diff --git a/.config/behavior-taxonomy.cdxlintrc.json b/.config/behavior-taxonomy.cdxlintrc.json
new file mode 100644
index 00000000..067ccaec
--- /dev/null
+++ b/.config/behavior-taxonomy.cdxlintrc.json
@@ -0,0 +1,25 @@
+{
+  "$comment": "This ia a cdxlinter config for file `../schema/behavior-taxonomy.schema.json`",
+  "checks": {
+    "formatting-indent": {
+      "spaces": 2
+    },
+    "schema-draft": {
+      "requiredSchema": "https://json-schema.org/draft/2020-12/schema"
+    },
+    "schema-id-filepath": {
+      "pattern": "^https://cyclonedx\\.org(/schema/[^/]+\\.schema\\.json)$"
+    },
+    "schema-id-pattern": {
+      "pattern": "^https://cyclonedx\\.org/schema/[^/]+\\.schema\\.json$"
+    }
+  },
+  "excludeChecks": [
+    "cdx2-reftype-usage",
+    "description-oxford-english",
+    "enum-value-formatting",
+    "model-structure",
+    "model-property-order",
+    "property-name-american-english"
+  ]
+}
diff --git a/.config/cryptography-defs.cdxlintrc.json b/.config/cryptography-defs.cdxlintrc.json
new file mode 100644
index 00000000..db44b6fe
--- /dev/null
+++ b/.config/cryptography-defs.cdxlintrc.json
@@ -0,0 +1,32 @@
+{
+  "$comment": "This ia a cdxlinter config for file `../schema/cryptography-defs.schema.json`",
+  "checks": {
+    "formatting-indent": {
+      "spaces": 2
+    },
+    "property-name-american-english": {
+      "customTerms": ["enum"]
+    },
+    "schema-comment": {
+      "requiredCommentPattern": "^\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}Z$"
+    },
+    "schema-draft": {
+      "requiredSchema": "http://json-schema.org/draft-07/schema#"
+    },
+    "schema-id-filepath": {
+      "pattern": "^http://cyclonedx\\.org(/schema/[^/]+\\.schema\\.json)$"
+    },
+    "schema-id-pattern": {
+      "pattern": "^http://cyclonedx\\.org/schema/[^/]+\\.schema\\.json$"
+    }
+  },
+  "excludeChecks": [
+    "cdx2-reftype-usage",
+    "description-oxford-english",
+    "duplicate-content",
+    "enum-value-formatting",
+    "enum-value-no-other",
+    "model-structure",
+    "model-property-order"
+  ]
+}
diff --git a/.config/jsf-0.82.cdxlintrc.json b/.config/jsf-0.82.cdxlintrc.json
new file mode 100644
index 00000000..f1a2b954
--- /dev/null
+++ b/.config/jsf-0.82.cdxlintrc.json
@@ -0,0 +1,31 @@
+{
+  "$comment": "This ia a cdxlinter config for file `../schema/jsf-0.82.schema.json`",
+  "checks": {
+    "formatting-indent": {
+      "spaces": 2
+    },
+    "property-name-american-english": {
+      "customTerms": ["crv", "kty"]
+    },
+    "schema-comment": {
+      "requiredCommentPattern": "JSON Signature Format schema is published under the terms of the Apache License 2\\.0\\."
