diff --git a/CMakeLists.txt b/CMakeLists.txt
index 0c4ba6cc..cdaaeb4b 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,8 +1,6 @@
 cmake_minimum_required(VERSION 3.0 FATAL_ERROR)
 cmake_policy(SET CMP0054 NEW)
 
-# note: for clang-tidy, we need cmake 3.6, or (if the return code should be handled correctly, e.g. on CI), we need 3.8.
-
 # TODO Perf test:
 #  - try if setting CRYPTOPP_NATIVE_ARCH=ON and adding -march=native to the compile commands for cryfs source files makes a difference
 #    -> if yes, offer a cmake option to enable both of these
@@ -22,8 +20,18 @@ option(DISABLE_OPENMP "allow building without OpenMP libraries. This will cause
 # The following options are helpful for development and/or CI
 option(USE_WERROR "build with -Werror flag")
 option(USE_CLANG_TIDY "build with clang-tidy checks enabled" OFF)
+option(USE_IWYU "build with iwyu checks enabled" OFF)
 option(CLANG_TIDY_WARNINGS_AS_ERRORS "treat clang-tidy warnings as errors" OFF)
 
+if(USE_IWYU)
+    # note: for iwyu, we need cmake 3.3
+    cmake_minimum_required(VERSION 3.3 FATAL_ERROR)
+endif()
+if(USE_CLANG_TIDY)
+    # note: for clang-tidy, we need cmake 3.6, or (if the return code should be handled correctly, e.g. on CI), we need 3.8.
+    cmake_minimum_required(VERSION 3.8 FATAL_ERROR)
+endif()
+
 
 if (MSVC)
     option(DOKAN_PATH "Location of the Dokan library, e.g. C:\\Program Files\\Dokan\\DokanLibrary-1.1.0" "")
diff --git a/cmake-utils/utils.cmake b/cmake-utils/utils.cmake
index c697332f..004a7e45 100644
--- a/cmake-utils/utils.cmake
+++ b/cmake-utils/utils.cmake
@@ -50,6 +50,21 @@ if (USE_CLANG_TIDY)
     endif()
 endif()
 
+# Find iwyu (for use in target_enable_style_warnings)
+if (USE_IWYU)
+    find_program(
+      IWYU_EXE NAMES
+      include-what-you-use
+      iwyu
+    )
+    if(NOT IWYU_EXE)
+        message(FATAL_ERROR "include-what-you-use not found. Please install iwyu or run without -DUSE_IWYU=on.")
+    else()
+        message(STATUS "iwyu found: ${IWYU_EXE}")
+        set(DO_IWYU "${IWYU_EXE}")
+    endif()
+endif()
+
 #################################################
 # Enable style compiler warnings
 #
@@ -75,6 +90,12 @@ function(target_enable_style_warnings TARGET)
           CXX_CLANG_TIDY "${CLANG_TIDY_CLI}"
         )
     endif()
+    if(USE_IWYU)
+        set_target_properties(
+          ${TARGET} PROPERTIES
+          CXX_INCLUDE_WHAT_YOU_USE "${DO_IWYU}"
+        )
+    endif()
 endfunction(target_enable_style_warnings)
 
 ##################################################
diff --git a/run-iwyu.sh b/run-iwyu.sh
new file mode 100755
index 00000000..50478862
--- /dev/null
+++ b/run-iwyu.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+# Note: Call this from a cmake build directory (e.g. cmake/) for out-of-source builds
+# Examples:
+# mkdir cmake && cd cmake && ../run-iwqu.sh
+# mkdir cmake && cd cmake && ../run-iwqu.sh -fix
+
+set -e
+
+export NUMCORES=`nproc` && if [ ! -n "$NUMCORES" ]; then export NUMCORES=`sysctl -n hw.ncpu`; fi
+echo Using ${NUMCORES} cores
+
+# Run cmake in current working directory, but on source that is in the same directory as this script file
+cmake -DBUILD_TESTING=on -DCMAKE_EXPORT_COMPILE_COMMANDS=ON "${0%/*}"
+
+# Filter all third party code from the compilation database
+cat compile_commands.json|jq "map(select(.file | test(\"^$(realpath ${0%/*})/(src|test)/.*$\")))" > compile_commands2.json
+rm compile_commands.json
+mv compile_commands2.json compile_commands.json
+
+if [ "$1" = "-fix" ]; then
+  TMPFILE=/tmp/iwyu.`cat /dev/urandom | tr -cd 'a-f0-9' | head -c 8`.out
+
+  function cleanup {
+    rm ${TMPFILE}
+  }
+  trap cleanup EXIT
+
+  iwyu_tool -j${NUMCORES} -p. ${@:2} | tee ${TMPFILE}
+  fix_include < ${TMPFILE}
+else
+  iwyu_tool -j${NUMCORES} -p. $@
+fi