diff --git a/.github/actions/setup-nix-direnv-rust/action.yml b/.github/actions/setup-nix-direnv-rust/action.yml
index e2513613..89116419 100644
--- a/.github/actions/setup-nix-direnv-rust/action.yml
+++ b/.github/actions/setup-nix-direnv-rust/action.yml
@@ -3,14 +3,14 @@ description: Checks out the git repo and sets up Nix, Direnv and Rust, with appr
 runs:
   using: "composite"
   steps:
-    - uses: nixbuild/nix-quick-install-action@8505cd40ae3d4791ca658f2697c5767212e5ce71  # v30
-    - uses: nix-community/cache-nix-action@135667ec418502fa5a3598af6fb9eb733888ce6a  # v6
+    - uses: nixbuild/nix-quick-install-action@9f63be77f412a248c9d9a65a4c82cf066cdf8f0c  # Latest as of 2026-07-31
+    - uses: nix-community/cache-nix-action@7df957e333c1e5da7721f60227dbba6d06080569  # Latest as of 2026-07-31
       with:
           # restore and save a cache using this key
           primary-key: nix-${{ runner.os }}-${{ hashFiles('**/*.nix', 'nix/sources.json', 'rust-toolchain.toml') }}
           # if there's no cache hit, restore a cache by this prefix
           restore-prefixes-first-match: nix-${{ runner.os }}-
-    - uses: HatsuneMiku3939/direnv-action@89ed6f6786c25aa7a69cd12f9fd0fdcb46c7c489  # Latest as of 2025-05-16
-    - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6  # v2.7.8
+    - uses: HatsuneMiku3939/direnv-action@c81e6f10d47895cdd46432d8801bff0fabc73a6b  # Latest as of 2026-07-31
+    - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4  # Latest as of 2026-07-31
       with:
         cache-all-crates: "true"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ef0db1a1..76fa1122 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,26 +1,27 @@
 name: Continuous Integration
-on: [push]
+"on": [push]
 jobs:
   test-unit:
     name: Unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # Latest as of 2026-07-31
       - uses: ./.github/actions/setup-nix-direnv-rust
       - run: just test-unit
   test-integration:
     name: Integration test (& build all in dev-mode)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # Latest as of 2026-07-31
       - uses: ./.github/actions/setup-nix-direnv-rust
       - run: OPSQUEUE_PYTEST_TIMEOUT=600 just test-integration
   lint:
     name: Lint & Style Check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # Latest as of 2026-07-31
+        with:
+          fetch-tags: "true"
       - uses: ./.github/actions/setup-nix-direnv-rust
       - run: |
-          just lint-light --show-diff-on-failure --all
-          just lint-heavy
+          just lint
diff --git a/.semaphore/semaphore.yml b/.semaphore/semaphore.yml
index 435cd524..45713746 100644
--- a/.semaphore/semaphore.yml
+++ b/.semaphore/semaphore.yml
@@ -86,5 +86,4 @@ blocks:
       jobs:
         - name: "Type- and format-check"
           commands:
-            - "just lint-light --show-diff-on-failure --all"
-            - "just lint-heavy"
+            - "just lint"
diff --git a/default.nix b/default.nix
index ef1e7aed..69555da9 100644
--- a/default.nix
+++ b/default.nix
@@ -47,9 +47,10 @@ let
       # Rust build tools
       pkgs.cargo-audit
       pkgs.cargo-edit
-      pkgs.cargo-insta
       pkgs.cargo-hakari
+      pkgs.cargo-insta
       pkgs.cargo-nextest
+      pkgs.cargo-semver-checks
       pkgs.maturin
 
       # Resolve native sqlite from Nix for libsqlite3-sys
diff --git a/justfile b/justfile
index 9b9dd674..a3b312da 100644
--- a/justfile
+++ b/justfile
@@ -77,7 +77,7 @@ nix-test-integration *TEST_ARGS: nix-build
 
 # Run all linters, fast and slow
 [group('lint')]
-lint: (lint-light "--all-files") lint-heavy
+lint: (lint-light "--show-diff-on-failure" "--all-files") lint-heavy
 
 # Run only the fast per-file linters; these might opt to only look at the changed files. Args are passed to pre-commit
 [group('lint')]
@@ -87,16 +87,15 @@ lint-light *ARGS:
 # Run the slow linters/static analysers that need to look at everything
 [group('lint')]
 [parallel]
-lint-heavy: clippy-fix lint-cargo mypy
+lint-heavy: semver clippy-fix lint-cargo mypy
 
-# Serial execution on the main `CARGO_TARGET_DIR`
-[group('lint')]
-lint-cargo: clippy hakari
-
-# Verify the workspace-hack crate is up to date
+# Verify the semver bounds are respected since the last tagged build
 [group('lint')]
-hakari:
-  cargo hakari verify
+semver:
+  #!/usr/bin/env bash
+  set -euo pipefail
+  export DATABASE_URL="sqlite://{{justfile_directory()}}/opsqueue/opsqueue_example_database_schema.db"
+  cargo semver-checks --workspace --target x86_64-unknown-linux-gnu --baseline-rev "$(git tag -l --sort=-version:refname | head -1)"
 
 # Rust static analysis
 [group('lint')]
@@ -106,6 +105,15 @@ clippy-fix:
   CARGO_TARGET_DIR=target/clippy-fix cargo clippy --no-deps --all-targets --no-default-features --fix --allow-dirty --allow-staged -- -Dwarnings
   CARGO_TARGET_DIR=target/clippy-fix cargo clippy --no-deps --all-targets --all-features --fix --allow-dirty --allow-staged -- -Dwarnings
 
+# Serial execution on the main `CARGO_TARGET_DIR`
+[group('lint')]
+lint-cargo: clippy hakari
+
+# Verify the workspace-hack crate is up to date
+[group('lint')]
+hakari:
+  cargo hakari verify
+
 # Rust static analysis
 [group('lint')]
 clippy: