diff --git a/.github/workflows/portfolio-check.yml b/.github/workflows/portfolio-check.yml
new file mode 100644
index 0000000..0785c32
--- /dev/null
+++ b/.github/workflows/portfolio-check.yml
@@ -0,0 +1,26 @@
+# Portfolio check - calls the shared harness in Remade-With-Rust/.github.
+#
+# Managed by remade-updater. Edit the shared workflow, not this file: this exists
+# only so the run attaches to the pull request, where a merge can wait on it.
+
+name: portfolio-check
+
+on:
+  pull_request:
+  # Also on the base branch, so a red pull request can be compared against a
+  # real run of THIS check on main. Without it the only baseline available is
+  # "are main's own checks green", which answers a different question: this
+  # harness is stricter than most repositories' own CI, so a pre-existing
+  # failure it alone catches looks exactly like a regression.
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    uses: Remade-With-Rust/.github/.github/workflows/portfolio-test.yml@main
+    with:
+      command: test
diff --git a/crates/rusty_esp_alloc/Cargo.toml b/crates/rusty_esp_alloc/Cargo.toml
index 6c7dbcd..1f954aa 100644
--- a/crates/rusty_esp_alloc/Cargo.toml
+++ b/crates/rusty_esp_alloc/Cargo.toml
@@ -38,8 +38,8 @@ secure = ["rusty_alloc-api/secure", "rusty_alloc/secure"]
 # 2.0.1 is the floor for a firmware, not a preference; 2.0.5 is what we run. It is the release that
 # refuses a region too small to hold a segment and turns an allocating
 # interrupt into a panic instead of a silent hang; on 2.0.0 both are quiet.
-rusty_alloc-api = { version = "=2.0.5", default-features = false }
-rusty_alloc = { version = "=2.0.5", default-features = false }
+rusty_alloc-api = { version = "=2.2.0", default-features = false }
+rusty_alloc = { version = "=2.2.0", default-features = false }
 
 [lints]
 workspace = true