diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0a79bac..90fb6ef 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -16,13 +16,170 @@ concurrency:
 
 env:
   CARGO_TERM_COLOR: always
-  TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5433/locks_test
 
 jobs:
-  checks:
-    name: Checks
+  style:
+    name: Style / Compose
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+        with:
+          fetch-depth: 0
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.89.0
+        with:
+          components: rustfmt
+
+      - name: Format
+        run: cargo fmt --check
+
+      - name: Compose bootstrap regression
+        run: ./scripts/test-compose-bootstrap.sh
+
+      - name: Whitespace check
+        env:
+          EVENT_NAME: ${{ github.event_name }}
+          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          PUSH_BEFORE_SHA: ${{ github.event.before }}
+        run: |
+          set -euo pipefail
+
+          check_current_commit() {
+            local fallback_base
+            fallback_base="$(
+              git rev-parse --verify "$GITHUB_SHA^" 2>/dev/null ||
+                git hash-object -t tree /dev/null
+            )"
+            git diff --check "$fallback_base..$GITHUB_SHA"
+          }
+
+          case "$EVENT_NAME" in
+            pull_request)
+              git diff --check "$PR_BASE_SHA...$PR_HEAD_SHA"
+              ;;
+            push)
+              zero_sha='0000000000000000000000000000000000000000'
+              if [[ -n "$PUSH_BEFORE_SHA" && "$PUSH_BEFORE_SHA" != "$zero_sha" ]]; then
+                if ! git cat-file -e "$PUSH_BEFORE_SHA^{commit}" 2>/dev/null; then
+                  if ! git fetch --no-tags --depth=1 origin "$PUSH_BEFORE_SHA"; then
+                    printf 'unable to fetch push base commit: %s\n' "$PUSH_BEFORE_SHA" >&2
+                    exit 1
+                  fi
+                fi
+                if ! git cat-file -e "$PUSH_BEFORE_SHA^{commit}" 2>/dev/null; then
+                  printf 'unable to fetch push base commit: %s\n' "$PUSH_BEFORE_SHA" >&2
+                  exit 1
+                fi
+                git diff --check "$PUSH_BEFORE_SHA..$GITHUB_SHA"
+              else
+                check_current_commit
+              fi
+              ;;
+            workflow_dispatch)
+              check_current_commit
+              ;;
+            *)
+              printf 'unsupported workflow event: %s\n' "$EVENT_NAME" >&2
+              exit 1
+              ;;
+          esac
+
+  clippy:
+    name: Clippy
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.89.0
+        with:
+          components: clippy
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Lint
+        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
+
+  rust-tests:
+    name: Rust tests
     runs-on: ubuntu-latest
-    timeout-minutes: 45
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.89.0
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install cargo-nextest
+        uses: taiki-e/install-action@nextest
+
+      - name: Unit and integration tests
+        run: |
+          cargo nextest run --workspace --exclude locks-e2e --exclude locks-service --exclude locks-sdk-wasm
+          cargo nextest run -p locks-service --lib -- --skip infrastructure::postgres
+          cargo nextest run -p locks-e2e --test creator_publishing_http
+          cargo nextest run -p locks-e2e --test retrieval_access_http
+          cargo nextest run -p locks-e2e --test production_creator_publishing_http
+          cargo nextest run -p locks-e2e --test production_creator_authority_acquisition
+          cargo nextest run -p locks-e2e --test legacy_connect_shell_http
+          cargo nextest run -p locks-e2e --test pubky_homeserver_repositories
+
+  js-wasm:
+    name: JS / WASM
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@1.89.0
+        with:
+          targets: wasm32-unknown-unknown
+
+      - name: Cache Cargo
+        uses: Swatinem/rust-cache@v2
+
+      - name: Install wasm-pack
+        uses: taiki-e/install-action@v2
+        with:
+          tool: wasm-pack@0.13.1
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v5
+        with:
+          node-version: '22'
+          cache: npm
+          cache-dependency-path: examples/js-sdk/package-lock.json
+
+      - name: Install JS example dependencies
+        run: npm --prefix examples/js-sdk ci
+
+      - name: JS/WASM SDK tests
+        run: npm --prefix locks-sdk/bindings/js run test
+
+  postgres:
+    name: PostgreSQL
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    env:
+      TEST_DATABASE_URL: postgres://postgres:postgres@localhost:5433/locks_test
 
     services:
       postgres:
@@ -43,16 +200,8 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v5
 
-      - name: Install system dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y --no-install-recommends pkg-config libssl-dev
-
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@1.89.0
-        with:
-          components: clippy,rustfmt
-          targets: wasm32-unknown-unknown
 
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2
@@ -60,14 +209,6 @@ jobs:
       - name: Install cargo-nextest
         uses: taiki-e/install-action@nextest
 
-      - name: Install wasm-pack
-        run: cargo install wasm-pack --version 0.13.1 --locked
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v5
-        with:
-          node-version: '22'
-
       - name: Wait for Postgres
         env:
           PGPASSWORD: postgres
@@ -81,38 +222,23 @@ jobs:
           echo "Postgres did not become ready" >&2
           exit 1
 
