diff --git a/.github/workflows/rust.yaml b/.github/workflows/rust.yaml
index bd15268..2625ac9 100644
--- a/.github/workflows/rust.yaml
+++ b/.github/workflows/rust.yaml
@@ -37,3 +37,8 @@ jobs:
         run: |
           which cargo-tarpaulin || cargo install cargo-tarpaulin
           cargo tarpaulin
+
+      - name: Check licenses
+        run: |
+          which cargo-deny || cargo install cargo-deny
+          cargo deny check licenses
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 0000000..01ef02a
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,18 @@
+[licenses]
+allow = [
+    "Apache-2.0",
+    "MIT",
+    "MPL-2.0",
+    "BSD-3-Clause",
+    "Unicode-3.0",
+]
+
+[licenses.private]
+ignore = true
+
+[bans]
+multiple-versions = "warn"
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
diff --git a/githooks/pre-commit b/githooks/pre-commit
new file mode 100755
index 0000000..c6bd415
--- /dev/null
+++ b/githooks/pre-commit
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+if [ -n "$GIT_GLOBAL_HOOKS_PATH" -a -x "$GIT_GLOBAL_HOOKS_PATH/pre-commit" ]; then
+  $GIT_GLOBAL_HOOKS_PATH/pre-commit
+fi
diff --git a/githooks/pre-push b/githooks/pre-push
new file mode 100755
index 0000000..8c9b10d
--- /dev/null
+++ b/githooks/pre-push
@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+input="$(cat)"
+
+if [ -n "$GIT_GLOBAL_HOOKS_PATH" -a -x "$GIT_GLOBAL_HOOKS_PATH/pre-push" ]; then
+  echo -n "$input" | $GIT_GLOBAL_HOOKS_PATH/pre-push
+fi
diff --git a/githooks/pre-rebase b/githooks/pre-rebase
new file mode 100755
index 0000000..062c9fb
--- /dev/null
+++ b/githooks/pre-rebase
@@ -0,0 +1,7 @@
+#!/usr/bin/env bash
+
+set -xeuo pipefail
+
+if [ -n "$GIT_GLOBAL_HOOKS_PATH" -a -x "$GIT_GLOBAL_HOOKS_PATH/pre-rebase" ]; then
+  $GIT_GLOBAL_HOOKS_PATH/pre-rebase
+fi
diff --git a/shell.nix b/shell.nix
index 4c7183a..08fe00e 100644
--- a/shell.nix
+++ b/shell.nix
@@ -3,8 +3,11 @@ pkgs.mkShell {
   buildInputs = with pkgs; [
     rustup
     python3
+    podman
   ];
   shellHook = ''
+    git config set core.hooksPath githooks
+
     rustup default stable
     rustup component add rust-src
   '';
diff --git a/src/aes.rs b/src/aes.rs
index 44e3a72..d4bc36a 100644
--- a/src/aes.rs
+++ b/src/aes.rs
@@ -6,17 +6,14 @@
 // option. This file may not be copied, modified, or distributed
 // except according to those terms.
 
+use aes::cipher::{BlockDecryptMut, BlockEncryptMut, KeyIvInit, block_padding::Pkcs7};
 use rtoolbox::safe_vec::SafeVec;
-use aes::cipher::{block_padding::Pkcs7, BlockDecryptMut, BlockEncryptMut, KeyIvInit};
 
 type Aes256CbcEnc = cbc::Encryptor<aes::Aes256>;
 type Aes256CbcDec = cbc::Decryptor<aes::Aes256>;
 
 pub fn encrypt(data: &[u8], key: &[u8], iv: &[u8]) -> Result<Vec<u8>, ()> {
-    Ok(
-        Aes256CbcEnc::new(key.into(), iv.into())
-        .encrypt_padded_vec_mut::<Pkcs7>(data)
-    )
+    Ok(Aes256CbcEnc::new(key.into(), iv.into()).encrypt_padded_vec_mut::<Pkcs7>(data))
 }
 