+    },
+    "schema-draft": {
+      "requiredSchema": "http://json-schema.org/draft-07/schema#"
+    },
+    "schema-id-filepath": {
+      "pattern": "^http://cyclonedx\\.org(/schema/[^/]+\\.schema\\.json)$"
+    },
+    "schema-id-pattern": {
+      "pattern": "^http://cyclonedx\\.org/schema/[^/]+\\.schema\\.json$"
+    }
+  },
+  "excludeChecks": [
+    "cdx2-reftype-usage",
+    "description-oxford-english",
+    "duplicate-content",
+    "model-structure",
+    "model-property-order",
+    "no-must-word"
+  ]
+}
diff --git a/.config/spdx.cdxlintrc.json b/.config/spdx.cdxlintrc.json
new file mode 100644
index 00000000..a3a75df4
--- /dev/null
+++ b/.config/spdx.cdxlintrc.json
@@ -0,0 +1,32 @@
+{
+  "$comment": "This ia a cdxlinter config for file `../schema/spdx.schema.json`",
+  "checks": {
+    "formatting-indent": {
+      "spaces": 2
+    },
+    "schema-comment": {
+      "requiredCommentPattern": "^v(\\d+\\.\\d+)\\-(.+)$"
+    },
+    "schema-draft": {
+      "requiredSchema": "http://json-schema.org/draft-07/schema#"
+    },
+    "schema-id-filepath": {
+      "pattern": "^http://cyclonedx\\.org(/schema/[^/]+\\.schema\\.json)$"
+    },
+    "schema-id-pattern": {
+      "pattern": "^http://cyclonedx\\.org/schema/[^/]+\\.schema\\.json$"
+    }
+  },
+  "excludeChecks": [
+    "cdx2-reftype-usage",
+    "description-oxford-english",
+    "duplicate-content",
+    "enum-value-formatting",
+    "enum-value-no-other",
+    "meta-enum-full-stop",
+    "model-structure",
+    "model-property-order",
+    "no-must-word",
+    "property-name-american-english"
+  ]
+}
diff --git a/.github/workflows/lint_non-core_schemas.yml b/.github/workflows/lint_non-core_schemas.yml
new file mode 100644
index 00000000..e9e5693f
--- /dev/null
+++ b/.github/workflows/lint_non-core_schemas.yml
@@ -0,0 +1,75 @@
+name: CT Non-Core Schemas Lint
+
+on:
+  push:
+    branches: ['master', 'main']
+  pull_request:
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/controlling-permissions-for-github_token
+permissions: {}
+
+env:
+  NODE_VERSION: '24.x'
+
+jobs:
+  lint-externals:
+    timeout-minutes: 10
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        schema: # path relative to `schema` dir, without suffix `.schema.json`
+          - 'behavior-taxonomy'
+          - 'cryptography-defs'
+          - 'jsf-0.82'
+          - 'spdx'
+    name: lint ${{ matrix.schema }}
+    env:
+      SCHEMA_FILE: schema/${{ matrix.schema }}.schema.json
+      CONFIG_FILE: .config/${{ matrix.schema }}.cdxlintrc.json
+      REPORT_FILE: tools/src/main/js/linter/reports/${{ matrix.schema }}.json
+    steps:
+      - name: Checkout repository
+        # see https://github.com/actions/checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Setup Node.js
+        # see https://github.com/actions/setup-node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          package-manager-cache: false
+      - name: Install linter
+        working-directory: tools/src/main/js/linter
+        run: npm ci
+      - name: Lint schemas
+        run: |
+          set -eu
+          mkdir -p "$(dirname "$REPORT_FILE")"
+          # only run checks not carried over from source files
+          node tools/src/main/js/linter/cli.js \
+            --format json \
+            --config "$CONFIG_FILE" \
+            "$SCHEMA_FILE" \
+            > "$REPORT_FILE"
+      - name: Make report relative
+        if: ${{ !cancelled() }}
+        run: sed -i "s|${GITHUB_WORKSPACE}/||g" "$REPORT_FILE"
+      - name: Print report
+        if: '!cancelled()'
+        run: cat "$REPORT_FILE"
+      - name: Artifact report
+        if: ${{ !cancelled() }}
+        # https://github.com/actions/upload-artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: report_${{ matrix.schema }}
+          path: ${{ env.REPORT_FILE }}
+          if-no-files-found: error
+          retention-days: 1
diff --git a/schema/jsf-0.82.schema.json b/schema/jsf-0.82.schema.json
index f46bfb1e..3d866479 100644
--- a/schema/jsf-0.82.schema.json
+++ b/schema/jsf-0.82.schema.json
@@ -6,10 +6,10 @@
   "$comment" : "JSON Signature Format schema is published under the terms of the Apache License 2.0. JSF was developed by Anders Rundgren (anders.rundgren.net@gmail.com) as a part of the OpenKeyStore project. This schema supports the entirely of the JSF standard excluding 'extensions'.",
   "definitions": {
     "signature": {
-      "type": "object",
       "title": "Signature",
       "oneOf": [
         {
+          "type": "object",
           "additionalProperties": false,
           "properties": {
             "signers": {
@@ -21,6 +21,7 @@
           }
         },
         {
+          "type": "object",
           "additionalProperties": false,
           "properties": {
             "chain": {
@@ -124,6 +125,7 @@
     "publicKey": {
       "title": "Public key",
       "description": "Optional. Public key object.",
+      "$comment": "This is a mixin - additional properties may be allowed, see the constraints on `kty`.",
       "type": "object",
       "required": [
         "kty"