diff --git a/tests/federation/test_federation_server.py b/tests/federation/test_federation_server.py
index c4491d5b3c..63b05180f9 100644
--- a/tests/federation/test_federation_server.py
+++ b/tests/federation/test_federation_server.py
@@ -324,6 +324,127 @@ class StateQueryTests(unittest.FederatingHomeserverTestCase):
         self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
 
 
+class UnstableGetExtremitiesTests(unittest.FederatingHomeserverTestCase):
+    servlets = [
+        admin.register_servlets,
+        room.register_servlets,
+        login.register_servlets,
+    ]
+
+    def prepare(self, reactor: MemoryReactor, clock: Clock, hs: HomeServer) -> None:
+        super().prepare(reactor, clock, hs)
+        self._storage_controllers = hs.get_storage_controllers()
+
+    def _make_endpoint_path(self, room_id: str) -> str:
+        return f"/_matrix/federation/unstable/org.matrix.msc4370/extremities/{room_id}"
+
+    def _remote_join(self, room_id: str, room_version: str) -> None:
+        # Note: other tests ensure the called endpoints in this function return useful
+        # and proper data.
+
+        # make_join first
+        joining_user = "@misspiggy:" + self.OTHER_SERVER_NAME
+        channel = self.make_signed_federation_request(
+            "GET",
+            f"/_matrix/federation/v1/make_join/{room_id}/{joining_user}?ver={room_version}",
+        )
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        join_result = channel.json_body
+
+        # Sign/populate the join
+        join_event_dict = join_result["event"]
+        self.add_hashes_and_signatures_from_other_server(
+            join_event_dict,
+            KNOWN_ROOM_VERSIONS[room_version],
+        )
+        if room_version in ["1", "2"]:
+            add_hashes_and_signatures(
+                KNOWN_ROOM_VERSIONS[room_version],
+                join_event_dict,
+                signature_name=self.hs.hostname,
+                signing_key=self.hs.signing_key,
+            )
+
+        # Send the join
+        channel = self.make_signed_federation_request(
+            "PUT",
+            f"/_matrix/federation/v2/send_join/{room_id}/x",
+            content=join_event_dict,
+        )
+
+        # Check that things went okay so the test doesn't become a total train wreck
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        r = self.get_success(self._storage_controllers.state.get_current_state(room_id))
+        self.assertEqual(r[("m.room.member", joining_user)].membership, "join")
+
+    def _test_get_extremities_common(self, room_version: str) -> None:
+        # Create a room to test with
+        creator_user_id = self.register_user("kermit", "test")
+        tok = self.login("kermit", "test")
+        room_id = self.helper.create_room_as(
+            room_creator=creator_user_id,
+            tok=tok,
+            room_version=room_version,
+            extra_content={
+                # Public preset uses `shared` history visibility, but makes joins
+                # easier in our tests.
+                # https://spec.matrix.org/v1.16/client-server-api/#post_matrixclientv3createroom
+                "preset": "public_chat"
+            },
+        )
+
+        # At this stage we should fail to get the extremities because we're not joined
+        # and therefore can't see the events (`shared` history visibility).
+        channel = self.make_signed_federation_request("GET", self._make_endpoint_path(room_id))
+        self.assertEqual(channel.code, HTTPStatus.FORBIDDEN, channel.json_body)
+        self.assertEqual(channel.json_body["error"], "Host not in room.")
+        self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
+
+        # Now join the room and try again
+        # Note: we're expecting a linear room DAG, so there should be just one extremity
+        self._remote_join(room_id, room_version)
+        channel = self.make_signed_federation_request("GET", self._make_endpoint_path(room_id))
+        self.assertEqual(channel.code, HTTPStatus.OK, channel.json_body)
+        self.assertEqual(channel.json_body["extremities"], [self.get_success(self._storage_controllers.main.get_forward_extremities_for_room(room_id))[0][0]])
+
+        # ACL the calling server and try again. This should cause an error getting extremities.
+        self.helper.send_state(
+            room_id,
+            "m.room.server_acl",
+            {
+                "allow": ["*"],
+                "allow_ip_literals": False,
+                "deny": [self.OTHER_SERVER_NAME],
+            },
+            tok=tok,
+            expect_code=HTTPStatus.OK,
+        )
+        channel = self.make_signed_federation_request("GET", self._make_endpoint_path(room_id))
+        self.assertEqual(channel.code, HTTPStatus.FORBIDDEN, channel.json_body)
+        self.assertEqual(channel.json_body["error"], "Server is banned from room")
+        self.assertEqual(channel.json_body["errcode"], "M_FORBIDDEN")
+
+    @parameterized.expand([(k,) for k in KNOWN_ROOM_VERSIONS.keys()])
+    @override_config({"use_frozen_dicts": True, "experimental_features": {"msc4370_enabled": True}})
+    def test_get_extremities_with_frozen_dicts(self, room_version: str) -> None:
+        """Test GET /extremities with USE_FROZEN_DICTS=True"""
+        self._test_get_extremities_common(room_version)
+
+    @parameterized.expand([(k,) for k in KNOWN_ROOM_VERSIONS.keys()])
+    @override_config({"use_frozen_dicts": False, "experimental_features": {"msc4370_enabled": True}})
+    def test_get_extremities_without_frozen_dicts(self, room_version: str) -> None:
+        """Test GET /extremities with USE_FROZEN_DICTS=True"""
+        self._test_get_extremities_common(room_version)
+
+    # note the lack of config-setting stuff on this test.
+    def test_get_extremities_unstable_not_enabled(self):
+        """Test that GET /extremities returns M_UNRECOGNIZED when MSC4370 is not enabled"""
+        # We shouldn't even have to create a room - the endpoint should just fail.
+        channel = self.make_signed_federation_request("GET", self._make_endpoint_path("!room:example.org"))
+        self.assertEqual(channel.code, HTTPStatus.NOT_FOUND, channel.json_body)
+        self.assertEqual(channel.json_body["errcode"], "M_UNRECOGNIZED")
+
+
 class SendJoinFederationTests(unittest.FederatingHomeserverTestCase):
     servlets = [
         admin.register_servlets,