diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 4d81237..7beaa9f 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: "actions/checkout@v3"
       - uses: "authzed/actions/yaml-lint@main"
-      - uses: "bufbuild/buf-setup-action@v1.30.0"
+      - uses: "bufbuild/buf-setup-action@v1.32.2"
         with:
           version: "1.30.0"
       - uses: "bufbuild/buf-lint-action@v1"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7822722..14179e3 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: "ubuntu-latest"
     steps:
       - uses: "actions/checkout@v3"
-      - uses: "bufbuild/buf-setup-action@v1"
+      - uses: "bufbuild/buf-setup-action@v1.32.2"
         with:
           version: "1.30.0"
       - name: "push release name to BSR"
diff --git a/buf.lock b/buf.lock
index ee3653b..e098f10 100644
--- a/buf.lock
+++ b/buf.lock
@@ -1,15 +1,12 @@
 # Generated by buf. DO NOT EDIT.
-version: v1
+version: v2
 deps:
-  - remote: buf.build
-    owner: envoyproxy
-    repository: protoc-gen-validate
+  - name: buf.build/envoyproxy/protoc-gen-validate
     commit: 45685e052c7e406b9fbd441fc7a568a5
-  - remote: buf.build
-    owner: googleapis
-    repository: googleapis
+    digest: b5:63939effe0c64a94cd3151770b73007e43c9aeff31dcb24737fb11750dcaaca99338df3c1e5513828a685c743712e59ce283e046c27725e96928d200492bb6ec
+  - name: buf.build/googleapis/googleapis
     commit: 62f35d8aed1149c291d606d958a7ce32
-  - remote: buf.build
-    owner: grpc-ecosystem
-    repository: grpc-gateway
+    digest: b5:d66bf04adc77a0870bdc9328aaf887c7188a36fb02b83a480dc45ef9dc031b4d39fc6e9dc6435120ccf4fe5bfd5c6cb6592533c6c316595571f9a31420ab47fe
+  - name: buf.build/grpc-ecosystem/grpc-gateway
     commit: bc28b723cd774c32b6fbc77621518765
+    digest: b5:a613f827fa6ff35a4f5e87e80e35ac6b35e5792cc9c5a658351072777d88c6d4df785a0c14889090db11667cf5463d122c7193b3719c7861d3e5747c22ce1381
diff --git a/buf.yaml b/buf.yaml
index b50e11a..a2328d9 100644
--- a/buf.yaml
+++ b/buf.yaml
@@ -1,13 +1,16 @@
 ---
-version: "v1"
+version: "v2"
 name: "buf.build/authzed/api"
 deps:
   - "buf.build/envoyproxy/protoc-gen-validate"
   - "buf.build/googleapis/googleapis"
   - "buf.build/grpc-ecosystem/grpc-gateway"
 lint:
+  except:
+    - "PACKAGE_VERSION_SUFFIX"
   ignore:
-    - "authzed/api/v0"  # legacy from before we used buf
+    - "authzed/api/v0"
+  disallow_comment_ignores: true
 breaking:
   use:
     - "WIRE_JSON"