diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
new file mode 100644
index 0000000..759b37b
--- /dev/null
+++ b/.github/workflows/pr-lint.yml
@@ -0,0 +1,17 @@
+name: PR Lint
+
+# Conventional Commits on the PR title and every commit on the branch.
+# release-please parses those commit types to decide the version bump and to
+# build the changelog - a non-conventional commit silently produces neither.
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint:
+    uses: OneLiteFeatherNET/workflows/.github/workflows/pr-lint.yml@v2.8.1
+    secrets: inherit
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 160df45..0ac2771 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -14,6 +14,11 @@ jobs:
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       version: ${{ steps.release.outputs.version }}
+      # Read by the SBOM job below. Declared here because a job output
+      # that is never declared expands to the empty string rather than
+      # failing: `gh release upload ""` would have gone wrong on a release
+      # nobody was watching.
+      tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
       - id: release
         uses: googleapis/release-please-action@v5
@@ -64,3 +69,31 @@ jobs:
       context: "."
       dockerfile: "console/Dockerfile"
     secrets: inherit
+
+  sbom:
+    name: Attach SBOM to release
+    needs: release-please
+    if: needs.release-please.outputs.release_created == 'true'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.release-please.outputs.tag_name }}
+
+      - name: Generate CycloneDX SBOM
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          scan-type: fs
+          scan-ref: .
+          format: cyclonedx
+          output: bom.json
+          exit-code: '0'
+
+      - name: Attach SBOM to the release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          TAG: ${{ needs.release-please.outputs.tag_name }}
+        run: gh release upload "$TAG" bom.json --clobber
diff --git a/commitlint.config.mjs b/commitlint.config.mjs
new file mode 100644
index 0000000..0616fb9
--- /dev/null
+++ b/commitlint.config.mjs
@@ -0,0 +1,3 @@
+export default {
+  extends: ['@commitlint/config-conventional'],
+};
diff --git a/release-please-config.json b/release-please-config.json
index 866b575..027e8af 100644
--- a/release-please-config.json
+++ b/release-please-config.json
@@ -9,8 +9,14 @@
       "package-name": "sturnus",
       "changelog-path": "CHANGELOG.md",
       "extra-files": [
-        { "type": "generic", "path": "pyproject.toml" },
-        { "type": "generic", "path": "charts/sturnus/Chart.yaml" },
+        {
+          "type": "generic",
+          "path": "pyproject.toml"
+        },
+        {
+          "type": "generic",
+          "path": "charts/sturnus/Chart.yaml"
+        },
         {
           "type": "toml",
           "path": "uv.lock",
@@ -18,5 +24,6 @@
         }
       ]
     }
-  }
+  },
+  "bootstrap-sha": "906c6d661be1e22435fc66c7baac92e13cddf535"
 }