diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 22c2be639d..87ae78e4e3 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -6,7 +6,6 @@ permissions:
 
 on:
   pull_request:
-    branches: ["main"]
 
 jobs:
   check:
@@ -29,3 +28,4 @@ jobs:
 
       # Run checks with cached dependencies
       - run: nix develop --command just ci
+
diff --git a/.github/workflows/semver.yml b/.github/workflows/semver.yml
new file mode 100644
index 0000000000..92657d40a5
--- /dev/null
+++ b/.github/workflows/semver.yml
@@ -0,0 +1,31 @@
+name: Semver
+
+permissions:
+  id-token: write
+  contents: read
+
+on:
+  pull_request:
+    branches: ["main"]
+
+jobs:
+  check:
+    name: Check
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - uses: DeterminateSystems/nix-installer-action@main
+      - uses: DeterminateSystems/magic-nix-cache-action@main
+      - uses: DeterminateSystems/flake-checker-action@main
+
+      # Cache Rust dependencies and build artifacts
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+        with:
+          cache-on-failure: true
+
+      # Run checks with cached dependencies
+      - run: nix develop --command just semver
diff --git a/CLAUDE.md b/CLAUDE.md
index 61fd6fd34f..0d17dd326e 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -90,6 +90,13 @@ Key architectural rule: The CDN/relay does not know anything about media. Anythi
 - Rust tests are integrated within source files
 - Async tests that sleep should call `tokio::time::pause()` at the start to simulate time instantly
 
+## Branching Strategy
+
+- **`main`**: Stable branch for patch releases. Only non-breaking fixes and additions.
+- **`dev`**: Development branch for breaking API changes. PRs with major API changes should target `dev`.
+- When ready for a new minor/major release, merge `dev` into `main`.
+- `cargo-semver-checks` enforces this on PRs to `main`.
+
 ## Workflow
 
 When making changes to the codebase:
diff --git a/flake.nix b/flake.nix
index e411d416d4..bb22ecac43 100644
--- a/flake.nix
+++ b/flake.nix
@@ -62,6 +62,7 @@
           cargo-edit
           cargo-hack
           cargo-sweep
+          cargo-semver-checks
         ];
 
         # JavaScript dependencies
diff --git a/justfile b/justfile
index 9cbe1528df..7b74fe4d51 100644
--- a/justfile
+++ b/justfile
@@ -11,7 +11,7 @@ default:
 # Install any dependencies.
 install:
 	bun install
-	cargo install --locked cargo-shear cargo-sort cargo-upgrades cargo-edit cargo-hack cargo-sweep
+	cargo install --locked cargo-shear cargo-sort cargo-upgrades cargo-edit cargo-hack cargo-sweep cargo-semver-checks release-plz
 
 # Alias for dev.
 all: dev
@@ -368,6 +368,16 @@ ci:
 	echo "Checking all feature combinations..."
 	cargo hack check --workspace --each-feature --no-dev-deps
 
+# Check semver compatibility against crates.io
+# requires: cargo install cargo-semver-checks
+# libmoq is an internal C-ABI crate and is intentionally excluded from published-crate semver checks.
+semver:
+	cargo semver-checks check-release --workspace --exclude libmoq
+
+# Update versions and changelogs via release-plz
+bump:
+	release-plz update
+
 # Run the unit tests
 test:
 	#!/usr/bin/env bash