diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 6d33fed37b..e24f5dc11b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -182,6 +182,11 @@ precheck:debian:sid:amd64:
     expire_in: '1 week'
     when: on_failure
 
+precheck:🐞:sid:amd64:
+  <<: *debian_sid_amd64_image
+  stage: precheck
+  script: util/check-cocci
+
 docs:debian:sid:amd64:
   <<: *debian_sid_amd64_image
   stage: test
diff --git a/cocci/.gitignore b/cocci/.gitignore
new file mode 100644
index 0000000000..faacba5004
--- /dev/null
+++ b/cocci/.gitignore
@@ -0,0 +1 @@
+/*.patch
diff --git a/cocci/unreachable.spatch b/cocci/unreachable.spatch
new file mode 100644
index 0000000000..0cc368a516
--- /dev/null
+++ b/cocci/unreachable.spatch
@@ -0,0 +1,6 @@
+@@
+@@
+
+    INSIST(0);
++   ISC_UNREACHABLE();
+    ... when != ISC_UNREACHABLE();
diff --git a/lib/dns/geoip.c b/lib/dns/geoip.c
index 140fe3b65e..6e0ba71675 100644
--- a/lib/dns/geoip.c
+++ b/lib/dns/geoip.c
@@ -810,7 +810,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr,
 
 	default:
 		INSIST(0);
-		ISC_UNREACHABLE()
+		ISC_UNREACHABLE();
 	}
 
 	return (false);
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 0d75ff0c66..6fcd5dca17 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -334,7 +334,7 @@ make_addr_set(dns_rpz_addr_zbits_t *tgt_set, dns_rpz_zbits_t zbits,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -353,7 +353,7 @@ make_nm_set(dns_rpz_nm_zbits_t *tgt_set,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -2564,7 +2564,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 	result = ip2name(&found->ip, found->prefix, dns_rootname, ip_name);
 	RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
diff --git a/util/check-cocci b/util/check-cocci
new file mode 100755
index 0000000000..61792bd12e
--- /dev/null
+++ b/util/check-cocci
@@ -0,0 +1,15 @@
+#!/bin/sh
+
+ret=0
+for spatch in cocci/*.spatch; do
+    patch="$(dirname "$spatch")/$(basename "$spatch" .spatch).patch"
+    spatch --sp-file="$spatch" --use-gitgrep --dir . --very-quiet > "$patch";
+    if [ "$(< "$patch" wc -l)" -gt "0" ]; then
+	cat "$patch"
+	ret=1
+    else
+	rm "$patch"
+    fi
+done
+
+exit $ret
diff --git a/util/copyrights b/util/copyrights
index e53ed0fc9f..3d6841dfd0 100644
--- a/util/copyrights
+++ b/util/copyrights
@@ -1285,6 +1285,7 @@
 ./bin/win32/BINDInstall/resource.h		X	2001,2005,2009,2018
 ./bind.keys					X	2009,2010,2011,2017,2018
 ./bind.keys.h					X	2009,2010,2011,2012,2014,2017,2018
+./cocci/unreachable.spatch			X	2018
 ./config.guess					X	1998,1999,2000,2001,2004,2009,2013,2018
 ./config.h.in					X	1998,1999,2000,2001,2002,2003,2004,2005,2006,2007,2008,2009,2010,2011,2012,2013,2014,2015,2016,2017,2018
 ./config.h.win32				C	1999,2000,2001,2004,2006,2007,2008,2009,2011,2012,2013,2014,2015,2016,2017,2018
@@ -2568,6 +2569,7 @@
 ./util/branchsync.sh				SH	2013,2016,2018
 ./util/check-categories.sh			SH	2015,2016,2017,2018
 ./util/check-changes				PERL	2002,2004,2007,2012,2016,2018
+./util/check-cocci				X	2018
 ./util/check-includes.pl			PERL	2000,2001,2004,2007,2012,2016,2017,2018
 ./util/check-instincludes.sh			SH	2000,2001,2004,2007,2012,2016,2018
 ./util/check-pullups.pl				PERL	2001,2002,2003,2004,2007,2012,2016,2018