 pub fn decrypt(data: &[u8], key: &[u8], iv: &[u8]) -> Result<SafeVec, ()> {
diff --git a/src/commands/add.rs b/src/commands/add.rs
index 4a22689..7eb974b 100644
--- a/src/commands/add.rs
+++ b/src/commands/add.rs
@@ -1,7 +1,7 @@
 use crate::clip::{copy_to_clipboard, paste_keys};
-use crate::password;
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::password;
 use std::ops::Deref;
 
 pub fn callback_exec(
diff --git a/src/commands/change.rs b/src/commands/change.rs
index 498ec22..215826b 100644
--- a/src/commands/change.rs
+++ b/src/commands/change.rs
@@ -1,9 +1,9 @@
 use crate::clip;
 use crate::ffi;
-use crate::list;
-use crate::password;
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::list;
+use crate::password;
 
 pub fn callback_exec(
     matches: &clap::ArgMatches,
diff --git a/src/commands/delete.rs b/src/commands/delete.rs
index df8e1db..3ce5095 100644
--- a/src/commands/delete.rs
+++ b/src/commands/delete.rs
@@ -1,7 +1,7 @@
-use crate::list;
-use crate::password;
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::list;
+use crate::password;
 
 pub fn callback_exec(
     matches: &clap::ArgMatches,
diff --git a/src/commands/generate.rs b/src/commands/generate.rs
index 8108186..033f7c9 100644
--- a/src/commands/generate.rs
+++ b/src/commands/generate.rs
@@ -1,8 +1,8 @@
 use crate::clip::{copy_to_clipboard, paste_keys};
-use crate::generate::{check_password_len, PasswordSpec};
-use crate::password;
+use crate::generate::{PasswordSpec, check_password_len};
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::password;
 
 use std::ops::Deref;
 
diff --git a/src/commands/get.rs b/src/commands/get.rs
index 8abf5df..5c5a73e 100644
--- a/src/commands/get.rs
+++ b/src/commands/get.rs
@@ -1,8 +1,8 @@
 use crate::clip;
 
+use crate::io::CliInputOutput;
 use crate::list;
 use crate::password;
-use crate::io::CliInputOutput;
 
 pub fn callback_exec(
     matches: &clap::ArgMatches,
diff --git a/src/commands/list.rs b/src/commands/list.rs
index 98c0343..ce9d360 100644
--- a/src/commands/list.rs
+++ b/src/commands/list.rs
@@ -1,7 +1,7 @@
-use crate::list;
-use crate::password;
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::list;
+use crate::password;
 
 pub fn callback_exec(
     _matches: &clap::ArgMatches,
diff --git a/src/commands/regenerate.rs b/src/commands/regenerate.rs
index 312301e..ef20792 100644
--- a/src/commands/regenerate.rs
+++ b/src/commands/regenerate.rs
@@ -1,10 +1,10 @@
 use crate::clip;
 use crate::ffi;
-use crate::generate::{check_password_len, PasswordSpec};
-use crate::list;
-use crate::password;
+use crate::generate::{PasswordSpec, check_password_len};
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::list;
+use crate::password;
 
 pub fn callback_exec(
     matches: &clap::ArgMatches,
diff --git a/src/commands/rename.rs b/src/commands/rename.rs
index 55e9390..2ac02d7 100644
--- a/src/commands/rename.rs
+++ b/src/commands/rename.rs
@@ -1,8 +1,8 @@
 use crate::ffi;
-use crate::list;
-use crate::password;
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::list;
+use crate::password;
 
 pub fn callback_exec(
     matches: &clap::ArgMatches,
diff --git a/src/commands/set_master_password.rs b/src/commands/set_master_password.rs
index d2d4443..871c04d 100644
--- a/src/commands/set_master_password.rs
+++ b/src/commands/set_master_password.rs
@@ -1,6 +1,6 @@
-use crate::password;
 use crate::io::CliInputOutput;
 use crate::io::OutputType;
+use crate::password;
 use std::ops::Deref;
 
