diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index d131826..b01b907 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -8,6 +8,7 @@ on:
 
 jobs:
   coverage:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index 78caed6..38c9852 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -28,12 +28,22 @@ jobs:
       - name: Check formatting
         run: cargo fmt -- --check
 
+      # The identity-only tag bootstraps the stable dependency graph. Other
+      # workspace members intentionally reference crates published later.
       - name: Run clippy
+        if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
         run: cargo clippy --workspace --all-targets --all-features -- -D warnings
 
       - name: Test workspace
+        if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
         run: cargo test --workspace --all-features --all-targets
 
+      - name: Check dhttp-identity
+        if: ${{ endsWith(github.head_ref, '-dhttp-identity') || endsWith(github.ref_name, '-dhttp-identity') }}
+        run: |
+          cargo clippy --package dhttp-identity --all-targets --all-features -- -D warnings
+          cargo test --package dhttp-identity --all-features --all-targets
+
       - name: Authenticate to crates.io
         if: github.ref_type == 'tag' && startsWith(github.ref_name, 'v')
         uses: rust-lang/crates-io-auth-action@v1
@@ -43,6 +53,7 @@ jobs:
         shell: bash
         env:
           CARGO_REGISTRY_TOKEN: ${{ steps.auth.outputs.token }}
+          IDENTITY_ONLY: ${{ endsWith(github.head_ref, '-dhttp-identity') || endsWith(github.ref_name, '-dhttp-identity') }}
         run: |
           set -euo pipefail
 
@@ -52,7 +63,7 @@ jobs:
             mode=dry-run
           fi
 
-          if [[ "${GITHUB_REF_TYPE}" == "tag" && "${GITHUB_REF_NAME}" == v*-dhttp-identity ]]; then
+          if [[ "${IDENTITY_ONLY}" == "true" ]]; then
             packages=(dhttp-identity)
           else
             packages=(
@@ -64,7 +75,7 @@ jobs:
             )
           fi
 
-          cargo metadata --format-version 1 > "$RUNNER_TEMP/workspace-metadata.json"
+          cargo metadata --no-deps --format-version 1 > "$RUNNER_TEMP/workspace-metadata.json"
           package_versions="$(
             PACKAGES="$(printf '%s\n' "${packages[@]}")" RUNNER_TEMP="$RUNNER_TEMP" python3 - <<'PY'
           import json
diff --git a/.github/workflows/publish-npm.yml b/.github/workflows/publish-npm.yml
index 5f03276..067c961 100644
--- a/.github/workflows/publish-npm.yml
+++ b/.github/workflows/publish-npm.yml
@@ -11,6 +11,7 @@ on:
 
 jobs:
   build:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
index c33cfb0..8466d3b 100644
--- a/.github/workflows/publish-pypi.yml
+++ b/.github/workflows/publish-pypi.yml
@@ -11,6 +11,7 @@ on:
 
 jobs:
   build:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 07f9a85..1a4a35d 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -11,6 +11,7 @@ env:
 
 jobs:
   build:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     strategy:
       matrix:
         target: [ubuntu, macos, windows]
@@ -28,6 +29,7 @@ jobs:
         run: cargo test --workspace --verbose -- --test-threads=1
 
   format:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -39,6 +41,7 @@ jobs:
       - name: Run rustfmt
         run: cargo +nightly fmt --all -- --check
   clippy:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -50,6 +53,7 @@ jobs:
       - name: Run clippy
         run: cargo +nightly clippy --all-targets --all-features -- -Dwarnings
   doc:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -61,6 +65,7 @@ jobs:
         run: RUSTDOCFLAGS="-D warnings" cargo +nightly doc --no-deps
 
   msrv:
+    if: ${{ !endsWith(github.head_ref, '-dhttp-identity') && !endsWith(github.ref_name, '-dhttp-identity') }}
     strategy:
       matrix:
         target: [ubuntu, macos, windows]
diff --git a/identity/Cargo.toml b/identity/Cargo.toml
index 0e8c190..fdea346 100644
--- a/identity/Cargo.toml
+++ b/identity/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "dhttp-identity"
 description = "Identity primitives for DHttp"
-version = "0.3.0-beta.2"
+version = "0.3.0"
 edition.workspace = true
 license.workspace = true
 repository.workspace = true
diff --git a/identity/src/certificate.rs b/identity/src/certificate.rs
index 3b380f9..1ce0a25 100644
--- a/identity/src/certificate.rs
+++ b/identity/src/certificate.rs
@@ -93,8 +93,8 @@ impl CertificateUsage {
 
     pub fn kind_flag(self) -> &'static str {
         match self {
-            Self::ClientOnly => "0",
-            Self::ClientAndServer => "1",
+            Self::ClientOnly => "1",
+            Self::ClientAndServer => "0",
         }
     }
 }
@@ -227,8 +227,8 @@ impl FromStr for DhttpSubjectKeyIdentifier {
         let sequence = CertificateSequence::try_from(sequence)
             .context(invalid_dhttp_subject_key_identifier::SequenceRangeSnafu)?;
         let usage = match usage {
-            "0" => CertificateUsage::ClientOnly,
-            "1" => CertificateUsage::ClientAndServer,
+            "0" => CertificateUsage::ClientAndServer,
+            "1" => CertificateUsage::ClientOnly,
             _ => return invalid_dhttp_subject_key_identifier::KindFlagSnafu.fail(),
         };
         let owner_hash = OwnerHash::try_from(owner_hash)
@@ -309,6 +309,12 @@ mod tests {
         assert_eq!(secondary.to_string(), "client:2");
     }
 
+    #[test]
+    fn certificate_usage_preserves_certserver_kind_flags() {
+        assert_eq!(CertificateUsage::ClientAndServer.kind_flag(), "0");
+        assert_eq!(CertificateUsage::ClientOnly.kind_flag(), "1");
+    }
+
     #[test]
     fn rejects_out_of_range_subject_key_identifier_sequence() {
         let error = format!("{}:0:{OWNER_HASH}", i32::MAX as u64 + 1)
@@ -324,14 +330,14 @@ mod tests {
     #[test]
     fn parses_canonical_dhttp_subject_key_identifier() {
         let ski = DhttpSubjectKeyIdentifier::try_from_subject_key_identifier_bytes(
-            format!("7:1:{OWNER_HASH}").as_bytes(),
+            format!("7:0:{OWNER_HASH}").as_bytes(),
         )
         .unwrap();
 
         assert_eq!(ski.chain().sequence().get(), 7);
         assert_eq!(ski.chain().usage(), CertificateUsage::ClientAndServer);
         assert_eq!(ski.owner_hash().as_str(), OWNER_HASH);
-        assert_eq!(ski.to_string(), format!("7:1:{OWNER_HASH}"));
+        assert_eq!(ski.to_string(), format!("7:0:{OWNER_HASH}"));
     }
 
     #[test]
diff --git a/identity/src/identity.rs b/identity/src/identity.rs
index 861daf0..be40d09 100644
--- a/identity/src/identity.rs
+++ b/identity/src/identity.rs
@@ -572,7 +572,7 @@ mod tests {
         let dhttp = identity
             .dhttp_subject_key_identifier()
             .expect("extract dhttp ski");
-        assert_eq!(dhttp.chain().usage(), CertificateUsage::ClientOnly);
+        assert_eq!(dhttp.chain().usage(), CertificateUsage::ClientAndServer);
         assert_eq!(dhttp.chain().sequence().get(), 0);
     }