diff --git a/tests/Sanity/shadow-stack-smoke/hello.rs b/tests/Sanity/shadow-stack-smoke/hello.rs
new file mode 100644
index 0000000..e7a11a9
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/hello.rs
@@ -0,0 +1,3 @@
+fn main() {
+    println!("Hello, world!");
+}
diff --git a/tests/Sanity/shadow-stack-smoke/main.fmf b/tests/Sanity/shadow-stack-smoke/main.fmf
new file mode 100644
index 0000000..565ad68
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/main.fmf
@@ -0,0 +1,27 @@
+summary: Verify rustc enables Shadow Stack by default
+description: |
+    rustc must emit the SHSTK GNU property note on binaries and shared
+    libraries by default for x86_64-unknown-linux-gnu, without any extra
+    flags, so glibc can enable Intel CET Shadow Stack for them.
+duration: 5m
+tier: 1
+tag+:
+  - CI-Tier-1
+link+:
+  - verifies: https://redhat.atlassian.net/browse/RHEL-213919
+  - verifies: https://redhat.atlassian.net/browse/RHEL-223924
+  - relates: https://fedoraproject.org/wiki/Changes/ShadowStack
+adjust+:
+  - when: arch != x86_64
+    enabled: false
+    continue: false
+    because: Shadow Stack (Intel CET) is x86_64 only
+
+  # Shadow stack enabled only in RHEL 9.9+ and 10.3+ and F45+
+  # Centos Stream is RHEL upstream, available always.
+  # Not supported in RHEL-8 and older
+  - when: distro == rhel-9 and distro < rhel-9.9 or
+      distro == rhel-10 and distro < rhel-10.3 or
+      distro == fedora and distro < fedora-45 or
+      distro <= rhel-8
+    enabled: false
diff --git a/tests/Sanity/shadow-stack-smoke/runtest.sh b/tests/Sanity/shadow-stack-smoke/runtest.sh
new file mode 100755
index 0000000..103a7a2
--- /dev/null
+++ b/tests/Sanity/shadow-stack-smoke/runtest.sh
@@ -0,0 +1,40 @@
+#!/bin/bash
+# vim: dict+=/usr/share/beakerlib/dictionary.vim cpt=.,w,b,u,t,i,k
+. /usr/share/beakerlib/beakerlib.sh || exit 1
+
+PACKAGE="$(rpm -qf $(which rustc))"
+PACKAGES=${PACKAGES:-$PACKAGE}
+
+# rustc must mark x86_64-unknown-linux-gnu output as Shadow Stack (SHSTK)
+# compatible by default, without any extra flags:
+# https://fedoraproject.org/wiki/Changes/ShadowStack
+# https://issues.redhat.com/browse/RHEL-213919
+TARGET="x86_64-unknown-linux-gnu"
+
+rlJournalStart
+    rlPhaseStartSetup
+        rlAssertRpm --all
+        rlRun "tmp=\$(mktemp -d)" 0 "Create tmp directory"
+        rlRun "cp hello.rs $tmp"
+        rlRun "pushd $tmp"
+        rlRun "set -o pipefail"
+    rlPhaseEnd
+
+    rlPhaseStartTest "binary is marked SHSTK by default"
+        rlRun "rustc --target $TARGET hello.rs -o hello"
+        rlRun "./hello | grep 'Hello, world!'"
+        rlRun "readelf -n hello > hello-notes.out"
+        rlAssertGrep "SHSTK" hello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartTest "cdylib is marked SHSTK by default"
+        rlRun "rustc --target $TARGET --crate-type cdylib hello.rs -o libhello.so"
+        rlRun "readelf -n libhello.so > libhello-notes.out"
+        rlAssertGrep "SHSTK" libhello-notes.out
+    rlPhaseEnd
+
+    rlPhaseStartCleanup
+        rlRun "popd"
+        rlRun "rm -r $tmp" 0 "Remove tmp directory"
+    rlPhaseEnd
+rlJournalEnd