diff --git a/.cargo/deny.toml b/.cargo/deny.toml
new file mode 100644
index 000000000..6990965fb
--- /dev/null
+++ b/.cargo/deny.toml
@@ -0,0 +1,72 @@
+[licenses]
+allow = [
+  "0BSD",
+  "Apache-2.0 WITH LLVM-exception",
+  "Apache-2.0",
+  "BSD-3-Clause",
+  "CC0-1.0",
+  "CDLA-Permissive-2.0",
+  "ISC",
+  "MIT",
+  "MPL-2.0",
+  "Unicode-3.0",
+  "Zlib",
+]
+
+# NSS modules must link libnss; ak-nss is dynamically loaded by glibc.
+[[licenses.exceptions]]
+crate = "libnss"
+allow = ["LGPL-3.0"]
+
+[licenses.private]
+ignore = true
+
+[bans]
+multiple-versions = "allow"
+wildcards = "deny"
+allow-wildcard-paths = true
+[bans.workspace-dependencies]
+duplicates = "deny"
+include-path-dependencies = true
+unused = "deny"
+
+# No non-FIPS compliant dependencies
+[[bans.deny]]
+name = "native-tls"
+[[bans.deny]]
+name = "openssl"
+[[bans.deny]]
+name = "openssl-sys"
+[[bans.deny]]
+name = "ring"
+# Only reachable via ureq's `rustls` feature, a build-dependency of osquery-sys
+# used to download a checksum-pinned prebuilt bundle. Remove once osquery-rs
+# switches ureq to `rustls-no-provider` + aws-lc-rs.
+wrappers = ["rustls", "rustls-webpki"]
+[[bans.features]]
+allow = [
+  "alloc",
+  "aws-lc-sys",
+  "default",
+  "prebuilt-nasm",
+  "ring-io",
+  "ring-sig-verify",
+]
+name = "aws-lc-rs"
+exact = true
+
+[advisories]
+ignore = [
+  { id = "RUSTSEC-2023-0071", reason = "rsa (via ssh-key) is only used to verify RSA host keys; all private keys are Ed25519, so no RSA private-key operations are exposed to the Marvin timing side channel" },
+  { id = "RUSTSEC-2024-0436", reason = "paste is a proc-macro dependency of libnss (ak-nss); no maintained alternative upstream" },
+  { id = "RUSTSEC-2024-0370", reason = "proc-macro-error is pulled in by gtk-rs 0.18 via tauri on Linux; remove when tauri moves to gtk4" },
+  { id = "RUSTSEC-2026-0370", reason = "zvariant was merged into zbus 6; tauri plugins and secret-service still depend on zbus 5" },
+  { id = "RUSTSEC-2026-0371", reason = "zbus_names was merged into zbus 6; tauri plugins and secret-service still depend on zbus 5" },
+  { id = "RUSTSEC-2026-0372", reason = "zvariant_derive was merged into zbus 6; tauri plugins and secret-service still depend on zbus 5" },
+]
+
+[sources]
+allow-git = [
+  "https://github.com/BeryJu/osquery-rs",
+  "https://github.com/goauthentik/client-rust",
+]
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 5448f366b..b30b62960 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -148,6 +148,10 @@ jobs:
       - uses: ./.github/actions/setup-toolchain
         with:
           platform: ${{ matrix.platform }}
+      # see test_rs: must not overlap with setup-rust-toolchain
+      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2
+        with:
+          tool: cargo-deny
       - run: make lint-rs-ci
   lint_js:
     name: Lint
diff --git a/Cargo.lock b/Cargo.lock
index e0a9b7349..43247bd61 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -318,8 +318,8 @@ dependencies = [
  "env_filter",
  "eventlog",
  "eyre",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
  "hyper-util",
  "interprocess",
@@ -891,6 +891,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b281d307588d634de920874890732659e2e7672f72b5e10e81badc1a8a83621e"
 dependencies = [
  "aws-lc-sys",
+ "untrusted 0.7.1",
  "zeroize",
 ]
 
