diff --git a/.cargo/config.toml b/.cargo/config.toml
index be614b002368..b18b6ce735d9 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -4,3 +4,6 @@
 # we don't use `[build]` because of rust analyzer's build cache invalidation https://github.com/emilk/eframe_template/issues/93
 [target.wasm32-unknown-unknown]
 rustflags = ["--cfg=web_sys_unstable_apis"]
+
+[alias]
+xtask = "run --quiet --package xtask --"
diff --git a/Cargo.lock b/Cargo.lock
index c6d8727188a7..fea3b014056f 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4698,6 +4698,10 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ec7a2a501ed189703dba8b08142f057e887dfc4b2cc4db2d343ac6376ba3e0b9"
 
+[[package]]
+name = "xtask"
+version = "0.27.1"
+
 [[package]]
 name = "yaml-rust"
 version = "0.4.5"
diff --git a/Cargo.toml b/Cargo.toml
index 598eae08cb1d..425eb8de2085 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -14,6 +14,8 @@ members = [
     "crates/epaint",
 
     "examples/*",
+
+    "xtask",
 ]
 
 [workspace.package]
diff --git a/scripts/cargo_deny.sh b/scripts/cargo_deny.sh
index 560b8efd1bbc..bf811e852041 100755
--- a/scripts/cargo_deny.sh
+++ b/scripts/cargo_deny.sh
@@ -1,21 +1,3 @@
 #!/usr/bin/env bash
 
-set -eu
-script_path=$( cd "$(dirname "${BASH_SOURCE[0]}")" ; pwd -P )
-cd "$script_path/.."
-set -x
-
-cargo install --quiet cargo-deny
-
-cargo deny --all-features --log-level error --target aarch64-apple-darwin check
-cargo deny --all-features --log-level error --target aarch64-linux-android check
-cargo deny --all-features --log-level error --target i686-pc-windows-gnu check
-cargo deny --all-features --log-level error --target i686-pc-windows-msvc check
-cargo deny --all-features --log-level error --target i686-unknown-linux-gnu check
-cargo deny --all-features --log-level error --target wasm32-unknown-unknown check
-cargo deny --all-features --log-level error --target x86_64-apple-darwin check
-cargo deny --all-features --log-level error --target x86_64-pc-windows-gnu check
-cargo deny --all-features --log-level error --target x86_64-pc-windows-msvc check
-cargo deny --all-features --log-level error --target x86_64-unknown-linux-gnu check
-cargo deny --all-features --log-level error --target x86_64-unknown-linux-musl check
-cargo deny --all-features --log-level error --target x86_64-unknown-redox check
+cargo xtask deny
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
new file mode 100644
index 000000000000..b3437f1bb64e
--- /dev/null
+++ b/xtask/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "xtask"
+edition.workspace = true
+license.workspace = true
+rust-version.workspace = true
+version.workspace = true
+
+[dependencies]
diff --git a/xtask/README.md b/xtask/README.md
new file mode 100644
index 000000000000..bb5e92777627
--- /dev/null
+++ b/xtask/README.md
@@ -0,0 +1,12 @@
+## xtask - Task automation
+
+This crate is meant to automate common tasks on the repository. It serves as a
+replacement for shell scripts that is more portable across host operating
+systems (namely Windows) and hopefully also easier to work with for
+contributors who are already familiar with Rust (and not necessarily with shell
+scripting).
+
+The executable can be invoked via the subcommand `cargo xtask`, thanks to an
+alias defined in `.cargo/config.toml`.
+
+For more information, see <https://github.com/matklad/cargo-xtask>.
diff --git a/xtask/src/deny.rs b/xtask/src/deny.rs
new file mode 100644
index 000000000000..9bb61c099c62
--- /dev/null
+++ b/xtask/src/deny.rs
@@ -0,0 +1,55 @@
+//! Run `cargo deny`
+//!
+//! Also installs the subcommand if it is not already installed.
+
+use std::process::Command;
+
+use super::DynError;
+
+pub fn deny(args: &[&str]) -> Result<(), DynError> {
+    if !args.is_empty() {
+        eprintln!("Warning: arguments ignored: {args:?}");
+    }
+    install_cargo_deny()?;
+    let targets = [
+        "aarch64-apple-darwin",
+        "aarch64-linux-android",
+        "i686-pc-windows-gnu",
+        "i686-pc-windows-msvc",
+        "i686-unknown-linux-gnu",
+        "wasm32-unknown-unknown",
+        "x86_64-apple-darwin",
+        "x86_64-pc-windows-gnu",
+        "x86_64-pc-windows-msvc",
+        "x86_64-unknown-linux-gnu",
+        "x86_64-unknown-linux-musl",
+        "x86_64-unknown-redox",
+    ];
+    for target in targets {
+        let status = Command::new("cargo")
+            .args([
+                "deny",
+                "--all-features",
+                "--log-level",
+                "error",
+                "--target",
+                target,
+                "check",
+            ])
+            .status()?;
+        if !status.success() {
+            return Err(status.to_string().into());
+        }
+    }
+    Ok(())
+}
+
+fn install_cargo_deny() -> Result<(), DynError> {
+    let status = Command::new("cargo")
+        .args(["+stable", "install", "--quiet", "--locked", "cargo-deny"])
+        .status()?;
+    if !status.success() {
+        return Err(status.to_string().into());
+    }
+    Ok(())
+}
diff --git a/xtask/src/main.rs b/xtask/src/main.rs
new file mode 100644
index 000000000000..d74add0c1746
--- /dev/null
+++ b/xtask/src/main.rs
@@ -0,0 +1,39 @@
+#![allow(clippy::print_stdout)]
+#![allow(clippy::print_stderr)]
+#![allow(clippy::exit)]
+
+mod deny;
+
+type DynError = Box<dyn std::error::Error>;
+
+fn main() {
+    if let Err(e) = try_main() {
+        eprintln!("{e}");
+        std::process::exit(-1);
+    }
+}
+
+fn try_main() -> Result<(), DynError> {
+    let arg_strings: Vec<_> = std::env::args().skip(1).collect();
+    let args: Vec<_> = arg_strings.iter().map(String::as_str).collect();
+
+    match args.as_slice() {
+        &[] | &["-h"] | &["--help"] => print_help(),
+        &["deny", ..] => deny::deny(&args[1..])?,
+        c => Err(format!("Invalid arguments {c:?}"))?,
+    }
+    Ok(())
+}
+
+fn print_help() {
+    let help = "
+    xtask help
+
+    Subcommands
+    deny: Run cargo-deny for all targets
+
+    Options
+    -h, --help: print help and exit
+        ";
+    println!("{help}");
+}