diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 1d345498..89b97cb4 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -30,10 +30,22 @@ jobs:
       uses: actions/setup-python@d09bd5e6005b175076f227b13d9730d56e9dcfcb
       with:
         python-version: ${{ matrix.python }}
-    - name: Install dependencies
-      run: make setup
+    - name: Create and activate virtual environment
+      if: ${{ matrix.os == 'ubuntu-latest' || matrix.os == 'macos-latest' }}
+      run: |
+        make venv
+        source .venv/bin/activate
+      env:
+        PYTHON: python
+    - name: Create and activate virtual environment (Windows)
+      if: ${{ matrix.os == 'windows-latest' }}
+      run: |
+        make venv
+        .venv/Scripts/Activate.ps1
       env:
         PYTHON: python
+    - name: Install dependencies
+      run: make setup
     - name: Build the package
       # We don't need to check and test the package separately
       # because `make dist` runs those targets first and only
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 8e07a311..f63d0e87 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -31,7 +31,7 @@ jobs:
         language: [python]
         # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
         # Learn more about CodeQL language support at https://git.io/codeql-language-support
-        python: ['3.9', '3.10']
+        python: ['3.10']
 
     steps:
     - name: Harden Runner
@@ -46,11 +46,15 @@ jobs:
       uses: actions/setup-python@98f2ad02fd48d057ee3b4d4f66525b231c3e52b6
       with:
         python-version: ${{ matrix.python }}
-    - name: Install dependencies
-      run: make setup
+    - name: Create and activate virtual environment
+      run: |
+        make venv
+        source .venv/bin/activate
       env:
         PYTHON: python
 
+    - name: Install dependencies
+      run: make setup
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
       uses: github/codeql-action/init@c0982d28099e3cb8fd8b37cfd6c2cdfea4531853
diff --git a/.gitignore b/.gitignore
index 6988fda5..fe324aff 100644
--- a/.gitignore
+++ b/.gitignore
@@ -132,6 +132,3 @@ dmypy.json
 
 # Pyre type checker
 .pyre/
-
-# Makefile generated
-.upgraded
diff --git a/Makefile b/Makefile
index f220c14d..0c16fe96 100644
--- a/Makefile
+++ b/Makefile
@@ -5,6 +5,7 @@
 # whether this current run of `make` requires a Python virtual environment.
 NEED_VENV := $(or \
   $(findstring setup,$(MAKECMDGOALS)), \
+  $(findstring upgrade-quiet,$(MAKECMDGOALS)), \
   $(findstring upgrade,$(MAKECMDGOALS)), \
   $(findstring requirements,$(MAKECMDGOALS)), \
   $(findstring all,$(MAKECMDGOALS)), \
@@ -20,12 +21,19 @@ else
   ifeq ($(origin VIRTUAL_ENV),undefined)
     $(warning No Python virtual environment found, proceeding anyway)
   else
-    ifeq ($(wildcard .upgraded),)
+    ifeq ($(wildcard .venv/upgraded-on),)
       $(warning Python virtual environment not yet set up, proceeding anyway)
     endif
   endif
 endif
 
+# If the project configuration file has been updated (package deps or
+# otherwise) then warn the user and suggest resolving the conflict.
+ifeq ($(shell test pyproject.toml -nt .venv/upgraded-on; echo $$?),0)
+  $(warning pyproject.toml was updated, consider `make upgrade` if your packages have changed)
+  $(warning If this is not correct then run `make upgrade-quiet`)
+endif
+
 # Create a virtual environment, either for Python3.10 (default) or using
 # the Python interpreter specified in the PYTHON environment variable.
 .PHONY: venv
@@ -53,14 +61,16 @@ setup: force-upgrade
 # Install or upgrade an existing virtual environment based on the
 # package dependencies declared in pyproject.toml.
 .PHONY: upgrade force-upgrade
-upgrade: .upgraded
-.upgraded: pyproject.toml
+upgrade: .venv/upgraded-on
+.venv/upgraded-on: pyproject.toml
 	python -m pip install --upgrade pip
 	python -m pip install --upgrade --upgrade-strategy eager --editable .[hooks,dev,test,docs]
-	echo "Automatically generated by Python Package Makefile." > .upgraded
+	$(MAKE) upgrade-quiet
 force-upgrade:
-	rm -f .upgraded
+	rm -f .venv/upgraded-on
 	$(MAKE) upgrade
+upgrade-quiet:
+	echo "Automatically generated by Python Package Makefile on `date --rfc-3339=seconds`." > .venv/upgraded-on
 
 # Generate a requirements.txt file containing version and integrity
 # hashes for all packages currently installed in the virtual environment.
@@ -96,7 +106,7 @@ test:
 
 # Build a source distribution package and a binary wheel distribution artifact.
 .PHONY: dist
-ifeq ($(wildcard .upgraded),)
+ifeq ($(wildcard .venv/upgraded-on),)
   PACKAGE_VERSION=unknown
 else
   PACKAGE_VERSION=$(shell python -c 'import package; print(package.__version__)')
@@ -133,4 +143,4 @@ nuke: nuke-caches
 	  rm -fr $(VIRTUAL_ENV); \
 	fi
 	rm -fr src/package.egg-info/
-	rm -f requirements.txt .upgraded
+	rm -f requirements.txt