diff --git a/coderd/agentapi/activitybump.go b/coderd/agentapi/activitybump.go
index 90afaf7e36111..a28ba695d018e 100644
--- a/coderd/agentapi/activitybump.go
+++ b/coderd/agentapi/activitybump.go
@@ -41,6 +41,7 @@ func ActivityBumpWorkspace(ctx context.Context, log slog.Logger, db database.Sto
 	// low priority operations fail first.
 	ctx, cancel := context.WithTimeout(ctx, time.Second*15)
 	defer cancel()
+	// nolint:gocritic // (#13146) Will be moved soon as part of refactor.
 	err := db.ActivityBumpWorkspace(ctx, database.ActivityBumpWorkspaceParams{
 		NextAutostart: nextAutostart.UTC(),
 		WorkspaceID:   workspaceID,
diff --git a/coderd/agentapi/stats.go b/coderd/agentapi/stats.go
index fe5ccbe833022..e91a3624e915d 100644
--- a/coderd/agentapi/stats.go
+++ b/coderd/agentapi/stats.go
@@ -102,6 +102,7 @@ func (a *StatsAPI) UpdateStats(ctx context.Context, req *agentproto.UpdateStatsR
 		return nil
 	})
 	errGroup.Go(func() error {
+		// nolint:gocritic // (#13146) Will be moved soon as part of refactor.
 		err := a.Database.UpdateWorkspaceLastUsedAt(ctx, database.UpdateWorkspaceLastUsedAtParams{
 			ID:         workspace.ID,
 			LastUsedAt: now,
diff --git a/coderd/batchstats/batcher.go b/coderd/batchstats/batcher.go
index 34b76d239e7ef..bbff38b0413c0 100644
--- a/coderd/batchstats/batcher.go
+++ b/coderd/batchstats/batcher.go
@@ -240,6 +240,7 @@ func (b *Batcher) flush(ctx context.Context, forced bool, reason string) {
 		b.buf.ConnectionsByProto = payload
 	}
 
+	// nolint:gocritic // (#13146) Will be moved soon as part of refactor.
 	err = b.store.InsertWorkspaceAgentStats(ctx, *b.buf)
 	elapsed := time.Since(start)
 	if err != nil {
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
index bf50971ea6cb8..03ca23dcc1162 100644
--- a/coderd/workspaceagents.go
+++ b/coderd/workspaceagents.go
@@ -1244,6 +1244,7 @@ func (api *API) workspaceAgentReportStats(rw http.ResponseWriter, r *http.Reques
 	})
 	if req.SessionCount() > 0 {
 		errGroup.Go(func() error {
+			// nolint:gocritic // (#13146) Will be moved soon as part of refactor.
 			err := api.Database.UpdateWorkspaceLastUsedAt(ctx, database.UpdateWorkspaceLastUsedAtParams{
 				ID:         workspace.ID,
 				LastUsedAt: now,
diff --git a/coderd/workspaceusage/tracker.go b/coderd/workspaceusage/tracker.go
index 6a3659a5008d8..118b021d71d52 100644
--- a/coderd/workspaceusage/tracker.go
+++ b/coderd/workspaceusage/tracker.go
@@ -130,6 +130,7 @@ func (tr *Tracker) flush(now time.Time) {
 	authCtx := dbauthz.AsSystemRestricted(ctx)
 	tr.flushLock.Lock()
 	defer tr.flushLock.Unlock()
+	// nolint:gocritic // (#13146) Will be moved soon as part of refactor.
 	if err := tr.s.BatchUpdateWorkspaceLastUsedAt(authCtx, database.BatchUpdateWorkspaceLastUsedAtParams{
 		LastUsedAt: now,
 		IDs:        ids,
diff --git a/enterprise/coderd/schedule/template.go b/enterprise/coderd/schedule/template.go
index 1d246d344f026..824bcca6a1bcc 100644
--- a/enterprise/coderd/schedule/template.go
+++ b/enterprise/coderd/schedule/template.go
@@ -169,6 +169,7 @@ func (s *EnterpriseTemplateScheduleStore) Set(ctx context.Context, db database.S
 		}
 
 		if opts.UpdateWorkspaceLastUsedAt {
+			// nolint:gocritic // (#13146) Will be moved soon as part of refactor.
 			err = tx.UpdateTemplateWorkspacesLastUsedAt(ctx, database.UpdateTemplateWorkspacesLastUsedAtParams{
 				TemplateID: tpl.ID,
 				LastUsedAt: dbtime.Now(),
diff --git a/scripts/rules.go b/scripts/rules.go
index 246fe29381e7c..2ff2a503b8503 100644
--- a/scripts/rules.go
+++ b/scripts/rules.go
@@ -467,3 +467,23 @@ func withTimezoneUTC(m dsl.Matcher) {
 	).Report(`Setting database timezone to UTC may mask timezone-related bugs.`).
 		At(m["tz"])
 }
+
+// workspaceActivity ensures that updating workspace activity is only done in the workspaceapps package.
+//
+//nolint:unused,deadcode,varnamelen
+func workspaceActivity(m dsl.Matcher) {
+	m.Import("github.com/coder/coder/v2/coderd/database")
+	m.Match(
+		`$_.ActivityBumpWorkspace($_, $_)`,
+		`$_.UpdateWorkspaceLastUsedAt($_, $_)`,
+		`$_.BatchUpdateWorkspaceLastUsedAt($_, $_)`,
+		`$_.UpdateTemplateWorkspacesLastUsedAt($_, $_)`,
+		`$_.InsertWorkspaceAgentStats($_, $_)`,
+		`$_.InsertWorkspaceAppStats($_, $_)`,
+	).Where(
+		!m.File().PkgPath.Matches(`workspaceapps`) &&
+			!m.File().PkgPath.Matches(`dbauthz$`) &&
+			!m.File().PkgPath.Matches(`dbgen$`) &&
+			!m.File().Name.Matches(`_test\.go$`),
+	).Report("Updating workspace activity should always be done in the workspaceapps package.")
+}