diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000000..17f40f6157
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,42 @@
+[licenses]
+allow = [
+  "0BSD",
+  "Apache-2.0 WITH LLVM-exception",
+  "Apache-2.0",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "BSL-1.0",
+  "bzip2-1.0.6",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Zlib",
+]
+confidence-threshold = 0.8
+private = { ignore = true }
+
+[[licenses.clarify]]
+crate = "uv-auth"
+expression = "MIT OR Apache-2.0"
+license-files = [
+  { path = "../../LICENSE-APACHE", hash = 0x0 },
+  { path = "../../LICENSE-MIT", hash = 0x0 },
+]
+
+[[licenses.clarify]]
+crate = "uv-client"
+expression = "MIT OR Apache-2.0"
+license-files = [
+  { path = "../../LICENSE-APACHE", hash = 0x0 },
+  { path = "../../LICENSE-MIT", hash = 0x0 },
+]
+
+[[licenses.clarify]]
+crate = "uv-shell"
+expression = "MIT OR Apache-2.0"
+license-files = [
+  { path = "../../LICENSE-APACHE", hash = 0x0 },
+  { path = "../../LICENSE-MIT", hash = 0x0 },
+]
diff --git a/lefthook.yaml b/lefthook.yaml
index 630011f879..41097a396a 100644
--- a/lefthook.yaml
+++ b/lefthook.yaml
@@ -21,6 +21,10 @@ pre-commit:
   jobs:
     - name: actionlint
       run: pixi {run} actionlint
+    - name: cargo-deny
+      glob: "Cargo.lock,Cargo.toml"
+      stage_fixed: true
+      run: pixi {run} cargo-deny
     - name: cargo-fmt
       glob: "*.rs"
       stage_fixed: true
diff --git a/pixi.lock b/pixi.lock
index c9c0bcbc3e..6443ca27ba 100644
--- a/pixi.lock
+++ b/pixi.lock
@@ -1410,6 +1410,7 @@ environments:
       - conda: https://prefix.dev/conda-forge/linux-64/c-ares-1.34.5-hb9d3cd8_0.conda
       - conda: https://prefix.dev/conda-forge/linux-64/c-compiler-1.9.0-h2b85faf_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/ca-certificates-2025.4.26-hbd8a1cb_0.conda
+      - conda: https://prefix.dev/conda-forge/linux-64/cargo-deny-0.18.3-hb23c6cf_0.conda
       - conda: https://prefix.dev/conda-forge/linux-64/clang-21-21.1.0-default_hddf928d_0.conda
       - conda: https://prefix.dev/conda-forge/linux-64/clang-21.1.0-default_hfa515fb_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/colorama-0.4.6-pyhd8ed1ab_1.conda
@@ -1547,6 +1548,7 @@ environments:
       - conda: https://prefix.dev/conda-forge/linux-aarch64/c-ares-1.34.5-h86ecc28_0.conda
       - conda: https://prefix.dev/conda-forge/linux-aarch64/c-compiler-1.9.0-h6561dab_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/ca-certificates-2025.4.26-hbd8a1cb_0.conda
+      - conda: https://prefix.dev/conda-forge/linux-aarch64/cargo-deny-0.18.3-h7d7b287_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/colorama-0.4.6-pyhd8ed1ab_1.conda
       - conda: https://prefix.dev/conda-forge/linux-aarch64/compilers-1.9.0-h8af1aa0_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/cpython-3.13.3-py313hd8ed1ab_101.conda
@@ -1671,6 +1673,7 @@ environments:
       - conda: https://prefix.dev/conda-forge/osx-64/c-ares-1.34.5-hf13058a_0.conda
       - conda: https://prefix.dev/conda-forge/osx-64/c-compiler-1.9.0-h09a7c41_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/ca-certificates-2025.4.26-hbd8a1cb_0.conda
+      - conda: https://prefix.dev/conda-forge/osx-64/cargo-deny-0.18.3-h20e96b3_0.conda
       - conda: https://prefix.dev/conda-forge/osx-64/cctools-1010.6-ha66f10e_6.conda
       - conda: https://prefix.dev/conda-forge/osx-64/cctools_osx-64-1010.6-hd19c6af_6.conda
       - conda: https://prefix.dev/conda-forge/osx-64/clang-18-18.1.8-default_h3571c67_10.conda
@@ -1804,6 +1807,7 @@ environments:
       - conda: https://prefix.dev/conda-forge/osx-arm64/c-ares-1.34.5-h5505292_0.conda
       - conda: https://prefix.dev/conda-forge/osx-arm64/c-compiler-1.9.0-hdf49b6b_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/ca-certificates-2025.4.26-hbd8a1cb_0.conda
+      - conda: https://prefix.dev/conda-forge/osx-arm64/cargo-deny-0.18.3-hf783435_0.conda
