diff --git a/Cargo.toml b/Cargo.toml
index 9c43642072..2882e3f843 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,11 +1,11 @@
 [package]
 name = "rustup"
-version = "1.27.1"
-edition = "2021"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
 description = "Manage multiple rust installations with ease"
 homepage = "https://github.com/rust-lang/rustup"
 keywords = ["rustup", "multirust", "install", "proxy"]
-license = "MIT OR Apache-2.0"
 readme = "README.md"
 repository = "https://github.com/rust-lang/rustup"
 build = "build.rs"
@@ -130,9 +130,17 @@ trycmd = "0.15.0"
 platforms.workspace = true
 regex = "1"
 
+[lints]
+workspace = true
+
 [workspace]
 members = ["download"]
 
+[workspace.package]
+version = "1.27.1"
+edition = "2021"
+license = "MIT OR Apache-2.0"
+
 [workspace.dependencies]
 anyhow = "1.0.69"
 fs_at = "0.2.1"
@@ -153,6 +161,14 @@ tracing-subscriber = "0.3.16"
 url = "2.4"
 walkdir = "2"
 
+[workspace.lints.rust]
+rust_2018_idioms = "deny"
+
+[workspace.lints.clippy]
+# `dbg!()` and `todo!()` clearly shouldn't make it to production:
+dbg_macro = "warn"
+todo = "warn"
+
 [lib]
 name = "rustup"
 path = "src/lib.rs"
diff --git a/download/Cargo.toml b/download/Cargo.toml
index c1daeeaefc..0457cd84dc 100644
--- a/download/Cargo.toml
+++ b/download/Cargo.toml
@@ -1,8 +1,8 @@
 [package]
 name = "download"
-version = "1.27.1"
-edition = "2021"
-license = "MIT OR Apache-2.0"
+version.workspace = true
+edition.workspace = true
+license.workspace = true
 
 [features]
 default = ["reqwest-backend", "reqwest-rustls-tls", "reqwest-native-tls"]
@@ -32,3 +32,6 @@ http-body-util = "0.1.0"
 hyper = { version = "1.0", default-features = false, features = ["server", "http1"] }
 hyper-util = { version = "0.1.1", features = ["tokio"] }
 tempfile.workspace = true
+
+[lints]
+workspace = true
diff --git a/download/src/lib.rs b/download/src/lib.rs
index c22ed87e49..ba796c8306 100644
--- a/download/src/lib.rs
+++ b/download/src/lib.rs
@@ -1,5 +1,4 @@
 //! Easy file downloading
-#![deny(rust_2018_idioms)]
 
 use std::fs::remove_file;
 use std::path::Path;
diff --git a/src/cli/rustup_mode.rs b/src/cli/rustup_mode.rs
index 9b84fe1a28..8c69b25253 100644
--- a/src/cli/rustup_mode.rs
+++ b/src/cli/rustup_mode.rs
@@ -588,7 +588,8 @@ pub async fn main(
     }
 
     let Some(subcmd) = matches.subcmd else {
-        eprintln!("{}", Rustup::command().render_long_help());
+        let help = Rustup::command().render_long_help();
+        writeln!(process.stderr().lock(), "{help}")?;
         return Ok(utils::ExitCode(1));
     };
 
diff --git a/src/diskio/threaded.rs b/src/diskio/threaded.rs
index 85906b3b84..486864bbae 100644
--- a/src/diskio/threaded.rs
+++ b/src/diskio/threaded.rs
@@ -268,6 +268,7 @@ impl<'a> Executor for Threaded<'a> {
                 prev_files as u64,
             ));
         }
+        #[allow(clippy::print_stderr)]
         if prev_files > 50 {
             eprintln!("{prev_files} deferred IO operations");
         }
diff --git a/src/lib.rs b/src/lib.rs
index bacaafe8c9..24664da77c 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1,9 +1,13 @@
-#![deny(rust_2018_idioms)]
 #![allow(
     clippy::type_complexity,
     clippy::result_large_err, // 288 bytes is our 'large' variant today, which is unlikely to be a performance problem
     clippy::arc_with_non_send_sync, // will get resolved as we move further into async
 )]
+#![cfg_attr(not(test), warn(
+    // We use the logging system instead of printing directly.
+    clippy::print_stdout,
+    clippy::print_stderr,
+))]
 #![recursion_limit = "1024"]
 
 use anyhow::{anyhow, Result};
diff --git a/src/test.rs b/src/test.rs
index 42a3c728dc..554792d851 100644
--- a/src/test.rs
+++ b/src/test.rs
@@ -1,4 +1,4 @@
-#![allow(clippy::box_default)]
+#![allow(clippy::box_default, clippy::print_stdout, clippy::print_stderr)]
 //! Test support module; public to permit use from integration tests.
 
 pub mod mock;
diff --git a/src/test/mock/clitools.rs b/src/test/mock/clitools.rs
index de9981abd5..256a1c830c 100644
--- a/src/test/mock/clitools.rs
+++ b/src/test/mock/clitools.rs
@@ -668,8 +668,11 @@ impl Config {
             println!("expected.ok: true");
             print_indented("expected.stdout", stdout);
             print_indented("expected.stderr", stderr);
-            dbg!(out.stdout == stdout);
-            dbg!(out.stderr == stderr);
+            #[allow(clippy::dbg_macro)]
+            {
+                dbg!(out.stdout == stdout);
+                dbg!(out.stderr == stderr);
+            }
             panic!();
         }
     }