diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index 518d3f7c583cd3..eca58cad4d9782 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -38,6 +38,7 @@ jobs:
         env:
             BUILD_VARIANT: ${{matrix.build_variant}}
             CHIP_TOOL_VARIANT: ${{matrix.chip_tool}}
+            TSAN_OPTIONS: "halt_on_error=1 suppressions=scripts/tests/chiptest/tsan-linux-suppressions.txt"
 
         if: github.actor != 'restyled-io[bot]'
         runs-on: ubuntu-latest
@@ -124,6 +125,7 @@ jobs:
         env:
             BUILD_VARIANT: ${{matrix.build_variant}}
             CHIP_TOOL_VARIANT: ${{matrix.chip_tool}}
+            TSAN_OPTIONS: "halt_on_error=1"
 
         if: github.actor != 'restyled-io[bot]'
         runs-on: macos-latest
diff --git a/scripts/tests/chiptest/tsan-linux-suppressions.txt b/scripts/tests/chiptest/tsan-linux-suppressions.txt
new file mode 100644
index 00000000000000..e5f8cec28d51ee
--- /dev/null
+++ b/scripts/tests/chiptest/tsan-linux-suppressions.txt
@@ -0,0 +1,10 @@
+# The Linux server app ends up with a data race in libglib.  A race_top
+# suppression does not work, since the actual race is inside a memset, so the
+# thing on top of the stack is memset.  called_from_lib is a narrower
+# suppression than a "race" suppression (which would be "libglib anywhere on the
+# stack", as opposed to "inside a function TSan intercepts, which was called
+# from libglib).
+#
+# See https://github.com/project-chip/connectedhomeip/issues/14710 for
+# addressing this.
+called_from_lib:libglib