diff --git a/.github/workflows/require-encapsulation.yml b/.github/workflows/require-encapsulation.yml
new file mode 100644
index 00000000000..d50e4d37659
--- /dev/null
+++ b/.github/workflows/require-encapsulation.yml
@@ -0,0 +1,21 @@
+name: Check require encapsulation
+
+on:
+  push:
+    branches:
+      - "**"
+  pull_request:
+    # The branches below must be a subset of the branches above
+    branches: [ master ]
+
+jobs:
+  check-require-encapsulation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: '3.2'
+          bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+      - run: rm -f .rspec
+      - run: bundle exec rspec spec/require_encapsulation_check.rb
diff --git a/lib/datadog/appsec.rb b/lib/datadog/appsec.rb
index da38e6d749d..4d512187e3b 100644
--- a/lib/datadog/appsec.rb
+++ b/lib/datadog/appsec.rb
@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative 'core/configuration'
 require_relative 'appsec/configuration'
 require_relative 'appsec/extensions'
 require_relative 'appsec/scope'
diff --git a/lib/datadog/appsec/contrib/sinatra/integration.rb b/lib/datadog/appsec/contrib/sinatra/integration.rb
index 6e5b39cfec9..9408fafad5c 100644
--- a/lib/datadog/appsec/contrib/sinatra/integration.rb
+++ b/lib/datadog/appsec/contrib/sinatra/integration.rb
@@ -1,5 +1,6 @@
 # frozen_string_literal: true
 
+require_relative '../../../tracing/contrib'
 require_relative '../integration'
 
 require_relative 'patcher'
diff --git a/lib/datadog/appsec/contrib/sinatra/patcher.rb b/lib/datadog/appsec/contrib/sinatra/patcher.rb
index 3811e2a7351..cc39be5e22a 100644
--- a/lib/datadog/appsec/contrib/sinatra/patcher.rb
+++ b/lib/datadog/appsec/contrib/sinatra/patcher.rb
@@ -11,6 +11,7 @@
 require_relative 'gateway/route_params'
 require_relative 'gateway/request'
 require_relative '../../../tracing/contrib/sinatra/framework'
+require_relative '../../../tracing/contrib'
 
 module Datadog
   module AppSec
diff --git a/spec/require_encapsulation_check.rb b/spec/require_encapsulation_check.rb
new file mode 100644
index 00000000000..b90849e221f
--- /dev/null
+++ b/spec/require_encapsulation_check.rb
@@ -0,0 +1,31 @@
+require 'English'
+REQUIRES = %w[
+  datadog/appsec
+  datadog/core
+  datadog/kit
+  datadog/profiling
+  datadog/tracing
+].freeze
+
+RSpec.describe 'require encapsulation' do
+  before(:all) do
+    # Permit Datadog::VERSION to be defined but no other constants.
+    # See the note in gemspec about requiring 'datadog/version'.
+    expect(defined?(Datadog)).to eq 'constant'
+    expect(Datadog.constants).to eq([:VERSION])
+  end
+
+  REQUIRES.each do |req|
+    context req do
+      it 'loads' do
+        pid = fork do
+          require req
+          exec('true')
+        end
+
+        Process.waitpid(pid)
+        expect($CHILD_STATUS.exitstatus).to be 0
+      end
+    end
+  end
+end