diff --git a/.commitlintrc.yml b/.commitlintrc.yml
new file mode 100644
index 0000000..8bc6ddb
--- /dev/null
+++ b/.commitlintrc.yml
@@ -0,0 +1,5 @@
+extends:
+  - '@commitlint/config-conventional'
+
+rules:
+  header-max-length: [0, 'always', 100]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9fae944..789c678 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,45 +14,6 @@ permissions:
   contents: read
 
 jobs:
-  commitlint:
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Enforce single-commit PRs
-        if: github.event_name == 'pull_request'
-        env:
-          PR_COMMIT_COUNT: ${{ github.event.pull_request.commits }}
-        run: |
-          test "$PR_COMMIT_COUNT" -eq 1
-
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
-
-      - name: Set up Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: "20"
-
-      - name: Validate PR title
-        if: github.event_name == 'pull_request'
-        env:
-          PR_TITLE: ${{ github.event.pull_request.title }}
-        run: |
-          printf '%s\n' "$PR_TITLE" |
-          npx --yes \
-            --package=@commitlint/cli@21.0.2 \
-            --package=@commitlint/config-conventional@21.0.2 \
-            commitlint --verbose --extends @commitlint/config-conventional
-
-      - name: Validate last commit
-        run: |
-          npx --yes \
-            --package=@commitlint/cli@21.0.2 \
-            --package=@commitlint/config-conventional@21.0.2 \
-            commitlint --last --verbose --extends @commitlint/config-conventional
-
   test:
     runs-on: ubuntu-latest
 
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
new file mode 100644
index 0000000..20a1020
--- /dev/null
+++ b/.github/workflows/commitlint.yml
@@ -0,0 +1,53 @@
+name: Commit checks
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+concurrency:
+  group: commitlint-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  commitlint:
+    if: >-
+      (github.event_name == 'pull_request' && github.event.pull_request.user.login != 'dependabot[bot]')
+      || (github.event_name == 'push' && github.event.head_commit.author.name != 'dependabot[bot]')
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Enforce single-commit PRs
+        if: github.event_name == 'pull_request'
+        env:
+          PR_COMMIT_COUNT: ${{ github.event.pull_request.commits }}
+        run: |
+          test "$PR_COMMIT_COUNT" -eq 1
+
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+
+      - name: Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+
+      - name: Install commitlint
+        run: npm install -D @commitlint/cli @commitlint/config-conventional
+
+      - name: Validate PR title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          printf '%s\n' "$PR_TITLE" | npx commitlint --verbose
+
+      - name: Validate last commit
+        run: |
+          npx commitlint --last --verbose
diff --git a/README.md b/README.md
index 43fd082..d627f62 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 <p align="center">
   <img alt="version 0.1.0" src="https://img.shields.io/badge/version-0.1.0-2f6f5e?style=flat-square">
   <img alt="license Apache-2.0" src="https://img.shields.io/badge/license-Apache--2.0-4a5568?style=flat-square">
-  <img alt="node &gt;=20" src="https://img.shields.io/badge/node-%3E%3D20-339933?style=flat-square&amp;logo=node.js&amp;logoColor=white">
+  <img alt="node &gt;=22" src="https://img.shields.io/badge/node-%3E%3D22-339933?style=flat-square&amp;logo=node.js&amp;logoColor=white">
   <img alt="python &gt;=3.11" src="https://img.shields.io/badge/python-%3E%3D3.11-3776AB?style=flat-square&amp;logo=python&amp;logoColor=white">
 </p>
 
@@ -200,7 +200,7 @@ controllers start as TODO adapters.
 ## Requirements
 
 - Python 3.11+
-- Node.js 20+
+- Node.js 22+
 - An OpenAPI 3.0 or 3.1 YAML/JSON contract
 - One of npm, pnpm, Yarn, or Bun for the generated package