diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 62abcaf3..6d4173fb 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -112,6 +112,15 @@ jobs:
         run: test "$(uname -m)" = "${{ matrix.arch }}"
       - run: cargo test --workspace --all-targets
 
+  cargo-deny:
+    name: cargo-deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check
+
   clippy-windows:
     name: clippy (windows)
     runs-on: windows-latest
diff --git a/Cargo.lock b/Cargo.lock
index 34574838..84ffcf3b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -136,9 +136,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.103"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "2a4385e2e34eb35d6b3efe798b9eb88096925d87726c0798709bf56d9ed84af3"
 
 [[package]]
 name = "ar_archive_writer"
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..4bfd0d91
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,37 @@
+# cargo-deny configuration — advisories, licenses, and source hygiene for the
+# whole dependency graph (including the git-pinned gpui/zed tree).
+# Run locally with: nix run nixpkgs#cargo-deny -- check
+
+[advisories]
+yanked = "deny"
+
+[licenses]
+# Additions here need a conscious decision; keep the list to what the graph
+# actually pulls in.
+allow = [
+    "0BSD",
+    "CDLA-Permissive-2.0",
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unicode-3.0",
+    "MPL-2.0",
+    "CC0-1.0",
+]
+
+[bans]
+# The zed/gpui tree inevitably carries duplicate versions; keep this advisory
+# rather than blocking.
+multiple-versions = "warn"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-git = [
+    "https://github.com/zed-industries/zed",
+    "https://github.com/longbridge/gpui-component",
+]
diff --git a/devenv.lock b/devenv.lock
index 9fc0737c..8bf78b3a 100644
--- a/devenv.lock
+++ b/devenv.lock
@@ -67,11 +67,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1779592685,
-        "narHash": "sha256-p9d56GezhHRf4QfANxwa1d+fvwShvjB5XUhdIl7WEd0=",
+        "lastModified": 1783144302,
+        "narHash": "sha256-NQnzmXwpEAd5tjMBh2+P/y9NknF+WHv5+6yoXoN4h/Y=",
         "owner": "oxalica",
         "repo": "rust-overlay",
-        "rev": "3a58b199e7c83a80b85c28044f808085ba7e941c",
+        "rev": "fe5aee0952e8e1525533d61defd9e36513db811b",
         "type": "github"
       },
       "original": {