diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a891cb2..52e125e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,11 +1,5 @@
 name: CI
 
-# The pull-request loop stays cheap: Lint, Test on Linux, and MSRV. The
-# platform-specific and packaging checks are slower or billed at a premium and
-# their failure modes do not depend on a given PR's diff, so they run once on
-# merge instead of on every push. Advisories are time-dependent rather than
-# code-dependent and live in advisories.yml on a schedule.
-
 on:
   pull_request:
   push:
@@ -48,19 +42,12 @@ jobs:
       # advisories.yml.)
       - uses: EmbarkStudios/cargo-deny-action@v2
         with:
-          command: check
+          command: check licenses bans sources
 
   test:
-    name: Test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
+    name: Test
+    runs-on: ubuntu-latest
     timeout-minutes: 35
-    strategy:
-      fail-fast: false
-      matrix:
-        # macOS runners bill at 10x Linux and every developer here builds on
-        # macOS continuously, so the second platform is worth one run per merge
-        # rather than one per push.
-        os: ${{ github.event_name == 'pull_request' && fromJSON('["ubuntu-latest"]') || fromJSON('["ubuntu-latest", "macos-latest"]') }}
     steps:
       - uses: actions/checkout@v4
       - uses: ./.github/actions/setup-rust
@@ -84,19 +71,3 @@ jobs:
         with:
           toolchain: "1.88.0"
       - run: cargo check --locked --all-targets
-
-  package:
-    name: Package
-    # Only the `include` list and the manifest can break this, and a failure on
-    # merge is still well before `cargo publish`.
-    if: github.event_name != 'pull_request'
-    runs-on: ubuntu-latest
-    timeout-minutes: 25
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.github/actions/setup-rust
-        with:
-          toolchain: stable
-      # Builds the crate as packaged, so an `include` list that drops a file the
-      # build needs fails here rather than after `cargo publish`.
-      - run: cargo package --locked
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1f7af0a..9f5c87a 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -67,16 +67,8 @@ Pull requests also run the declared MSRV:
 rustup run 1.88.0 cargo check --locked --all-targets
 ```
 
-Two more checks run on merge to `main` rather than on every push — macOS (its
-runners bill at a premium, and local development already covers the platform)
-and the published package:
-
-```bash
-cargo package --locked
-```
-
-If you change the `include` list in `Cargo.toml`, run that one yourself; it is
-what catches an `include` list that drops a file the build needs.
+If you change the `include` list in `Cargo.toml`, run `cargo package --locked`
+locally; it is what catches an `include` list that drops a file the build needs.
 
 A scheduled workflow re-runs `cargo deny check` weekly against `main`. Security
 advisories are published against dependency versions rather than commits, so
diff --git a/Cargo.lock b/Cargo.lock
index 0b2abcc..cb5bd65 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1189,9 +1189,9 @@ dependencies = [
 
 [[package]]
 name = "h2"
-version = "0.4.15"
+version = "0.4.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
+checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27"
 dependencies = [
  "atomic-waker",
  "bytes",