diff --git a/.dev/lsan.supp b/.dev/lsan.supp
new file mode 100644
index 000000000..6ac2d14a1
--- /dev/null
+++ b/.dev/lsan.supp
@@ -0,0 +1 @@
+leak:libfontconfig.so
diff --git a/.dev/ubsan.supp b/.dev/ubsan.supp
new file mode 100644
index 000000000..bea1b67e1
--- /dev/null
+++ b/.dev/ubsan.supp
@@ -0,0 +1,2 @@
+# TODO(bit>4.5.0.1): remove after a new 'bit' version is on CRAN
+function:R_doDotCall
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 91d1a9849..793e73ccd 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -212,6 +212,25 @@ test-lin-ancient-cran:
     # Restore checking vignettes if upgrading our R dependency means knitr can be installed.
     - R CMD check --no-manual --no-build-vignettes --ignore-vignettes $(ls -1t data.table_*.tar.gz | head -n 1)
 
+# run the main checks with Address(+Leak),UBSanitizer enabled
+test-lin-san:
+  <<: *test-lin
+  image: docker.io/rocker/r-devel-ubsan-clang
+  variables:
+    # must be set for most of the process because there are pseudo-leaks everywhere
+    ASAN_OPTIONS: "detect_leaks=0"
+    # fontconfig is known to leak; add more suppressions as discovered
+    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/.dev/lsan.supp"
+    UBSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/.dev/ubsan.supp"
+  script:
+    - ln -svf "$(which RDscript)" "$(which Rscript)" # install-deps will run 'Rscript', we need R-devel+sanitizers
+    - *install-deps
+    - >-
+        ASAN_OPTIONS=detect_leaks=1 RD CMD check --no-manual $(ls -1t data.table_*.tar.gz | head -n 1); res1=$?
+        perl -nle '(print, $a=1) if /: runtime error: |ERROR: LeakSanitizer/../SUMMARY.*Sanitizer/ }{ exit $a' data.table.Rcheck/**/*.Rout*; res2=$?
+        # fail if R CMD check had failed or if sanitizer output found
+        [ $res1 -eq 0 ] && [ $res2 -eq 0 ]
+
 .test-win-template: &test-win
   <<: *test
   tags:
@@ -311,7 +330,7 @@ integration:
     - saas-linux-medium-amd64
   only:
     - master
-  needs: ["mirror-packages","build","test-lin-rel","test-lin-rel-cran","test-lin-dev-gcc-strict-cran","test-lin-dev-clang-cran","test-lin-rel-vanilla","test-lin-ancient-cran","test-win-rel","test-win-dev" ,"test-win-old","test-mac-rel","test-mac-old"]
+  needs: ["mirror-packages","build","test-lin-rel","test-lin-rel-cran","test-lin-dev-gcc-strict-cran","test-lin-dev-clang-cran","test-lin-rel-vanilla","test-lin-ancient-cran","test-lin-san","test-win-rel","test-win-dev" ,"test-win-old","test-mac-rel","test-mac-old"]
   script:
     - R --version
     - *install-deps ## markdown pkg not present in r-pkgdown image