # Extract module blocks and check source + version/ref
+            python3 - "$tf_file" "$MODULE_SOURCE" "$CHECK_TYPE" "$DESIRED_VALUE" <<'PYEOF'
+          import sys, re
+
+          tf_file, module_source, check_type, desired_value = sys.argv[1:]
+
+          with open(tf_file) as f:
+              content = f.read()
+
+          # Find all module blocks
+          module_blocks = re.findall(r'module\s+"[^"]+"\s*\{([^}]+)\}', content, re.DOTALL)
+
+          for block in module_blocks:
+              source_match = re.search(r'source\s*=\s*"([^"]+)"', block)
+              if not source_match:
+                  continue
+
+              source = source_match.group(1)
+
+              # Strip ?ref= for git module comparison
+              source_base = re.sub(r'\?ref=.*$', '', source)
+
+              if check_type == 'ref':
+                  if source_base != module_source:
+                      continue
+                  ref_match = re.search(r'\?ref=(.+)$', source)
+                  current = ref_match.group(1) if ref_match else ''
+              else:
+                  if source != module_source:
+                      continue
+                  ver_match = re.search(r'version\s*=\s*"([^"]+)"', block)
+                  current = ver_match.group(1) if ver_match else ''
+
+              if current != desired_value:
+                  print(f"FAIL: {tf_file}: module source '{module_source}' has {check_type}='{current}', expected '{desired_value}'")
+                  sys.exit(1)
+          PYEOF
+
+            if [ $? -ne 0 ]; then
+              FAILED=1
+            fi
+          done < <(find . -name '*.tf' -not -path './.terraform/*' -print0)
+
+          if [ $FAILED -ne 0 ]; then
+            echo ""
+            echo "Module version policy violation detected."
+            echo "Expected module 'terraform-aws-modules/vpc/aws' to use version='6.1.1'."
+            echo "Run 'jig run' or merge the Jig reconciliation PR to fix this."
+            exit 1
+          fi
+
+          echo "All terraform module versions are compliant."