diff --git a/internal/db/sqltest/Makefile b/internal/db/sqltest/Makefile
index ea3099750..c5b526049 100644
--- a/internal/db/sqltest/Makefile
+++ b/internal/db/sqltest/Makefile
@@ -22,6 +22,7 @@ TESTS ?= tests/setup/*.sql \
 		 tests/sentinel/*.sql \
 		 tests/credential/*/*.sql \
 		 tests/session/*.sql \
+		 tests/target/*.sql \
 		 tests/controller/*.sql
 
 POSTGRES_DOCKER_IMAGE_BASE ?= postgres
diff --git a/internal/db/sqltest/tests/target/target_host_set.sql b/internal/db/sqltest/tests/target/target_host_set.sql
new file mode 100644
index 000000000..0079814e1
--- /dev/null
+++ b/internal/db/sqltest/tests/target/target_host_set.sql
@@ -0,0 +1,40 @@
+begin;
+  select plan(4);
+  select wtt_load('widgets', 'iam', 'kms', 'auth', 'hosts', 'targets');
+
+  -- validate the setup data
+  select is(count(*), 1::bigint)
+    from host_set hs
+    join host_catalog hc on hs.catalog_id = hc.public_id
+   where hc.scope_id  = 'p____bwidget'
+     and hc.public_id = 'c___wb-plghcl'
+     and hs.public_id = 's___1wb-plghs';
+
+  select is(count(*), 1::bigint)
+    from host_set hs
+    join host_catalog hc on hs.catalog_id = hc.public_id
+   where hc.scope_id  = 'p____swidget'
+     and hc.public_id = 'c___ws-plghcl'
+     and hs.public_id = 's___1ws-plghs';
+
+  insert into target
+    (scope_id, public_id)
+  values
+    ('p____bwidget', 'test______wb');
+
+  prepare insert_valid_target_host_set as
+    insert into target_host_set
+      (target_id, host_set_id)
+    values
+      ('test______wb', 's___1wb-plghs');
+  select lives_ok('insert_valid_target_host_set', 'insert valid target_host_set failed');
+
+  prepare insert_invalid_target_host_set as
+    insert into target_host_set
+      (target_id, host_set_id)
+    values
+      ('test______wb', 's___1ws-plghs');
+  select throws_ok('insert_invalid_target_host_set', '23000', null, 'insert invalid target_host_set succeeded');
+
+  select * from finish();
+rollback;