@@ -924,8 +925,8 @@ dependencies = [
  "bytes",
  "bytes-utils",
  "fastrand",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "percent-encoding",
  "pin-project-lite",
  "tracing",
@@ -953,7 +954,7 @@ dependencies = [
  "aws-smithy-xml",
  "aws-types",
  "fastrand",
- "http 1.5.0",
+ "http",
  "regex-lite",
  "tracing",
 ]
@@ -969,18 +970,14 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "crypto-bigint",
  "form_urlencoded",
  "hex",
  "hmac 0.13.0",
- "http 1.5.0",
- "p256",
+ "http",
  "percent-encoding",
  "sha2 0.11.1",
- "subtle",
  "time",
  "tracing",
- "zeroize",
 ]
 
 [[package]]
@@ -1006,8 +1003,8 @@ dependencies = [
  "bytes-utils",
  "futures-core",
  "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
  "percent-encoding",
  "pin-project-lite",
@@ -1024,23 +1021,17 @@ dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "h2 0.3.27",
- "h2 0.4.19",
- "http 0.2.12",
- "http 1.5.0",
- "http-body 0.4.6",
- "hyper 0.14.32",
- "hyper 1.11.1",
- "hyper-rustls 0.24.2",
- "hyper-rustls 0.27.10",
+ "h2",
+ "http",
+ "hyper",
+ "hyper-rustls",
  "hyper-util",
  "pin-project-lite",
- "rustls 0.21.12",
- "rustls 0.23.45",
+ "rustls",
  "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
- "tokio-rustls 0.26.6",
+ "tokio-rustls",
  "tower",
  "tracing",
 ]
@@ -1093,8 +1084,8 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "fastrand",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
  "pin-project-lite",
  "pin-utils",
@@ -1112,8 +1103,7 @@ dependencies = [
  "aws-smithy-runtime-api-macros",
  "aws-smithy-types",
  "bytes",
- "http 0.2.12",
- "http 1.5.0",
+ "http",
  "pin-project-lite",
  "tokio",
  "tracing",
@@ -1139,7 +1129,7 @@ checksum = "e8f395d93304280b64b7632fea798d177e74897fe7f063416ce627cd6fa24829"
 dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
- "http 1.5.0",
+ "http",
 ]
 
 [[package]]
@@ -1152,10 +1142,8 @@ dependencies = [
  "bytes",
  "bytes-utils",
  "futures-core",
- "http 0.2.12",
- "http 1.5.0",
- "http-body 0.4.6",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
  "itoa",
  "num-integer",
@@ -1204,8 +1192,8 @@ dependencies = [
  "axum-core",
  "bytes",
  "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
  "itoa",
  "matchit",
@@ -1228,8 +1216,8 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
  "mime",
  "pin-project-lite",
@@ -1403,18 +1391,18 @@ dependencies = [
  "futures-util",
  "hex",
  "home",
- "http 1.5.0",
+ "http",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper",
  "hyper-named-pipe",
- "hyper-rustls 0.27.10",
+ "hyper-rustls",
  "hyper-util",
  "hyperlocal",
  "log",
  "num",
  "pin-project-lite",
  "rand 0.10.3",
- "rustls 0.23.45",
+ "rustls",
  "rustls-native-certs",
  "rustls-pki-types",
  "serde",
@@ -2220,6 +2208,7 @@ checksum = "73e2cee48715b2a8fae3739aeb8433817051a6772562ba67f9b631fc833eb793"
 dependencies = [
  "aes",
  "anyhow",
+ "aws-lc-rs",
  "base64 0.23.1",
  "byteorder",
  "cbc",
@@ -2228,7 +2217,6 @@ dependencies = [
  "hidapi",
  "num",
  "pad",
- "ring",
  "strum",
  "strum_macros",
  "x509-parser",
@@ -2266,7 +2254,6 @@ dependencies = [
  "fiat-crypto",
  "rustc_version",
  "subtle",
- "zeroize",
 ]
 
