diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 47e2704..e30708a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -47,6 +47,16 @@ jobs:
       - run: rustup component add rustfmt
       - run: cargo fmt --all -- --check
 
+  cargo-deny:
+    name: Cargo Deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      # Reads the dependency graph only, so no protoc/liblogosdelivery needed.
+      - uses: EmbarkStudios/cargo-deny-action@v2
+        with:
+          command: check
+
   smoketest:
     name: Smoketest
     environment: ${{ github.ref == 'refs/heads/main' && 'public-cache' || '' }}
diff --git a/Cargo.lock b/Cargo.lock
index 081efb6..c93bad7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -754,9 +754,9 @@ dependencies = [
 
 [[package]]
 name = "anyhow"
-version = "1.0.102"
+version = "1.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f202df86484c868dbad7eaa557ef785d5c66295e41b460ef922eca0723b842c"
+checksum = "330a5ed07fa54e4702c9d6c4174f74427fc0ef6e214bbd677ae50a5099946470"
 
 [[package]]
 name = "arboard"
@@ -836,6 +836,23 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "ark-ff"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f7a806ac6c8307b929df4645776290a50ee2aac754ad09d8bdf73391309e43af"
+dependencies = [
+ "ark-ff-asm 0.6.0",
+ "ark-ff-macros 0.6.0",
+ "ark-serialize 0.6.0",
+ "ark-std 0.6.0",
+ "digest 0.10.7",
+ "educe",
+ "num-bigint",
+ "num-traits",
+ "zeroize",
+]
+
 [[package]]
 name = "ark-ff-asm"
 version = "0.3.0"
@@ -866,6 +883,16 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "ark-ff-asm"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1479009684adc073dff49a1025d3a7065b317a9ead25aaaca38cdc70058ba8a2"
+dependencies = [
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "ark-ff-macros"
 version = "0.3.0"
@@ -904,6 +931,19 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "ark-ff-macros"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4a0691ed21ef00ef89c1e9bda832eba493dda3ec2f8d892fb25b705f73f06bb8"
+dependencies = [
+ "num-bigint",
+ "num-traits",
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "ark-serialize"
 version = "0.3.0"
@@ -937,6 +977,30 @@ dependencies = [
  "num-bigint",
 ]
 
+[[package]]
+name = "ark-serialize"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a74dd304fd536fb95d0a328e72be759209cc496a9da094c5bc56e5fea4f9e86b"
+dependencies = [
+ "ark-serialize-derive",
+ "ark-std 0.6.0",
+ "digest 0.10.7",
+ "num-bigint",
+ "serde_with",
+]
+
+[[package]]
+name = "ark-serialize-derive"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4f153690697a2b91e5e1251ff98411ee5371500a111a0fd317a70e588eb300f9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "ark-std"
 version = "0.3.0"
@@ -967,6 +1031,16 @@ dependencies = [
  "rand 0.8.6",
 ]
 
+[[package]]
+name = "ark-std"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "367c9c827ed431bff6868b7aa926e05b16eb46603cc8b6e768e4a5553fa1d155"
+dependencies = [
+ "num-traits",
+ "rand 0.8.6",
+]
+
 [[package]]
 name = "arrayvec"
 version = "0.7.6"
@@ -1632,9 +1706,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.18"
+version = "0.9.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5b82ac4a3c2ca9c3460964f020e1402edd5753411d7737aa39c3714ad1b5420e"
+checksum = "2d6914041f254d6e9176c01941b21115dcfb7089e55135a35411081bd106ef3f"
 dependencies = [
  "crossbeam-utils",
 ]
@@ -2132,7 +2206,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -3760,7 +3834,7 @@ version = "0.50.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.59.0",
 ]
 
