diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 531be4ec..2dfc5001 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -6,7 +6,7 @@
 # Documentation at https://aka.ms/yaml
 
 variables:
-  VERILATOR_VERSION: 4.016
+  VERILATOR_VERSION: 4.028
   VERILATOR_PATH: /opt/buildcache/verilator/$(VERILATOR_VERSION)
   RISCV_TOOLCHAIN_TAR_VERSION: 20190807-1
   RISCV_COMPLIANCE_GIT_VERSION: 844c6660ef3f0d9b96957991109dfd80cc4938e2
diff --git a/lint/verilator_waiver.vlt b/lint/verilator_waiver.vlt
index 9a26d4f1..9fc21bbf 100644
--- a/lint/verilator_waiver.vlt
+++ b/lint/verilator_waiver.vlt
@@ -10,62 +10,59 @@
 // Otherwise, only global waivers are applied, but not file-specific waivers.
 
 `verilator_config
-lint_off -msg PINCONNECTEMPTY
+lint_off -rule PINCONNECTEMPTY
 
 // Filename 'ibex_register_file_ff' does not match MODULE name: ibex_register_file
 // ibex_register_file_ff and ibex_register_file_latch provide two
 // implementation choices for the same module.
-lint_off -msg DECLFILENAME -file "*/rtl/ibex_register_file_ff.sv"
-lint_off -msg DECLFILENAME -file "*/rtl/ibex_register_file_latch.sv"
-lint_off -msg DECLFILENAME -file "*/rtl/ibex_register_file_fpga.sv"
+lint_off -rule DECLFILENAME -file "*/rtl/ibex_register_file_ff.sv"
+lint_off -rule DECLFILENAME -file "*/rtl/ibex_register_file_latch.sv"
+lint_off -rule DECLFILENAME -file "*/rtl/ibex_register_file_fpga.sv"
 
 // Bits of signal are not used: fetch_addr_n[0]
 // cleaner to write all bits even if not all are used
-lint_off -msg UNUSED -file "*/rtl/ibex_if_stage.sv" -lines 85
+lint_off -rule UNUSED -file "*/rtl/ibex_if_stage.sv" -match "*'fetch_addr_n'[0]*"
 
 // Bits of signal are not used: shift_right_result_ext[32]
 // cleaner to write all bits even if not all are used
-lint_off -msg UNUSED -file "*/rtl/ibex_alu.sv" -lines 104
+lint_off -rule UNUSED -file "*/rtl/ibex_alu.sv" -match "*'shift_right_result_ext'[32]*"
 
 // Bits of signal are not used: alu_adder_ext_i[0]
 // Bottom bit is round, not needed
-lint_off -msg UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -lines 28
+lint_off -rule UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -match "*'alu_adder_ext_i'[0]*"
 
 // Bits of signal are not used: mac_res_ext[34]
 // cleaner to write all bits even if not all are used
-lint_off -msg UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -lines 43
+lint_off -rule UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -match "*mac_res_ext*"
 
 // Bits of signal are not used: res_adder_h[32]
 // cleaner to write all bits even if not all are used
-lint_off -msg UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -lines 69
-
-// Bits of signal are not used: mult1_res[33:32]
-// cleaner to write all bits even if not all are used
-lint_off -msg UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -lines 115
+lint_off -rule UNUSED -file "*/rtl/ibex_multdiv_fast.sv" -match "*'res_adder_h'[32]*"
 
 // Signal is not used: test_en_i
 // testability signal
-lint_off -msg UNUSED -file "*/rtl/ibex_register_file_ff.sv" -lines 21
-lint_off -msg UNUSED -file "*/rtl/ibex_register_file_fpga.sv" -lines 22
+lint_off -rule UNUSED -file "*/rtl/ibex_register_file_ff.sv" -match "*test_en_i*"
+lint_off -rule UNUSED -file "*/rtl/ibex_register_file_fpga.sv" -match "*test_en_i*"
 
 // Signal is not used: clk_i
 // leaving clk and reset connected in-case we want to add assertions
-lint_off -msg UNUSED -file "*/rtl/ibex_compressed_decoder.sv" -lines 17
-lint_off -msg UNUSED -file "*/rtl/ibex_decoder.sv" -lines 25
+lint_off -rule UNUSED -file "*/rtl/ibex_pmp.sv" -match "*clk_i*"
+lint_off -rule UNUSED -file "*/rtl/ibex_compressed_decoder.sv" -match "*clk_i*"
+lint_off -rule UNUSED -file "*/rtl/ibex_decoder.sv" -match "*clk_i*"
 
 // Signal is not used: rst_ni
 // leaving clk and reset connected in-case we want to add assertions
-lint_off -msg UNUSED -file "*/rtl/ibex_compressed_decoder.sv" -lines 18
-lint_off -msg UNUSED -file "*/rtl/ibex_decoder.sv" -lines 26
-lint_off -msg UNUSED -file "*/rtl/ibex_register_file_fpga.sv" -lines 20
-
-// Signal unoptimizable: Feedback to clock or circular logic:
-// ibex_core.cs_registers_i.mie_q
-// Issue lowrisc/ibex#212
-lint_off -msg UNOPTFLAT -file "*/rtl/ibex_cs_registers.sv" -lines 158
+lint_off -rule UNUSED -file "*/rtl/ibex_pmp.sv" -match "*rst_ni*"
+lint_off -rule UNUSED -file "*/rtl/ibex_compressed_decoder.sv" -match "*rst_ni*"
+lint_off -rule UNUSED -file "*/rtl/ibex_decoder.sv" -match "*rst_ni*"
 
 // Bits of signal are not used: instr_alu[24:15,11:7]
 // instr flops are duplicated to reduce fan-out, neater to just leave unused
 // bits in fully duplicated instr for synthesiser to optimise out rather than
 // explicitly flopping only the bits we want.
-lint_off -msg UNUSED -file "*/rtl/ibex_decoder.sv" -lines 106
+lint_off -rule UNUSED -file "*/rtl/ibex_decoder.sv" -match "*instr_alu*"
+
+// Signal unoptimizable: Feedback to clock or circular logic:
+// ibex_core.cs_registers_i.mie_q
+// Issue lowrisc/ibex#212
+lint_off -rule UNOPTFLAT -file "*/rtl/ibex_cs_registers.sv" -match "*u_ibex_core.cs_registers_i.mie_q*"
diff --git a/tool_requirements.py b/tool_requirements.py
index 368dc085..17a2bb09 100644
--- a/tool_requirements.py
+++ b/tool_requirements.py
@@ -5,5 +5,5 @@
 # Version requirements for various tools. Checked by tooling (e.g. fusesoc),
 # and inserted into the Sphinx-generated documentation.
 __TOOL_REQUIREMENTS__ = {
-    'verilator': '4.010',
+    'verilator': '4.028',
 }