-      - name: Format
-        run: cargo fmt --check
-
-      - name: Compose bootstrap regression
-        run: ./scripts/test-compose-bootstrap.sh
-
-      - name: Lint
-        run: cargo clippy --workspace --all-targets --all-features -- -D warnings
-
-      - name: Unit tests
-        run: |
-          cargo nextest run --workspace --exclude locks-e2e --exclude locks-service --exclude locks-sdk-wasm
-          cargo nextest run -p locks-service --lib -- --skip infrastructure::postgres
-
-      - name: E2E tests
+      - name: PostgreSQL-backed tests
         run: |
-          cargo nextest run -p locks-e2e --test creator_publishing_http
-          cargo nextest run -p locks-e2e --test retrieval_access_http
-          cargo nextest run -p locks-e2e --test production_creator_publishing_http
-          cargo nextest run -p locks-e2e --test production_creator_authority_acquisition
-
-      - name: JS/WASM SDK tests
-        run: npm --prefix locks-sdk/bindings/js run test
+          cargo nextest run -p locks-service --lib infrastructure::postgres
+          cargo nextest run -p locks-e2e --test postgres_runtime
 
-      - name: Postgres-backed tests
-        run: cargo nextest run -p locks-service --lib infrastructure::postgres
+  checks:
+    name: Checks
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    needs: [style, clippy, rust-tests, js-wasm, postgres]
+    if: always()
 
-      - name: Additional integration tests
+    steps:
+      - name: Require successful lanes
         run: |
-          cargo nextest run -p locks-e2e --test legacy_connect_shell_http
-          cargo nextest run -p locks-e2e --test postgres_runtime
-          cargo nextest run -p locks-e2e --test pubky_homeserver_repositories
-
-      - name: Whitespace check
-        run: git diff --check
+          test "${{ needs.style.result }}" = "success"
+          test "${{ needs.clippy.result }}" = "success"
+          test "${{ needs['rust-tests'].result }}" = "success"
+          test "${{ needs['js-wasm'].result }}" = "success"
+          test "${{ needs.postgres.result }}" = "success"
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index cc1ee1d..8b4eef3 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -27,8 +27,33 @@ npm --prefix locks-sdk/bindings/js run test
 git diff --check
 ```
 
-PostgreSQL and E2E tests require `TEST_DATABASE_URL`; CI uses an ephemeral local
-PostgreSQL service. Do not claim the full suite passed when only a subset ran.
+CI runs five lanes in parallel:
+
+| Lane | Ownership |
+| --- | --- |
+| `Style / Compose` | Formatting, Compose bootstrap regression, and whitespace |
+| `Clippy` | Workspace lint across all targets and features |
+| `Rust tests` | Non-PostgreSQL Rust tests and fake/in-memory E2E tests |
+| `JS / WASM` | Native bindings, wasm target, generated package, demo, and example smokes |
+| `PostgreSQL` | PostgreSQL-backed service tests and runtime E2E |
+
+The `Checks` result aggregates all five lanes. The effective `master` ruleset currently
+requires one approving review but does not enforce status checks, so a failing `Checks`
+result does not by itself block a merge. Maintainers should add `Checks` as a required
+status before treating it as a merge gate. `scripts/check` remains the sequential local
+umbrella.
+
+PostgreSQL-backed tests and `postgres_runtime` require `TEST_DATABASE_URL`; CI uses an
+ephemeral local PostgreSQL service. Do not claim the full suite passed when only a subset
+ran.
+
+`./scripts/check` preserves a caller-provided `TEST_DATABASE_URL`. When it is unset, the
+script runs the non-database checks and skips the full PostgreSQL-backed workspace run. To
+use the repository's default Compose database, run:
+
+```bash
+TEST_DATABASE_URL='postgres://locks:locks@localhost:55433/locks_test' ./scripts/check
+```
 
 ## Pull requests
 
diff --git a/docs/SDK.md b/docs/SDK.md
index dbadc74..559b283 100644
--- a/docs/SDK.md
+++ b/docs/SDK.md
@@ -424,7 +424,7 @@ cargo check -p locks-sdk-wasm --target wasm32-unknown-unknown
 Full workspace verification additionally requires the local Postgres test database:
 
 ```bash
-TEST_DATABASE_URL='postgres://postgres:postgres@localhost:5433/locks_test' cargo test --workspace
+TEST_DATABASE_URL='postgres://locks:locks@localhost:55433/locks_test' cargo test --workspace
 cargo clippy --workspace --all-targets --all-features -- -D warnings
 git diff --check
 ```
diff --git a/docs/SDK_RELEASE.md b/docs/SDK_RELEASE.md
index 22fe529..dba3cfa 100644
--- a/docs/SDK_RELEASE.md
+++ b/docs/SDK_RELEASE.md
@@ -61,7 +61,7 @@ npm --prefix locks-sdk/bindings/js publish --dry-run
 
 ```bash
 cargo fmt
-TEST_DATABASE_URL='postgres://postgres:postgres@localhost:5433/locks_test' cargo test --workspace
+TEST_DATABASE_URL='postgres://locks:locks@localhost:55433/locks_test' cargo test --workspace
 cargo clippy --workspace --all-targets --all-features -- -D warnings
 git diff --check
 ```
diff --git a/scripts/check b/scripts/check
index 8b63f43..1088749 100755
--- a/scripts/check
+++ b/scripts/check
@@ -1,8 +1,6 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-TEST_DATABASE_URL=postgres://postgres:postgres@localhost:5433/locks_test
-
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
 
@@ -25,7 +23,7 @@ run cargo nextest run -p locks-e2e --test production_creator_authority_acquisiti
 run npm --prefix locks-sdk/bindings/js run test
 
 if [[ -n "${TEST_DATABASE_URL:-}" ]]; then
-  run env TEST_DATABASE_URL="$TEST_DATABASE_URL" cargo nextest run --workspace
+  run cargo nextest run --workspace
 else
   printf '\n==> skipping Postgres-backed full workspace checks: TEST_DATABASE_URL is not set\n'
   printf '    Set TEST_DATABASE_URL=postgres://user:pass@host:port/db to include them.\n'