diff --git a/.editorconfig b/.editorconfig
index 30288000..69ef6731 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -12,3 +12,9 @@
 
 	[*.md]
 	trim_trailing_whitespace = false
+
+	# Preserve the UTF-8 byte order mark in the BOM ruleset test fixtures, so that
+	# editors honouring EditorConfig do not silently strip it (which would
+	# invalidate the Generic.Files.ByteOrderMark ruleset test).
+	[*-bom.inc]
+	charset = utf-8-bom
diff --git a/WordPress-VIP-Go/ruleset-test-bom.inc b/WordPress-VIP-Go/ruleset-test-bom.inc
new file mode 100644
index 00000000..7ecb784f
--- /dev/null
+++ b/WordPress-VIP-Go/ruleset-test-bom.inc
@@ -0,0 +1,3 @@
+<?php
+// This file intentionally begins with a UTF-8 byte order mark (BOM) to test that
+// the Generic.Files.ByteOrderMark sniff is included in the ruleset. Error on line 1.
diff --git a/WordPress-VIP-Go/ruleset-test.php b/WordPress-VIP-Go/ruleset-test.php
index f7af1404..6f929fbb 100644
--- a/WordPress-VIP-Go/ruleset-test.php
+++ b/WordPress-VIP-Go/ruleset-test.php
@@ -324,11 +324,29 @@
 	],
 ];
 
+// Expected values for the dedicated byte order mark (BOM) fixture.
+$bom_expected = [
+	'errors'   => [
+		1 => 1,
+	],
+	'warnings' => [],
+	'messages' => [
+		1 => [
+			'File contains UTF-8 byte order mark, which may corrupt your application',
+		],
+	],
+];
+
 require __DIR__ . '/../tests/RulesetTest.php';
 
 // Run the tests!
-$test = new RulesetTest( 'WordPress-VIP-Go', $expected );
-if ( $test->passes() ) {
+$test     = new RulesetTest( 'WordPress-VIP-Go', $expected );
+$bom_test = new RulesetTest( 'WordPress-VIP-Go', $bom_expected, 'ruleset-test-bom.inc' );
+
+// Evaluate both tests before the check so each reports its own discrepancies rather than being short-circuited away.
+$test_passes     = $test->passes();
+$bom_test_passes = $bom_test->passes();
+if ( $test_passes && $bom_test_passes ) {
 	printf( 'All WordPress-VIP-Go tests passed!' . PHP_EOL );
 	exit( 0 );
 }
diff --git a/WordPressVIPMinimum/ruleset-test-bom.inc b/WordPressVIPMinimum/ruleset-test-bom.inc
new file mode 100644
index 00000000..7ecb784f
--- /dev/null
+++ b/WordPressVIPMinimum/ruleset-test-bom.inc
@@ -0,0 +1,3 @@
+<?php
+// This file intentionally begins with a UTF-8 byte order mark (BOM) to test that
+// the Generic.Files.ByteOrderMark sniff is included in the ruleset. Error on line 1.
diff --git a/WordPressVIPMinimum/ruleset-test.php b/WordPressVIPMinimum/ruleset-test.php
index 4d31b841..8fd42f54 100644
--- a/WordPressVIPMinimum/ruleset-test.php
+++ b/WordPressVIPMinimum/ruleset-test.php
@@ -309,11 +309,29 @@
 	],
 ];
 
+// Expected values for the dedicated byte order mark (BOM) fixture.
+$bom_expected = [
+	'errors'   => [
+		1 => 1,
+	],
+	'warnings' => [],
+	'messages' => [
+		1 => [
+			'File contains UTF-8 byte order mark, which may corrupt your application',
+		],
+	],
+];
+
 require __DIR__ . '/../tests/RulesetTest.php';
 
