diff --git a/RELEASE.md b/RELEASE.md
index abb79a32a8ca8d..c5aa5d540b1191 100644
--- a/RELEASE.md
+++ b/RELEASE.md
@@ -98,6 +98,7 @@ Alternatively use the Github UI.
 
 ### Miscellaneous Clean up
 
+1. Pin the spl-token-cli version in the newly promoted stable branch by setting `splTokenCliVersion` in scripts/spl-token-cli-version.sh to the latest release that depends on the stable branch (usually this will be the latest spl-token-cli release).
 1. Update [mergify.yml](https://github.com/solana-labs/solana/blob/master/.mergify.yml) to add backport actions for the new branch and remove actions for the obsolete branch.
 1. Adjust the [Github backport labels](https://github.com/solana-labs/solana/labels) to add the new branch label and remove the label for the obsolete branch.
 1. Announce on Discord #development that the release branch exists so people know to use the new backport labels.
diff --git a/ci/check-install-all.sh b/ci/check-install-all.sh
new file mode 100755
index 00000000000000..0ffb52a370818c
--- /dev/null
+++ b/ci/check-install-all.sh
@@ -0,0 +1,5 @@
+source scripts/spl-token-cli-version.sh
+if [[ -z $splTokenCliVersion ]]; then
+    echo "On the stable channel, splTokenCliVersion must be set in scripts/spl-token-cli-version.sh"
+    exit 1
+fi
diff --git a/ci/test-checks.sh b/ci/test-checks.sh
index e29ed1faae0454..533d05e1720ff3 100755
--- a/ci/test-checks.sh
+++ b/ci/test-checks.sh
@@ -76,4 +76,8 @@ _ scripts/cargo-for-all-lock-files.sh -- "+${rust_nightly}" fmt --all -- --check
 
 _ ci/do-audit.sh
 
+if [[ -n $CI ]] && [[ $CHANNEL = "stable" ]]; then
+  _ ci/check-install-all.sh
+fi
+
 echo --- ok
diff --git a/scripts/cargo-install-all.sh b/scripts/cargo-install-all.sh
index 4aceef69a4fe73..e48ce4e02deeb8 100755
--- a/scripts/cargo-install-all.sh
+++ b/scripts/cargo-install-all.sh
@@ -149,11 +149,15 @@ mkdir -p "$installDir/bin"
 
   # Exclude `spl-token` binary for net.sh builds
   if [[ -z "$validatorOnly" ]]; then
+    # shellcheck source=scripts/spl-token-cli-version.sh
+    source "$here"/spl-token-cli-version.sh
+
     # the patch-related configs are needed for rust 1.69+ on Windows; see Cargo.toml
     # shellcheck disable=SC2086 # Don't want to double quote $rust_version
     "$cargo" $maybeRustVersion \
       --config 'patch.crates-io.ntapi.git="https://github.com/solana-labs/ntapi"' \
       --config 'patch.crates-io.ntapi.rev="97ede981a1777883ff86d142b75024b023f04fad"' \
+      $maybeSplTokenCliVersionArg \
       install --locked spl-token-cli --root "$installDir"
   fi
 )
diff --git a/scripts/spl-token-cli-version.sh b/scripts/spl-token-cli-version.sh
new file mode 100644
index 00000000000000..82559c5bc4bbb6
--- /dev/null
+++ b/scripts/spl-token-cli-version.sh
@@ -0,0 +1,8 @@
+# populate this on the stable branch
+splTokenCliVersion=
+
+maybeSplTokenCliVersionArg=
+if [[ -n "$splTokenCliVersion" ]]; then
+    # shellcheck disable=SC2034
+    maybeSplTokenCliVersionArg="--version $splTokenCliVersion"
+fi