diff --git a/.github/workflows/lint-dependencies.yml b/.github/workflows/lint-dependencies.yml
new file mode 100644
index 000000000..bf0c92a33
--- /dev/null
+++ b/.github/workflows/lint-dependencies.yml
@@ -0,0 +1,17 @@
+name: CI
+on:
+  pull_request:
+    paths:
+      - 'Cargo.lock'
+      - '**/Cargo.toml'
+      - 'deny.toml'
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: EmbarkStudios/cargo-deny-action@v2
+      with:
+        command: check licenses
+        arguments: --all-features --locked --exclude-dev
+        rust-version: 1.91 # updatecli.d/rust.yml
diff --git a/Cargo.toml b/Cargo.toml
index 33fbf2956..decc9c6dd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -6,6 +6,9 @@ members = ["crates/*"]
 rust-version = "1.85"
 edition = "2024"
 repository = "https://github.com/fish-shell/fish-shell"
+# see doc_src/license.rst for details
+# don't forget to update COPYING and debian/copyright too
+license = "GPL-2.0-only AND LGPL-2.0-or-later AND MIT AND PSF-2.0"
 
 [workspace.dependencies]
 bitflags = "2.5.0"
@@ -74,9 +77,7 @@ version = "4.2.1-snapshot"
 edition.workspace = true
 rust-version.workspace = true
 default-run = "fish"
-# see doc_src/license.rst for details
-# don't forget to update COPYING and debian/copyright too
-license = "GPL-2.0-only AND LGPL-2.0-or-later AND MIT AND PSF-2.0"
+license.workspace = true
 homepage = "https://fishshell.com"
 readme = "README.rst"
 
diff --git a/build_tools/check.sh b/build_tools/check.sh
index 44fe9e03e..25886a4f4 100755
--- a/build_tools/check.sh
+++ b/build_tools/check.sh
@@ -70,6 +70,9 @@ template_file=$(mktemp)
     cargo build --workspace --all-targets --features=gettext-extract
 )
 if $lint; then
+    if command -v cargo-deny >/dev/null; then
+        cargo deny --all-features --locked --exclude-dev check licenses
+    fi
     PATH="$build_dir:$PATH" "$workspace_root/build_tools/style.fish" --all --check
     for features in "" --no-default-features; do
         cargo clippy --workspace --all-targets $features
diff --git a/crates/build-helper/Cargo.toml b/crates/build-helper/Cargo.toml
index d8d5a5ddd..e136a55ee 100644
--- a/crates/build-helper/Cargo.toml
+++ b/crates/build-helper/Cargo.toml
@@ -4,6 +4,7 @@ edition.workspace = true
 rust-version.workspace = true
 version = "0.0.0"
 repository.workspace = true
+license.workspace = true
 
 [dependencies]
 rsconf.workspace = true
diff --git a/crates/build-man-pages/Cargo.toml b/crates/build-man-pages/Cargo.toml
index fbd9dcf64..d7b19b032 100644
--- a/crates/build-man-pages/Cargo.toml
+++ b/crates/build-man-pages/Cargo.toml
@@ -4,6 +4,7 @@ edition.workspace = true
 rust-version.workspace = true
 version = "0.0.0"
 repository.workspace = true
+license.workspace = true
 
 [build-dependencies]
 fish-build-helper.workspace = true
diff --git a/crates/gettext-extraction/Cargo.toml b/crates/gettext-extraction/Cargo.toml
index 9da5033ec..043bb9aa4 100644
--- a/crates/gettext-extraction/Cargo.toml
+++ b/crates/gettext-extraction/Cargo.toml
@@ -4,6 +4,7 @@ edition.workspace = true
 rust-version.workspace = true
 version = "0.0.0"
 repository.workspace = true
+license.workspace = true
 description = "proc-macro for extracting strings for gettext translation"
 
 [lib]
diff --git a/crates/gettext-maps/Cargo.toml b/crates/gettext-maps/Cargo.toml
index bc474e9b2..691baa315 100644
--- a/crates/gettext-maps/Cargo.toml
+++ b/crates/gettext-maps/Cargo.toml
@@ -4,6 +4,7 @@ edition.workspace = true
 rust-version.workspace = true
 version = "0.0.0"
 repository.workspace = true
+license.workspace = true
 
 [dependencies]
 phf.workspace = true
diff --git a/crates/gettext-mo-file-parser/Cargo.toml b/crates/gettext-mo-file-parser/Cargo.toml
index bcfe07cfc..da47ed4b6 100644
--- a/crates/gettext-mo-file-parser/Cargo.toml
+++ b/crates/gettext-mo-file-parser/Cargo.toml
@@ -4,6 +4,7 @@ edition.workspace = true
 rust-version.workspace = true
 version = "0.0.0"
 repository.workspace = true
+license.workspace = true
 
 [lints]
 workspace = true
diff --git a/crates/tempfile/Cargo.toml b/crates/tempfile/Cargo.toml
index aafe04d43..9ce7256a7 100644
--- a/crates/tempfile/Cargo.toml
+++ b/crates/tempfile/Cargo.toml
@@ -4,6 +4,7 @@ edition.workspace = true
 rust-version.workspace = true
 version = "0.0.0"
 repository.workspace = true
+license.workspace = true
 
 [dependencies]
 nix = { workspace = true, features = ["fs", "feature"] }
diff --git a/updatecli.d/rust.yml b/updatecli.d/rust.yml
index fec0782cf..27dd65a83 100644
--- a/updatecli.d/rust.yml
+++ b/updatecli.d/rust.yml
@@ -29,6 +29,14 @@ targets:
       file: .github/actions/rust-toolchain/action.yml
       matchpattern: '\(stable\) echo \d+\.\d+ ;;.*'
       replacepattern: '(stable) echo {{ source "rust_stable_version" }} ;; # updatecli.d/rust.yml'
+  update_rust_stable2:
+    name: "Update Rust stable #2"
+    sourceid: rust_stable_version
+    kind: file
+    spec:
+      file: .github/workflows/lint-dependencies.yml
+      matchpattern: 'rust-version: \d+\.\d+\b.*'
+      replacepattern: 'rust-version: {{ source "rust_stable_version" }} # updatecli.d/rust.yml'
   update_msrv:
     name: "Update MSRV"
     sourceid: rust_stable_version