diff --git a/.github/workflows/verify-release-notes.yml b/.github/workflows/verify-release-notes.yml
index 33973a75..eca68626 100644
--- a/.github/workflows/verify-release-notes.yml
+++ b/.github/workflows/verify-release-notes.yml
@@ -13,9 +13,11 @@ name: Verify Release Notes
 #
 # `edited` re-runs the check when the description changes and `labeled` and
 # `unlabeled` when the release label does. There is no branch or label filter: the
-# gate itself only checks pull requests into the default branch that carry exactly
-# one of major, minor or patch, and passes the rest (no release label yet,
-# no-release, Dependabot) with a notice.
+# gate itself checks pull requests into the default branch: a description that breaks
+# the release-note contract fails when the pull request carries major, minor or patch
+# and is reported as a warning when it is labelled no-release or not labelled yet.
+# Dependabot's pass with a notice. `pull-requests: read` lets it read the pull
+# request as it is now, so a re-run sees the current labels and description.
 #
 # The job is named release-notes so the check reads `release-notes / verify` and
 # does not collide with other `verify / verify` gates.
@@ -32,6 +34,7 @@ on:
 
 permissions:
   contents: read
+  pull-requests: read
 
 jobs:
   release-notes:
diff --git a/.github/workflows/verify-semver-label.yml b/.github/workflows/verify-semver-label.yml
new file mode 100644
index 00000000..c8c8625b
--- /dev/null
+++ b/.github/workflows/verify-semver-label.yml
@@ -0,0 +1,32 @@
+# Copyright (c) Cratis. All rights reserved.
+# Licensed under the MIT license. See LICENSE file in the project root for full license information.
+name: Verify Semver Label
+
+# Installed through a reviewed change: the organization bootstrap ignores this repository.
+# Correct Dependabot's dependency-version labels before reading the live release intent.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+on:
+  pull_request:
+    types: [opened, reopened, synchronize, labeled, unlabeled]
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  dependabot-labels:
+    if: github.event.pull_request.user.login == 'dependabot[bot]'
+    uses: Cratis/Workflows/.github/workflows/normalize-dependabot-labels.yml@main
+    permissions:
+      pull-requests: write
+
+  release-intent:
+    needs: dependabot-labels
+    if: ${{ !cancelled() }}
+    uses: Cratis/Workflows/.github/workflows/verify-release-intent.yml@main
+    permissions:
+      contents: read
+      pull-requests: read