diff --git a/.github/workflows/cve-monitor-list-check.yml b/.github/workflows/cve-monitor-list-check.yml
new file mode 100644
index 000000000000..8a3ab03ed39f
--- /dev/null
+++ b/.github/workflows/cve-monitor-list-check.yml
@@ -0,0 +1,54 @@
+# Ensures dependency-cve-monitor.yml stays in sync when modules are removed.
+name: "Dependency CVE Monitor Verification"
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  verify-exclusion-list:
+    name: Verify CVE monitor exclusion list
+    runs-on: ubuntu-latest
+    timeout-minutes: 2
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Validate -pl exclusion list against reactor modules
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          WORKFLOW_FILE=".github/workflows/dependency-cve-monitor.yml"
+
+          # Extract the -pl argument from the workflow file
+          PL_LINE=$(grep -oP '(?<=-pl )\S+' "$WORKFLOW_FILE")
+          if [ -z "$PL_LINE" ]; then
+            echo "Could not find -pl argument in $WORKFLOW_FILE"
+            exit 1
+          fi
+
+          # Parse individual module exclusions (remove leading '!')
+          EXCLUDED_MODULES=$(echo "$PL_LINE" | tr ',' '\n' | sed 's/^!//')
+
+          # Collect all reactor modules from root pom.xml (recursive through submodule poms)
+          REACTOR_MODULES=$(grep -ohP '(?<=<module>)[^<]+' pom.xml)
+
+          HAS_ERRORS=0
+          while IFS= read -r MODULE; do
+            if ! echo "$REACTOR_MODULES" | grep -qx "$MODULE"; then
+              echo "::error::Module '$MODULE' is excluded in $WORKFLOW_FILE but does not exist in the Maven reactor (pom.xml)"
+              HAS_ERRORS=1
+            fi
+          done <<< "$EXCLUDED_MODULES"
+
+          if [ $HAS_ERRORS -eq 1 ]; then
+            echo ""
+            echo "The -pl exclusion list in $WORKFLOW_FILE references modules that are no longer in the reactor."
+            echo "Please remove the stale entries from the exclusion list."
+            exit 1
+          fi
+
+          echo "All excluded modules are valid reactor modules."
diff --git a/.github/workflows/dependency-cve-monitor.yml b/.github/workflows/dependency-cve-monitor.yml
index 9164ddb4d0c3..00cc0b12e9cc 100644
--- a/.github/workflows/dependency-cve-monitor.yml
+++ b/.github/workflows/dependency-cve-monitor.yml
@@ -21,7 +21,7 @@ jobs:
           maven-args: >-
             -DtransitiveExcludes=*:*
             -DclasspathScope=runtime
-            -pl !build-tools,!release-scripts,!archetypes,!test/test-utils,!test/sdk-benchmarks,!test/http-client-tests,!test/http-client-benchmarks,!test/s3-benchmarks,!test/protocol-tests-core,!test/ruleset-testing-core,!test/protocol-tests,!test/service-test-utils,!test/codegen-generated-classes-test,!test/sdk-standard-benchmarks,!test/module-path-tests,!test/tests-coverage-reporting,!test/stability-tests,!test/sdk-native-image-test,!test/auth-tests,!test/region-testing,!test/old-client-version-compatibility-test,!test/bundle-logging-bridge-binding-test,!test/v2-migration-tests,!test/bundle-shading-tests,!test/crt-unavailable-tests,!test/architecture-tests,!test/s3-tests
+            -pl !build-tools,!release-scripts,!archetypes,!test/test-utils,!test/sdk-benchmarks,!test/http-client-tests,!test/http-client-benchmarks,!test/s3-benchmarks,!test/protocol-tests-core,!test/ruleset-testing-core,!test/protocol-tests,!test/service-test-utils,!test/codegen-generated-classes-test,!test/sdk-standard-benchmarks,!test/module-path-tests,!test/tests-coverage-reporting,!test/stability-tests,!test/sdk-native-image-test,!test/auth-tests,!test/service-client-backward-compat-test,!test/bundle-logging-bridge-binding-test,!test/v2-migration-tests,!test/bundle-shading-tests,!test/crt-unavailable-tests,!test/architecture-tests,!test/s3-tests
 
   notify-alerts:
     if: github.repository == 'aws/aws-sdk-java-v2'