 [[package]]
@@ -4958,14 +5032,15 @@ dependencies = [
 
 [[package]]
 name = "ruint"
-version = "1.18.0"
+version = "1.20.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0298da754d1395046b0afdc2f20ee76d29a8ae310cd30ffa84ed42acba9cb12a"
+checksum = "f5e99bff0393163bb25029a6af25d3d8d202ba5b5438a74d1bd8789f5c822970"
 dependencies = [
  "alloy-rlp",
  "ark-ff 0.3.0",
  "ark-ff 0.4.2",
  "ark-ff 0.5.0",
+ "ark-ff 0.6.0",
  "bytes",
  "fastrlp 0.3.1",
  "fastrlp 0.4.0",
@@ -5057,7 +5132,7 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys 0.12.1",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5115,7 +5190,7 @@ dependencies = [
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5725,7 +5800,7 @@ dependencies = [
  "getrandom 0.4.2",
  "once_cell",
  "rustix 1.1.4",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -6423,7 +6498,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index 47d84ea..5a5510e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,6 +31,9 @@ default-members = [
     "crates/generic-chat",
 ]
 
+[workspace.package]
+license = "MIT OR Apache-2.0"
+
 [workspace.dependencies]
 # Internal Workspace dependency declarations (sorted)
 logos-account = { path = "core/account" }
diff --git a/bin/chat-cli/Cargo.toml b/bin/chat-cli/Cargo.toml
index 71da08b..3e162a5 100644
--- a/bin/chat-cli/Cargo.toml
+++ b/bin/chat-cli/Cargo.toml
@@ -2,6 +2,7 @@
 name = "chat-cli"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [[bin]]
 name = "chat-cli"
diff --git a/core/account/Cargo.toml b/core/account/Cargo.toml
index 17db547..cde8530 100644
--- a/core/account/Cargo.toml
+++ b/core/account/Cargo.toml
@@ -2,6 +2,7 @@
 name = "logos-account"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [features]
 dev = []
diff --git a/core/conversations/Cargo.toml b/core/conversations/Cargo.toml
index 13754a9..61742b5 100644
--- a/core/conversations/Cargo.toml
+++ b/core/conversations/Cargo.toml
@@ -2,6 +2,7 @@
 name = "libchat"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [lib]
 crate-type = ["rlib"]
diff --git a/core/crypto/Cargo.toml b/core/crypto/Cargo.toml
index e5a0755..7fca144 100644
--- a/core/crypto/Cargo.toml
+++ b/core/crypto/Cargo.toml
@@ -2,6 +2,7 @@
 name = "crypto"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [dependencies]
 # External dependencies (sorted)
diff --git a/core/double-ratchets/Cargo.toml b/core/double-ratchets/Cargo.toml
index 3e3091d..8acf802 100644
--- a/core/double-ratchets/Cargo.toml
+++ b/core/double-ratchets/Cargo.toml
@@ -2,6 +2,7 @@
 name = "double-ratchets"
 version = "0.0.1"
 edition = "2024"
+license.workspace = true
 
 [lib]
 crate-type = ["rlib"]
diff --git a/core/integration_tests_core/Cargo.toml b/core/integration_tests_core/Cargo.toml
index 462b701..a9d1409 100644
--- a/core/integration_tests_core/Cargo.toml
+++ b/core/integration_tests_core/Cargo.toml
@@ -2,6 +2,7 @@
 name = "integration_tests_core"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 # [[test]]
 # name = "integration_tests_core"
diff --git a/core/shared-traits/Cargo.toml b/core/shared-traits/Cargo.toml
index ada17dc..174e534 100644
--- a/core/shared-traits/Cargo.toml
+++ b/core/shared-traits/Cargo.toml
@@ -3,6 +3,7 @@ name = "shared-traits"
 description = "Shared traits for the Logos Ecosystem"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [dependencies]
 crypto = { workspace = true }
diff --git a/core/sqlite/Cargo.toml b/core/sqlite/Cargo.toml
index 4fabf33..684ab54 100644
--- a/core/sqlite/Cargo.toml
+++ b/core/sqlite/Cargo.toml
@@ -2,6 +2,7 @@
 name = "chat-sqlite"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 description = "SQLite storage implementation for libchat"
 
 [dependencies]
diff --git a/core/storage/Cargo.toml b/core/storage/Cargo.toml
index 0c0775c..613b397 100644
--- a/core/storage/Cargo.toml
+++ b/core/storage/Cargo.toml
@@ -2,6 +2,7 @@
 name = "storage"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 description = "Shared storage layer for libchat"
 
