diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 60fa60e..babbcd5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,16 +1,14 @@
 version: 2
+# npm is intentionally omitted: this project uses bun (bun.lock), which
+# Dependabot doesn't keep in sync — its npm PRs break `bun install --frozen-lockfile`.
+# Update npm deps locally with `bun update` + `bun run typecheck && bun run test`.
 updates:
-  - package-ecosystem: npm
+  - package-ecosystem: github-actions
     directory: "/"
     schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
+      interval: monthly
   - package-ecosystem: cargo
     directory: "/src-tauri"
     schedule:
-      interval: weekly
-    open-pull-requests-limit: 5
-  - package-ecosystem: github-actions
-    directory: "/"
-    schedule:
-      interval: weekly
+      interval: monthly
+    open-pull-requests-limit: 3
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 81743f7..f2f34df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,38 +26,3 @@ jobs:
         run: bun run test
       - name: Build
         run: bun run build
-
-  rust:
-    name: Rust (check · clippy · fmt)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - name: Install Tauri system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y \
-            libwebkit2gtk-4.1-dev \
-            libappindicator3-dev \
-            librsvg2-dev \
-            patchelf \
-            libgtk-3-dev
-      - uses: oven-sh/setup-bun@v2
-        with:
-          bun-version: latest
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy, rustfmt
-      - uses: Swatinem/rust-cache@v2
-        with:
-          workspaces: src-tauri
-      # tauri-build (build.rs) reads the frontend dist, so produce it first.
-      - run: bun install --frozen-lockfile
-      - run: bun run build
-      - name: Format check
-        run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
-        continue-on-error: true
-      - name: Clippy
-        run: cargo clippy --manifest-path src-tauri/Cargo.toml --all-targets
-        continue-on-error: true
-      - name: Cargo check
-        run: cargo check --manifest-path src-tauri/Cargo.toml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0e0f492..bf00fbc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,7 +51,9 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           TAURI_SIGNING_PRIVATE_KEY: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY }}
-          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ${{ secrets.TAURI_SIGNING_PRIVATE_KEY_PASSWORD }}
+          # The updater signing key has no password, so pass an empty string.
+          # (It is not a secret, and GitHub won't store an empty-valued secret.)
+          TAURI_SIGNING_PRIVATE_KEY_PASSWORD: ""
         with:
           tagName: ${{ github.ref_name }}
           releaseName: "Notiq ${{ github.ref_name }}"
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
new file mode 100644
index 0000000..126f259
--- /dev/null
+++ b/.github/workflows/rust.yml
@@ -0,0 +1,51 @@
+name: Rust
+
+# Compiling the Tauri app is the heavy part of CI, so only run it when the
+# Rust backend (or this workflow) actually changes — not on frontend-only PRs.
+on:
+  push:
+    branches: [main]
+    paths:
+      - "src-tauri/**"
+      - ".github/workflows/rust.yml"
+  pull_request:
+    paths:
+      - "src-tauri/**"
+      - ".github/workflows/rust.yml"
+
+concurrency:
+  group: rust-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    name: Rust (fmt · check · test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Tauri system dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            patchelf \
+            libgtk-3-dev
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: latest
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt
+      - uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri
+      # generate_context! embeds the frontend dist, so build it first.
+      - run: bun install --frozen-lockfile
+      - run: bun run build
+      - name: Format check
+        run: cargo fmt --manifest-path src-tauri/Cargo.toml --check
+        continue-on-error: true
+      - name: Cargo check + unit tests
+        run: cargo test --manifest-path src-tauri/Cargo.toml --lib