       - conda: https://prefix.dev/conda-forge/osx-arm64/cctools-1010.6-hb4fb6a3_6.conda
       - conda: https://prefix.dev/conda-forge/osx-arm64/cctools_osx-arm64-1010.6-h3b4f5d3_6.conda
       - conda: https://prefix.dev/conda-forge/osx-arm64/clang-18-18.1.8-default_hf90f093_10.conda
@@ -1937,6 +1941,7 @@ environments:
       - conda: https://prefix.dev/conda-forge/win-64/bzip2-1.0.8-h2466b09_7.conda
       - conda: https://prefix.dev/conda-forge/win-64/c-compiler-1.9.0-hcfcfb64_0.conda
       - conda: https://prefix.dev/conda-forge/noarch/ca-certificates-2025.4.26-h4c7d964_0.conda
+      - conda: https://prefix.dev/conda-forge/win-64/cargo-deny-0.18.3-h63977a8_0.conda
       - conda: https://prefix.dev/conda-forge/win-64/clang-19-19.1.7-default_hec7ea82_3.conda
       - conda: https://prefix.dev/conda-forge/win-64/clang-19.1.7-default_hec7ea82_3.conda
       - conda: https://prefix.dev/conda-forge/noarch/colorama-0.4.6-pyhd8ed1ab_1.conda
@@ -3383,6 +3388,60 @@ packages:
   - pkg:pypi/cairosvg?source=hash-mapping
   size: 44459
   timestamp: 1747337159019
+- conda: https://prefix.dev/conda-forge/linux-64/cargo-deny-0.18.3-hb23c6cf_0.conda
+  sha256: 164b78a762df4742d9eafe08e0a8f4e04645c0afb8784dbe162bfbeff2b6957d
+  md5: 31a3ca46cd1feaa393222bbfb92d1f20
+  depends:
+  - __glibc >=2.17,<3.0.a0
+  - libgcc >=13
+  constrains:
+  - __glibc >=2.17
+  license: Apache-2.0 OR MIT
+  size: 6917564
+  timestamp: 1749753214856
+- conda: https://prefix.dev/conda-forge/linux-aarch64/cargo-deny-0.18.3-h7d7b287_0.conda
+  sha256: 11e305fdf45d698de4b46672fd57537c1f40f3a6626f3e43ba84ce06c4672a75
+  md5: 6a4a95be4969995a984307272e2faa1f
+  depends:
+  - libgcc >=13
+  constrains:
+  - __glibc >=2.17
+  license: Apache-2.0 OR MIT
+  size: 6760585
+  timestamp: 1749753267794
+- conda: https://prefix.dev/conda-forge/osx-64/cargo-deny-0.18.3-h20e96b3_0.conda
+  sha256: 8413a79a3ab09d314150d5d1ae249040cb409fb60f90ecd5379fbace1fa04c6e
+  md5: 443ef92a69e2514a277db437264c2a53
+  depends:
+  - __osx >=10.13
+  constrains:
+  - __osx >=10.13
+  license: Apache-2.0 OR MIT
+  size: 6782602
+  timestamp: 1749753244352
+- conda: https://prefix.dev/conda-forge/osx-arm64/cargo-deny-0.18.3-hf783435_0.conda
+  sha256: e973eda47c1f86e7a57038145fa76ba4fb81af5fc33f951e0b4626316b1c6891
+  md5: b0d67e90debc899d5c1400b92a29330e
+  depends:
+  - __osx >=11.0
+  constrains:
+  - __osx >=11.0
+  license: Apache-2.0 OR MIT
+  size: 6443568
+  timestamp: 1749753248961
+- conda: https://prefix.dev/conda-forge/win-64/cargo-deny-0.18.3-h63977a8_0.conda
+  sha256: 5a288f8059ff07bbc9eb7b54e6869299445c930551503827d6df6468e2b893a0
+  md5: 86bd96aa16a3d6843d79038559095f19
+  depends:
+  - vc >=14.2,<15
+  - vc14_runtime >=14.29.30139
+  - ucrt >=10.0.20348.0
+  - vc >=14.2,<15
+  - vc14_runtime >=14.29.30139
+  - ucrt >=10.0.20348.0
+  license: Apache-2.0 OR MIT
+  size: 7085662
+  timestamp: 1749753252071
 - conda: https://prefix.dev/conda-forge/linux-64/cargo-edit-0.13.6-hb23c6cf_0.conda
   sha256: 3eada64d7654d46d76c69a3d90b5885e22300d8c4fb38dcef8a1a8858dc1dbaa
   md5: 4cd64469a2b05ba54a3b3ec7177d0665
diff --git a/pixi.toml b/pixi.toml
index 9df4e9a53f..9379e337dd 100644
--- a/pixi.toml
+++ b/pixi.toml
@@ -124,6 +124,7 @@ cmd = "pytest --inline-snapshot=fix -k '{{ expression }}'"
 [feature.lint.dependencies]
 actionlint = ">=1.7.7,<2"
 basedpyright = ">=1.31.4,<2"
+cargo-deny = ">=0.18.3,<0.19"
 dprint = ">=0.49.1,<0.51"
 go-shfmt = ">=3.11.0,<4"
 lefthook = ">=1.11.14,<2"
@@ -135,6 +136,7 @@ typos = ">=1.29.10,<2"
 [feature.lint.tasks]
 actionlint = { cmd = "actionlint", env = { SHELLCHECK_OPTS = "-e SC2086" } }
 cargo-clippy = "cargo clippy --all-targets --workspace -- -D warnings"
+cargo-deny = "cargo deny --workspace check license --deny warnings"
 cargo-fmt = "cargo fmt --all"
 check-openssl = "python tests/scripts/check-openssl.py"
 dprint-check = { cmd = "dprint check --log-level=silent", description = "Check formatting with dprint" }