diff --git a/CHANGELOG.md b/CHANGELOG.md
index 41fd9bbe7e..c7c8d91ab6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1119,7 +1119,7 @@ that allows to add build-time environment variables (#15182)
 
 - devicemapper: Implement deferred deletion capability (#16381)
 
-## Networking
+### Networking
 
 + `docker network` exits experimental and is part of standard release (#16645)
 + New network top-level concept, with associated subcommands and API (#16645)
diff --git a/hack/validate/changelog-well-formed b/hack/validate/changelog-well-formed
new file mode 100755
index 0000000000..d75c1dd215
--- /dev/null
+++ b/hack/validate/changelog-well-formed
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+changelogFile=${1:-CHANGELOG.md}
+
+if [ ! -r "$changelogFile" ]; then
+  echo "Unable to read file $changelogFile" >&2
+  exit 1
+fi
+
+changelogWellFormed=1
+
+# e.g. "## 1.12.3 (2016-10-26)"
+VER_LINE_REGEX='^## [0-9]+\.[0-9]+\.[0-9]+ \([0-9]+-[0-9]+-[0-9]+\)$'
+while read -r line; do
+  if ! [[ "$line" =~ $VER_LINE_REGEX ]]; then
+    echo "Malformed changelog $changelogFile line \"$line\"" >&2
+    changelogWellFormed=0
+  fi
+done < <(grep '^## ' $changelogFile)
+
+if [[ "$changelogWellFormed" == "1" ]]; then
+  echo "Congratulations!  Changelog $changelogFile is well-formed."
+else
+  exit 2
+fi
diff --git a/hack/validate/default b/hack/validate/default
index 29b96ca9a3..fdd23ffe18 100755
--- a/hack/validate/default
+++ b/hack/validate/default
@@ -14,3 +14,4 @@ export SCRIPTDIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
 . $SCRIPTDIR/test-imports
 . $SCRIPTDIR/toml
 . $SCRIPTDIR/vet
+. $SCRIPTDIR/changelog-well-formed