 [dependencies]
diff --git a/crates/generic-chat/Cargo.toml b/crates/generic-chat/Cargo.toml
index beb802d..bfd3ede 100644
--- a/crates/generic-chat/Cargo.toml
+++ b/crates/generic-chat/Cargo.toml
@@ -2,6 +2,7 @@
 name = "logos-generic-chat"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [lib]
 crate-type = ["rlib"]
diff --git a/crates/logos-chat/Cargo.toml b/crates/logos-chat/Cargo.toml
index 63a8af6..6c0430d 100644
--- a/crates/logos-chat/Cargo.toml
+++ b/crates/logos-chat/Cargo.toml
@@ -2,6 +2,7 @@
 name = "logos-chat"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [lib]
 crate-type = ["rlib"]
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..f6af2b1
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,61 @@
+# cargo-deny configuration — run with: cargo deny check
+
+[graph]
+all-features = true
+
+[advisories]
+version = 2
+# libcrux crypto crates, exact-pinned (0.0.x) via openmls_libcrux_crypto 0.3.1.
+# The fix only exists on the openmls 0.9 prerelease line, which de-mls does not
+# support yet — revisit once openmls 0.9 is stable.
+ignore = [
+    "RUSTSEC-2026-0073", # libcrux-poly1305
+    "RUSTSEC-2026-0075", # libcrux-ed25519
+    "RUSTSEC-2026-0124", # libcrux-chacha20poly1305
+    "RUSTSEC-2026-0207", # libcrux-sha3
+    "RUSTSEC-2026-0208", # libcrux-sha3
+    "RUSTSEC-2026-0212", # libcrux-secrets
+    "RUSTSEC-2026-0209", # libcrux-aesgcm — AES-GCM, unused by our ciphersuite
+    "RUSTSEC-2026-0211", # libcrux-aesgcm — AES-GCM, unused by our ciphersuite
+    "RUSTSEC-2026-0210", # libcrux-aesgcm renamed
+    "RUSTSEC-2024-0436", # paste, unmaintained
+    "RUSTSEC-2026-0173", # proc-macro-error2, unmaintained
+]
+
+[licenses]
+version = 2
+allow = [
+    "MIT",
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "ISC",
+    "Zlib",
+    "Unicode-3.0",
+    "Unicode-DFS-2016",
+    "CC0-1.0",
+    "Unlicense",
+    "BSL-1.0",
+    "MPL-2.0",
+    "CDLA-Permissive-2.0",
+]
+confidence-threshold = 0.8
+
+# chat-proto ships no license field yet; treat it as the workspace license.
+[[licenses.clarify]]
+crate = "chat-proto"
+expression = "MIT OR Apache-2.0"
+license-files = []
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-git = [
+    "https://github.com/logos-messaging/chat_proto",
+    "https://github.com/vacp2p/de-mls",
+]
diff --git a/extensions/components/Cargo.toml b/extensions/components/Cargo.toml
index c4d1dd5..f08a12e 100644
--- a/extensions/components/Cargo.toml
+++ b/extensions/components/Cargo.toml
@@ -2,6 +2,7 @@
 name = "components"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [dependencies]
 # Workspace dependencies (sorted)
diff --git a/extensions/embedded-logos-delivery/Cargo.toml b/extensions/embedded-logos-delivery/Cargo.toml
index 65a9c71..953e0dc 100644
--- a/extensions/embedded-logos-delivery/Cargo.toml
+++ b/extensions/embedded-logos-delivery/Cargo.toml
@@ -2,6 +2,7 @@
 name = "embedded-logos-delivery"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 
 [dependencies]
 # Workspace dependencies (sorted)
diff --git a/extensions/logos-delivery-rust/Cargo.toml b/extensions/logos-delivery-rust/Cargo.toml
index bae3f20..ac2f5f6 100644
--- a/extensions/logos-delivery-rust/Cargo.toml
+++ b/extensions/logos-delivery-rust/Cargo.toml
@@ -2,6 +2,7 @@
 name = "logos-delivery"
 version = "0.1.0"
 edition = "2024"
+license.workspace = true
 links = "logosdelivery"
 
 [dependencies]