 // Run the tests!
-$test = new RulesetTest( 'WordPressVIPMinimum', $expected );
-if ( $test->passes() ) {
+$test     = new RulesetTest( 'WordPressVIPMinimum', $expected );
+$bom_test = new RulesetTest( 'WordPressVIPMinimum', $bom_expected, 'ruleset-test-bom.inc' );
+
+// Evaluate both tests before the check so each reports its own discrepancies rather than being short-circuited away.
+$test_passes     = $test->passes();
+$bom_test_passes = $bom_test->passes();
+if ( $test_passes && $bom_test_passes ) {
 	printf( 'All WordPressVIPMinimum tests passed!' . PHP_EOL );
 	exit( 0 );
 }
diff --git a/WordPressVIPMinimum/ruleset.xml b/WordPressVIPMinimum/ruleset.xml
index c735a3b9..c0f66990 100644
--- a/WordPressVIPMinimum/ruleset.xml
+++ b/WordPressVIPMinimum/ruleset.xml
@@ -60,6 +60,7 @@
 		</properties>
 	</rule>
 
+	<rule ref="Generic.Files.ByteOrderMark"/>
 	<rule ref="Generic.VersionControl.GitMergeConflict"/>
 	<rule ref="Generic.NamingConventions.ConstructorName"/>
 	<rule ref="Generic.PHP.DisallowShortOpenTag"/>
diff --git a/tests/RulesetTest.php b/tests/RulesetTest.php
index 3fb863f4..dc03e3ef 100644
--- a/tests/RulesetTest.php
+++ b/tests/RulesetTest.php
@@ -74,6 +74,13 @@ class RulesetTest {
 	 */
 	private $phpcs_bin = 'phpcs';
 
+	/**
+	 * Name of the fixture file (relative to the ruleset directory) to check.
+	 *
+	 * @var string
+	 */
+	private $fixture = 'ruleset-test.inc';
+
 	/**
 	 * String returned by PHP_CodeSniffer report for an Error.
 	 */
@@ -84,10 +91,12 @@ class RulesetTest {
 	 *
 	 * @param string                                       $ruleset  Name of the ruleset e.g. WordPressVIPMinimum or WordPress-VIP-Go.
 	 * @param array<string, array<int, int|array<string>>> $expected The array of expected errors, warnings and messages.
+	 * @param string                                       $fixture  Name of the fixture file within the ruleset directory to check. Defaults to `ruleset-test.inc`.
 	 */
-	public function __construct( $ruleset, $expected = [] ) {
+	public function __construct( $ruleset, $expected = [], $fixture = 'ruleset-test.inc' ) {
 		$this->ruleset  = $ruleset;
 		$this->expected = $expected;
+		$this->fixture  = $fixture;
 
 		// Travis and Windows support.
 		$phpcs_bin = getenv( 'PHPCS_BIN' );
@@ -99,7 +108,7 @@ public function __construct( $ruleset, $expected = [] ) {
 		}
 
 		// phpcs:ignore WordPress.Security.EscapeOutput.OutputNotEscaped
-		printf( 'Testing the ' . $this->ruleset . ' ruleset.' . PHP_EOL );
+		printf( 'Testing the ' . $this->ruleset . ' ruleset against ' . $this->fixture . '.' . PHP_EOL );
 
 		$output = $this->collect_phpcs_result();
 
@@ -149,11 +158,12 @@ private function collect_phpcs_result() {
 
 		$report_file = dirname( __DIR__ ) . '/ruleset-tests-report.json';
 		$shell       = sprintf(
-			'%1$s%2$s --severity=1 --standard=%3$s --report-json=%4$s ./%3$s/ruleset-test.inc',
+			'%1$s%2$s --severity=1 --standard=%3$s --report-json=%4$s ./%3$s/%5$s',
 			$php, // Current PHP executable if available.
 			$this->phpcs_bin,
 			$this->ruleset,
-			$report_file
+			$report_file,
+			$this->fixture
 		);
 
 		// phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.system_calls_shell_exec -- This is test code, not production.