diff --git a/.ci/scripts/check_changelog_snippets.py b/.ci/scripts/check_changelog_snippets.py
new file mode 100755
index 0000000..b744ff4
--- /dev/null
+++ b/.ci/scripts/check_changelog_snippets.py
@@ -0,0 +1,36 @@
+#!/bin/env python3
+# /// script
+# requires-python = ">=3.11"
+# dependencies = [
+# ]
+# ///
+import re
+import sys
+from pathlib import Path
+
+import tomllib
+
+EXCEPTIONS = [
+    ".TEMPLATE.md",
+    ".gitkeep",
+    "pulp-glue-deb",
+]
+
+
+def snippet_valid(path: Path, changelog_exts: list[str]) -> bool:
+    return (path.name in EXCEPTIONS) or (
+        path.suffix in changelog_exts
+        and (path.stem.startswith("+") or re.fullmatch(r"\d*", path.stem))
+    )
+
+
+if __name__ == "__main__":
+    with Path("pyproject.toml").open("rb") as fp:
+        pyproject_toml = tomllib.load(fp)
+    changelog_exts = [
+        f".{item['directory']}" for item in pyproject_toml["tool"]["towncrier"]["type"]
+    ]
+    matches = Path("CHANGES").rglob("*")
+    invalid_snippets = ", ".join(f"'{s}'" for s in matches if not snippet_valid(s, changelog_exts))
+    if invalid_snippets:
+        sys.exit(f"LINT: Invalid changelog entries: {invalid_snippets}.")
diff --git a/.ci/scripts/pr_labels.py b/.ci/scripts/pr_labels.py
index b2350b6..2144815 100755
--- a/.ci/scripts/pr_labels.py
+++ b/.ci/scripts/pr_labels.py
@@ -16,7 +16,7 @@
 from git import Repo
 
 
-def main():
+def main() -> None:
     assert len(sys.argv) == 3
 
     with Path("pyproject.toml").open("rb") as fp:
diff --git a/.ci/scripts/validate_commit_message.py b/.ci/scripts/validate_commit_message.py
index b8243c6..ca0fffd 100644
--- a/.ci/scripts/validate_commit_message.py
+++ b/.ci/scripts/validate_commit_message.py
@@ -62,7 +62,9 @@ def check_changelog(issue: str) -> None:
 print(f"Checking commit message for {sha[0:7]}.")
 
 # validate the issue attached to the commit
-issue_regex = r"(?:{keywords})[\s:]+#(\d+)".format(keywords=("|").join(KEYWORDS))
+issue_regex = r"(?:{keywords})[\s:]+#(\d+)".format(
+    keywords=("|").join(re.escape(k) for k in KEYWORDS)
+)
 issues = re.findall(issue_regex, message, re.IGNORECASE)
 cherry_pick_regex = r"^\s*\(cherry picked from commit [0-9a-f]*\)\s*$"
 cherry_pick = re.search(cherry_pick_regex, message, re.MULTILINE)
@@ -70,7 +72,7 @@ def check_changelog(issue: str) -> None:
 if issues:
     for issue in issues:
         if not cherry_pick:
-            check_status(issue)
             check_changelog(issue)
+            check_status(issue)
 
 print(f"Commit message for {sha[0:7]} passed.")
diff --git a/Makefile b/Makefile
index f323cf9..912d76a 100644
--- a/Makefile
+++ b/Makefile
@@ -39,6 +39,7 @@ _lint:
 	ruff format --check --diff
 	ruff check --output-format concise
 	.ci/scripts/check_cli_dependencies.py
+	.ci/scripts/check_changelog_snippets.py
 	.ci/scripts/check_click_for_mypy.py
 	mypy
 	cd pulp-glue-deb; mypy
diff --git a/pyproject.toml b/pyproject.toml
index 487c242..51af625 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -236,7 +236,7 @@ dev = [
 ]
 lint = [
   {include-group = "test"},
-  "mypy~=1.20.0",
+  "mypy~=2.4.0",
   "ruff~=0.16.0",
   "shellcheck-py~=0.11.0.1",
   "types-pygments",