diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..77ed81e
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,78 @@
+[graph]
+targets = [
+    "x86_64-unknown-linux-gnu",
+    "aarch64-unknown-linux-gnu",
+    "armv7-unknown-linux-gnueabihf",
+
+    "x86_64-unknown-freebsd",
+    "aarch64-unknown-freebsd",
+    "armv7-unknown-freebsd",
+
+    "x86_64-apple-darwin",
+    "aarch64-apple-darwin",
+]
+
+all-features = false
+no-default-features = false
+
+#features = []
+
+[output]
+feature-depth = 1
+
+[advisories]
+#db-path = "$CARGO_HOME/advisory-dbs"
+#db-urls = ["https://github.com/rustsec/advisory-db"]
+ignore = []
+
+[licenses]
+allow = [
+    "GPL-2.0",
+    "MIT",
+    "Apache-2.0",
+    "ISC",
+    "MPL-2.0",
+    "Unicode-DFS-2016",
+    "BSD-3-Clause",
+    "OpenSSL",
+]
+confidence-threshold = 0.8
+exceptions = []
+
+[[licenses.clarify]]
+crate = "ring"
+expression = "MIT AND ISC AND OpenSSL"
+license-files = [
+  { path = "LICENSE", hash = 0xbd0eed23 }
+]
+
+[licenses.private]
+ignore = false
+registries = []
+
+[bans]
+multiple-versions = "allow"
+wildcards = "allow"
+highlight = "all"
+workspace-default-features = "allow"
+external-default-features = "allow"
+allow = []
+deny = []
+
+#[[bans.features]]
+#crate = "reqwest"
+#deny = ["json"]
+#allow = []
+#exact = true
+
+skip = []
+skip-tree = []
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
+
+[sources.allow-org]
+
diff --git a/flake.nix b/flake.nix
index 60ff337..fe92eee 100644
--- a/flake.nix
+++ b/flake.nix
@@ -47,6 +47,7 @@
         toolchain
         mysql-client
         cargo-nextest
+        cargo-deny
       ];
 
       RUST_SRC_PATH = "${toolchain}/lib/rustlib/src/rust/library";