 pub fn callback_exec(
diff --git a/src/main.rs b/src/main.rs
index d2a2d34..d2398dd 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -39,12 +39,7 @@ fn main() {
 
     std::process::exit(rooster::main_with_args(
         args_refs.as_slice(),
-        &mut RegularInputOutput::new(
-            stdin.lock(),
-            stdout.lock(),
-            stderr.lock(),
-            false,
-        ),
+        &mut RegularInputOutput::new(stdin.lock(), stdout.lock(), stderr.lock(), false),
         &rooster_file_path,
     ));
 }
diff --git a/src/quale.rs b/src/quale.rs
index 9e1f93a..c8316a1 100644
--- a/src/quale.rs
+++ b/src/quale.rs
@@ -10,7 +10,7 @@
 // https://crates.io/crates/quale
 // It has been modified here to support Windows.
 
-use std::{env, ffi, path, fs};
+use std::{env, ffi, fs, path};
 
 pub fn which<S: AsRef<ffi::OsStr>>(name: S) -> Option<path::PathBuf> {
     let name: &ffi::OsStr = name.as_ref();
@@ -39,14 +39,19 @@ pub fn which<S: AsRef<ffi::OsStr>>(name: S) -> Option<path::PathBuf> {
 #[cfg(windows)]
 mod windows {
     use std::fs;
+    use std::os::windows::ffi::OsStrExt;
     use std::ptr::null_mut;
-    use windows::core::PCWSTR;
-    use windows::Win32::System::WindowsProgramming::{SCS_32BIT_BINARY, SCS_64BIT_BINARY, SCS_DOS_BINARY, SCS_OS216_BINARY, SCS_PIF_BINARY, SCS_POSIX_BINARY, SCS_WOW_BINARY};
     use windows::Win32::Storage::FileSystem::GetBinaryTypeW;
-    use std::os::windows::ffi::OsStrExt;
+    use windows::Win32::System::WindowsProgramming::{
+        SCS_32BIT_BINARY, SCS_64BIT_BINARY, SCS_DOS_BINARY, SCS_OS216_BINARY, SCS_PIF_BINARY,
+        SCS_POSIX_BINARY, SCS_WOW_BINARY,
+    };
+    use windows::core::PCWSTR;
 
     pub fn is_executable(file: &fs::DirEntry) -> bool {
-        let windows_str = file.path().as_os_str()
+        let windows_str = file
+            .path()
+            .as_os_str()
             .encode_wide()
             .chain(std::iter::once(0))
             .collect::<Vec<u16>>();
@@ -67,17 +72,18 @@ mod windows {
         }
 
         match binary_type {
-            SCS_32BIT_BINARY | SCS_64BIT_BINARY | SCS_DOS_BINARY | SCS_OS216_BINARY | SCS_PIF_BINARY | SCS_POSIX_BINARY | SCS_WOW_BINARY => true,
-            _ => false
+            SCS_32BIT_BINARY | SCS_64BIT_BINARY | SCS_DOS_BINARY | SCS_OS216_BINARY
+            | SCS_PIF_BINARY | SCS_POSIX_BINARY | SCS_WOW_BINARY => true,
+            _ => false,
         }
     }
 }
 
 #[cfg(unix)]
 mod unix {
-    use std::os::unix::fs::PermissionsExt;
-    use std::fs;
     use std::ffi;
+    use std::fs;
+    use std::os::unix::fs::PermissionsExt;
 
     pub fn is_executable(file: &fs::DirEntry) -> bool {
         // Don't use `file.metadata()` directly since it doesn't follow symlinks.
diff --git a/tests/test-commands-add.rs b/tests/test-commands-add.rs
index e1c94ba..bea279e 100644
--- a/tests/test-commands-add.rs
+++ b/tests/test-commands-add.rs
@@ -18,7 +18,7 @@ fn test_command_add() {
     let result = main_with_args(
         &["rooster", "add", "-s", "Youtube", "yt@example.com"],
         &mut inout,
-        &rooster_file
+        &rooster_file,
     );
     assert_eq!(0, result);