diff --git a/.github/check-version.sh b/.github/check-version.sh
index d5bc84c..b3f18d4 100755
--- a/.github/check-version.sh
+++ b/.github/check-version.sh
@@ -10,14 +10,16 @@
 # and the CI workflow .github/workflows/ci.yml count as code or build (a new
 # version is also what publishes a release, #32); the script cannot tell the
 # build steps of the workflow from its tests and publication, so all of it
-# counts (#42).  Docs, tests/ and the rest of .github/ need no new version.
+# counts (#42).  Docs, tests/ and the rest of .github/ (version.yml, which
+# runs this check, included) need no new version.
 # NO_RELEASE=true (the pull request's `no-release` label) lets a change to
 # the code or the build through without a new version, for changes that
 # leave the binaries as they are (a build-script tidy-up, a comment, a
 # workflow edit to the tests or the publication).
 #
-# Usage: .github/check-version.sh [BASE]   (default origin/master; CI passes
-# HEAD^1, the base side of the pull request's merge commit)
+# Usage: .github/check-version.sh [BASE]   (default origin/master; the
+# version.yml workflow passes HEAD^1, the base side of the pull request's
+# merge commit, and NO_RELEASE from the label)
 #
 
 set -eu
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2069f5b..fedd409 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,8 +4,6 @@ on:
   push:
     branches: [master]
   pull_request:
-    # labeled / unlabeled: the version check reads the no-release label
-    types: [opened, synchronize, reopened, labeled, unlabeled]
   workflow_dispatch:
 
 permissions:
@@ -19,22 +17,8 @@ concurrency:
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
 jobs:
-  # Pull requests: a change to src/, the installers, the Makefile, ci/ or this workflow (#42)
-  # comes with a new CERBERUS_VERSION (MAJOR.MINOR.PATCH) and its CHANGELOG.md section (#33), or
-  # with the no-release label when the binaries stay as they are (#39). The checkout is the
-  # merge commit; its first parent is the base it was made from.
-  version:
-    name: version bump
-    if: github.event_name == 'pull_request'
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - run: .github/check-version.sh HEAD^1
-        env:
-          # a change that leaves the binaries as they are may skip the new version
-          NO_RELEASE: ${{ contains(github.event.pull_request.labels.*.name, 'no-release') }}
+  # The version check of pull requests (a new CERBERUS_VERSION, or the no-release label) is
+  # .github/workflows/version.yml (#44): a label change re-runs that check, not this workflow.
 
   lint:
     name: shellcheck
diff --git a/.github/workflows/version.yml b/.github/workflows/version.yml
new file mode 100644
index 0000000..84116f5
--- /dev/null
+++ b/.github/workflows/version.yml
@@ -0,0 +1,35 @@
+# version.yml — the version check of pull requests (#33, #39, #42, #44)
+#
+# A change to src/, the installers, the Makefile, ci/ or the CI workflow ci.yml comes with a new
+# CERBERUS_VERSION (MAJOR.MINOR.PATCH) and its CHANGELOG.md section, unless the no-release label
+# says the binaries stay as they are. A workflow of its own: adding or removing a label re-runs
+# this check, not the whole CI.
+
+name: version
+
+on:
+  pull_request:
+    # labeled / unlabeled: the check reads the no-release label
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+
+permissions:
+  contents: read
+
+# a newer event of the same pull request cancels the older check
+concurrency:
+  group: version-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  version:
+    name: version bump
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # The checkout is the merge commit; its first parent is the base it was made from.
+      - run: .github/check-version.sh HEAD^1
+        env:
+          # a change that leaves the binaries as they are may skip the new version
+          NO_RELEASE: ${{ contains(github.event.pull_request.labels.*.name, 'no-release') }}
diff --git a/README.md b/README.md
index c978477..09b0583 100644
--- a/README.md
+++ b/README.md
@@ -323,7 +323,8 @@ small changes, MINOR for a new feature, MAJOR for an incompatible change or a la
 when the maintainer decides. A pull request that changes `src/`, the installers, the `Makefile`,
 `ci/` or the CI workflow `.github/workflows/ci.yml` raises the version as its last commit before
 the merge, together with its `CHANGELOG.md` section; docs, tests and the rest of `.github/` do not.
-CI checks this on every pull request (`.github/check-version.sh`).
+A workflow of its own, `.github/workflows/version.yml`, checks this on every pull request
+(`.github/check-version.sh`); adding or removing a label re-runs only that check.
 
 A change to the code or the build that leaves the binaries as they are (a build-script
 tidy-up, a comment, a workflow edit to the tests or the publication) can carry the `no-release`
diff --git a/README.ru.md b/README.ru.md
index dd29e5e..5d0fe3e 100644
--- a/README.ru.md
+++ b/README.ru.md
@@ -320,8 +320,9 @@ kernel-WireGuard туннель до хаба в отдельном network name
 правки, MINOR — новая возможность, MAJOR — несовместимое изменение или крупное обновление, только по
 решению сопровождающего. PR, который меняет `src/`, установщики, `Makefile`, `ci/` или workflow CI
 `.github/workflows/ci.yml`, поднимает версию последним коммитом перед мержем вместе с её разделом в
-`CHANGELOG.md`; правки документации, тестов и остального в `.github/` версию не поднимают. CI
-проверяет это в каждом PR (`.github/check-version.sh`).
+`CHANGELOG.md`; правки документации, тестов и остального в `.github/` версию не поднимают. Это
+проверяет в каждом PR отдельный workflow `.github/workflows/version.yml` (`.github/check-version.sh`);
+смена метки перезапускает только эту проверку.
 
 Правка кода или сборки, после которой бинари не меняются (чистка сборочного скрипта,
 комментарий, правка тестов или публикации в workflow), может вместо этого нести метку
diff --git a/README.zh-CN.md b/README.zh-CN.md
index c4e33f9..0caa2be 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -268,8 +268,8 @@ CERBERUS_TEST_IMAGE=debian:bookworm-slim tests/run.sh      # glibc + mbedTLS 2.2
 版本号格式为 `MAJOR.MINOR.PATCH`（`src/cerberus.c` 中的 `CERBERUS_VERSION`）：PATCH 表示修复和小改动，MINOR
 表示新功能，MAJOR 表示不兼容的变更或大规模更新，仅由维护者决定。修改 `src/`、安装脚本、`Makefile`、`ci/`
 或 CI 工作流 `.github/workflows/ci.yml` 的 PR 需要在合并前的最后一个提交中提升版本号，并在 `CHANGELOG.md`
-中添加对应章节；仅修改文档、测试或 `.github/` 中其他文件的 PR 不提升版本号。CI 会在每个 PR 中检查这一点
-（`.github/check-version.sh`）。
+中添加对应章节；仅修改文档、测试或 `.github/` 中其他文件的 PR 不提升版本号。独立的工作流 `.github/workflows/version.yml` 会在每个 PR 中检查这一点
+（`.github/check-version.sh`）；添加或移除标签只会重新运行这项检查。
 
 不改变二进制文件的代码或构建修改（整理构建脚本、注释、工作流中测试或发布部分的修改）可以改用 `no-release`
 标签：不提升版本号，也不发布。