diff --git a/cli-tests/src/upload.rs b/cli-tests/src/upload.rs
index d7e5208b..f0964fb3 100644
--- a/cli-tests/src/upload.rs
+++ b/cli-tests/src/upload.rs
@@ -1730,3 +1730,23 @@ async fn reports_failures_even_if_cannot_get_quarantine_context() {
 
     println!("{assert}");
 }
+
+#[tokio::test(flavor = "multi_thread")]
+async fn fails_if_sha_is_too_long() {
+    let temp_dir = tempdir().unwrap();
+    generate_mock_git_repo(&temp_dir);
+    generate_mock_valid_junit_xmls_with_failures(&temp_dir);
+
+    let mock_server_builder = MockServerBuilder::new();
+    let state = mock_server_builder.spawn_mock_server().await;
+
+    let mut command = CommandBuilder::upload(temp_dir.path(), state.host.clone())
+        .repo_head_sha("12345678901234567890123456789012345678901")
+        .command();
+
+    let assert = command.assert().failure().stderr(predicate::str::contains(
+        "Sha code must be at most 40 characters, was 41",
+    ));
+
+    println!("{assert}");
+}
diff --git a/cli/src/upload_command.rs b/cli/src/upload_command.rs
index d615dc74..bc1551bd 100644
--- a/cli/src/upload_command.rs
+++ b/cli/src/upload_command.rs
@@ -81,7 +81,7 @@ pub struct UploadArgs {
     pub repo_root: Option<String>,
     #[arg(long, help = "Value to override URL of repository.")]
     pub repo_url: Option<String>,
-    #[arg(long, help = "Value to override SHA of repository head.")]
+    #[arg(long, help = "Value to override SHA of repository head.", value_parser = parse_sha)]
     pub repo_head_sha: Option<String>,
     #[arg(long, help = "Value to override branch of repository head.")]
     pub repo_head_branch: Option<String>,
@@ -222,6 +222,17 @@ pub struct UploadArgs {
     pub show_failure_messages: bool,
 }
 
+fn parse_sha(s: &str) -> anyhow::Result<String> {
+    if s.len() > 40 {
+        anyhow::bail!(anyhow::Error::msg(format!(
+            "Sha code must be at most 40 characters, was {}",
+            s.len()
+        )))
+    } else {
+        anyhow::Ok(s.into())
+    }
+}
+
 impl UploadArgs {
     pub fn new(
         token: String,