diff --git a/injected/unit-test/dependency-format.spec.js b/injected/unit-test/dependency-format.spec.js
new file mode 100644
index 0000000000..08d7abf172
--- /dev/null
+++ b/injected/unit-test/dependency-format.spec.js
@@ -0,0 +1,14 @@
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+describe('Dependency format check', () => {
+    it('should use a 13-digit numeric tag (not a commit hash or short hash) for @duckduckgo/privacy-configuration', () => {
+        const __filename = fileURLToPath(import.meta.url);
+        const __dirname = path.dirname(__filename);
+        const pkg = JSON.parse(fs.readFileSync(path.join(__dirname, '../package.json'), 'utf-8'));
+        const dep = pkg.dependencies['@duckduckgo/privacy-configuration'];
+        // Only allow 13-digit numeric tags and not a commit hash or short hash
+        expect(dep).toMatch(/^github:duckduckgo\/privacy-configuration#\d{13}$/);
+    });
+});