diff --git a/.tangled/workflows/lexicons-check.yml b/.tangled/workflows/lexicons-check.yml
index aa25327..70088af 100644
--- a/.tangled/workflows/lexicons-check.yml
+++ b/.tangled/workflows/lexicons-check.yml
@@ -5,9 +5,15 @@ when:
 engine: nixery
 
 dependencies:
-  git+https://tangled.org/zzstoatzz.io/publex:
-    - publex
+  git+https://github.com/zzstoatzz/goat?rev=dc6885650a408b6f8e8744845a24d33d26f2bf69:
+    - goat
 
 steps:
-  - name: check lexicons
-    command: publex check
+  - name: lint lexicons
+    command: goat lex lint lexicons
+
+  - name: check breaking changes
+    command: goat lex breaking lexicons
+
+  - name: check namespace delegation
+    command: goat lex check-dns lexicons
diff --git a/.tangled/workflows/lexicons-publish.yml b/.tangled/workflows/lexicons-publish.yml
index 8904ee7..9c2177d 100644
--- a/.tangled/workflows/lexicons-publish.yml
+++ b/.tangled/workflows/lexicons-publish.yml
@@ -8,9 +8,9 @@ environment:
   ATPROTO_HANDLE: waow.tech
 
 dependencies:
-  git+https://tangled.org/zzstoatzz.io/publex:
-    - publex
+  git+https://github.com/zzstoatzz/goat?rev=dc6885650a408b6f8e8744845a24d33d26f2bf69:
+    - goat
 
 steps:
   - name: publish lexicons
-    command: publex publish
+    command: GOAT_USERNAME="$ATPROTO_HANDLE" GOAT_PASSWORD="$ATPROTO_PASSWORD" goat lex publish --update lexicons
diff --git a/readme.md b/readme.md
index 4b28abb..9311665 100644
--- a/readme.md
+++ b/readme.md
@@ -9,11 +9,14 @@ polls on [AT Protocol](https://atproto.com). create polls, vote, see results in
 - [`tech.waow.pollz.poll`](lexicons/tech/waow/pollz/poll.json) — a poll with question + options
 - [`tech.waow.pollz.vote`](lexicons/tech/waow/pollz/vote.json) — a vote on a poll
 
-[Publex](https://tangled.org/zzstoatzz.io/publex) checks these schemas on
-every pull request and publishes changed schemas from `main` as
-`com.atproto.lexicon.schema` records. The publishing workflow uses the public
-`waow.tech` publishing identity and an `ATPROTO_PASSWORD` repository secret
-containing an app password for that account. The
+[GOAT](https://github.com/bluesky-social/goat) checks these schemas on every
+pull request and publishes changed schemas from `main` as
+`com.atproto.lexicon.schema` records. Tangled installs a commit-pinned
+[experimental fork](https://github.com/zzstoatzz/goat/tree/codex/permissioned-space-lexicons)
+that packages GOAT as a Nix flake and adds support for proposed permissioned
+space lexicons. The publishing workflow uses the public `waow.tech` publishing
+identity and an `ATPROTO_PASSWORD` repository secret containing an app password
+for that account. The
 `_lexicon.pollz.waow.tech` TXT record delegates this lexicon authority to the
 same identity.