diff --git a/.forgejo/workflows/setup-tools.sh b/.forgejo/workflows/setup-tools.sh
index dfcb6f8..3c71b7c 100755
--- a/.forgejo/workflows/setup-tools.sh
+++ b/.forgejo/workflows/setup-tools.sh
@@ -13,6 +13,8 @@ TAPLO_VERSION="0.10.0"
 TAPLO_SHA256SUM="8fe196b894ccf9072f98d4e1013a180306e17d244830b03986ee5e8eabeb6156"
 TYPOS_VERSION="1.47.2"
 TYPOS_SHA256SUM="7aef58932fc123b4cf4b40d86468e89a3297d80169051d7cfd13a235e05fc426"
+CARGO_DENY_VERSION="0.19.8"
+CARGO_DENY_SHA256SUM="70e769ae3872e34d45132b17040859175e11401dc12dddb0303e0b8c7d088f3f"
 
 TRIPLE="x86_64-unknown-linux-gnu"
 TRIPLE_MUSL="x86_64-unknown-linux-musl"
@@ -67,3 +69,7 @@ fetch tamasfe/taplo "$TAPLO_VERSION" \
 fetch crate-ci/typos "v$TYPOS_VERSION" \
     "typos-v$TYPOS_VERSION-$TRIPLE_MUSL.tar.gz" \
     "$TYPOS_SHA256SUM" typos
+
+fetch EmbarkStudios/cargo-deny "$CARGO_DENY_VERSION" \
+    cargo-deny-$CARGO_DENY_VERSION-$TRIPLE_MUSL.tar.gz \
+    "$CARGO_DENY_SHA256SUM" cargo-deny
diff --git a/.forgejo/workflows/verify.yaml b/.forgejo/workflows/verify.yaml
index 2d4e590..c37f8e7 100644
--- a/.forgejo/workflows/verify.yaml
+++ b/.forgejo/workflows/verify.yaml
@@ -9,6 +9,7 @@ on:
       - .forgejo/**
       - Cargo.toml
       - Cargo.lock
+
 jobs:
   verify:
     runs-on: docker
@@ -39,9 +40,12 @@ jobs:
           useradd -m ci && chown -R ci:ci .
           git config --global --add safe.directory "$PWD"
 
-      - name: Build
-        run: just ci build
-
+      - name: Text matching checks
+        run: just ci todos-assess version-assess spell
+      - name: Schema lint
+        run: just ci schema-lint
+      - name: Deny
+        run: just ci deny
       - name: Format
         run: just ci format-assess
       - name: Lint
diff --git a/.justfile b/.justfile
index 9ae185c..9c7d7d3 100644
--- a/.justfile
+++ b/.justfile
@@ -51,7 +51,7 @@ alias wc := run-watch-containerized
 
 [private]
 assess-quick:
-    {{ just_cmd }} lint check test-cover-quick spell
+    {{ just_cmd }} lint check test-cover-quick spell schema-lint
 
 [private]
 assess-run-quick:
@@ -219,8 +219,8 @@ mutate-single *cargo_test_args:
 # Tag HEAD with version from Cargo.toml
 [script, group: 'assess']
 tag commit="HEAD": update
-    if [ "{{ last_tag }}" = "{{ manifest_version }}" ]; then
-        echo "Last tag {{ last_tag }} and manifest ({{ manifest_version }}) already match"
+    if [ "{{ last_local_tag }}" = "{{ manifest_version }}" ]; then
+        echo "Last tag {{ last_local_tag }} and manifest ({{ manifest_version }}) already match"
         exit
     elif [ "{{ manifest_version }}" != "{{ lockfile_version }}" ]; then
         echo "Manifest and lockfile versions don't match: update failed?"
@@ -231,15 +231,15 @@ tag commit="HEAD": update
     {{ just_cmd }} version-assess
 
 # Verify and push
-[group: 'develop']
-push: verify
+[group: 'develop', env("JUST", "1")]
+push: verify && (version-assess "true")
     git push
     git push --tags
 
 alias p := push
 
 # Push without verifying
-[group: 'develop']
+[group: 'develop', env("JUST", "1")]
 push-unsafe:
     git push --no-verify
     git push --tags --no-verify
@@ -355,16 +355,21 @@ alias v := verify
 
 # Check tag-manifest consistency
 [script, group: 'assess']
-version-assess: update
-    if
-        [ "{{ last_tag }}" != "{{ lockfile_version }}" ] \
-        || [ "{{ last_tag }}" != "{{ lockfile_version }}" ]
-    then
-        printf 'Last tag: %s\nManifest: %s\nLockfile: %s\n' \
-            "{{ last_tag }}" \
-            "{{ manifest_version }}" \
-            "{{ lockfile_version }}"
-        exit 1
+[arg("remote", long="remote", short="r", value="true")]
+version-assess remote="false": update
+    last_remote_tag=$(
+        git ls-remote --tags --sort=-creatordate origin |
+            head -n 1 | tr -d v | cut -d / -f 3
+    )
+    printf 'Local: %s\nRemote: %s\nManifest: %s\nLockfile: %s\n' \
+        "{{ last_local_tag }}" \
+        "$last_remote_tag" \
+        "{{ manifest_version }}" \
+        "{{ lockfile_version }}"
+    test "{{ last_local_tag }}" = "{{ lockfile_version }}"
+    test "{{ last_local_tag }}" = "{{ manifest_version }}"
+    if {{ if remote == "true" { "true" } else { "false" } }}; then
+        test "{{ last_local_tag }}" = "$last_remote_tag"
     fi
 
 alias va := version-assess
@@ -379,7 +384,7 @@ alias ta := todos-assess
 # Check for security advisories, unexpected licenses, allowed registries
 [group: 'assess']
 deny:
-    cargo deny check
+    cargo-deny check
 
 # Check for spelling mistakes
 [group: 'assess']
@@ -463,7 +468,7 @@ choose:
 
 alias ch := choose
 
-[script, private]
+[script, private, env("CARGO_HOME", "$HOME/.cargo")]
 ci recipe:
     su ci -c "just {{ recipe }}"
 
@@ -481,7 +486,7 @@ just_cmd_no_ts := 'just --explain --command-color green'
 watch_cmd := "watchexec -qc -r -e rs,toml,html,css --color always -- "
 cover_cmd := 'cargo llvm-cov --color always --ignore-filename-regex "main\.rs|log\.rs"'
 
-last_tag := `git tag --sort=-creatordate | head -1 | tr -d v`
+last_local_tag := `git tag --sort=-creatordate | head -n 1 | tr -d v`
 manifest_version := `grep "^version" Cargo.toml | cut -d \" -f 2`
 lockfile_version := ```
     grep -A 1 'name = "en"' Cargo.lock \
diff --git a/Cargo.lock b/Cargo.lock
index daa0607..d0133a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -238,7 +238,7 @@ dependencies = [
 
 [[package]]
 name = "en"
-version = "0.4.1-alpha"
+version = "0.4.0-alpha"
 dependencies = [
  "axum",
  "serde",
diff --git a/Cargo.toml b/Cargo.toml
index a3b9a52..5c79e7d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "en"
-version = "0.4.1-alpha"
+version = "0.4.0-alpha"
 description = "A non-linear writing instrument."
 license = "AGPL-3.0-only"