 [[package]]
@@ -2702,7 +2689,6 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8",
  "signature",
 ]
 
@@ -2714,10 +2700,8 @@ checksum = "70e796c081cee67dc755e1a36a0a172b897fab85fc3f6bc48307991f64e4eca9"
 dependencies = [
  "curve25519-dalek",
  "ed25519",
- "serde",
  "sha2 0.10.9",
  "subtle",
- "zeroize",
 ]
 
 [[package]]
@@ -2739,7 +2723,6 @@ dependencies = [
  "ff",
  "generic-array",
  "group",
- "hkdf 0.12.4",
  "pem-rfc7468",
  "pkcs8",
  "rand_core 0.6.4",
@@ -2837,7 +2820,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -3557,25 +3540,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "h2"
-version = "0.3.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0beca50380b1fc32983fc1cb4587bfa4bb9e78fc259aad4a0032d2080309222d"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap 2.14.2",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.19"
@@ -3587,7 +3551,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.5.0",
+ "http",
  "indexmap 2.14.2",
  "slab",
  "tokio",
@@ -3695,15 +3659,6 @@ dependencies = [
  "windows-sys 0.61.2",
 ]
 
-[[package]]
-name = "hkdf"
-version = "0.12.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7b5f8eb2ad728638ea2c7d47a21db23b7b58a72ed6a38256b8a1849f15fbbdf7"
-dependencies = [
- "hmac 0.12.1",
-]
-
 [[package]]
 name = "hkdf"
 version = "0.13.0"
@@ -3761,17 +3716,6 @@ dependencies = [
  "markup5ever",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.5.0"
@@ -3782,17 +3726,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
 [[package]]
 name = "http-body"
 version = "1.1.0"
@@ -3800,7 +3733,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ca2a8f2913ee65f60facd6a5905613afaa448497a0230cc41ce022d93290bc2c"
 dependencies = [
  "bytes",
- "http 1.5.0",
+ "http",
 ]
 
 [[package]]
@@ -3811,8 +3744,8 @@ checksum = "23169fe34a5fbcdd3f3862e78fb9b6fccd5f02a6dc6f732547005d45631ce71c"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -3839,9 +3772,9 @@ dependencies = [
  "crossbeam-channel",
  "form_urlencoded",
  "futures",
- "http 1.5.0",
+ "http",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper",
  "hyper-util",
  "log",
  "once_cell",
@@ -3861,30 +3794,6 @@ dependencies = [
  "typenum",
 ]
 
-[[package]]
-name = "hyper"
-version = "0.14.32"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "41dfc780fdec9373c01bae43289ea34c972e40ee3c9f6b3c8801a35f35586ce7"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.27",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2 0.5.10",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
 [[package]]
 name = "hyper"
 version = "1.11.1"
@@ -3895,9 +3804,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-core",
- "h2 0.4.19",
- "http 1.5.0",
- "http-body 1.1.0",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
@@ -3914,41 +3823,26 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fab3637d6b04a8037af8a266fdf6cf92ea957e8c53981a2bf6136572531025bf"
 dependencies = [
  "hex",
- "hyper 1.11.1",
+ "hyper",
  "hyper-util",
  "pin-project-lite",
  "tokio",
  "tower-service",
 ]
 
-[[package]]
-name = "hyper-rustls"
-version = "0.24.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec3efd23720e2049821a693cbc7e65ea87c72f1c58ff2f9522ff332b1491e590"
-dependencies = [
- "futures-util",
- "http 0.2.12",
- "hyper 0.14.32",
- "log",
- "rustls 0.21.12",
- "tokio",
- "tokio-rustls 0.24.1",
-]
-
 [[package]]
 name = "hyper-rustls"
 version = "0.27.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dfa8e654703247911e29c23fbeaa261834bd9bb74efba2f9acddc37bfb127f53"
 dependencies = [
- "http 1.5.0",
- "hyper 1.11.1",
+ "http",
+ "hyper",
  "hyper-util",
- "rustls 0.23.45",
+ "rustls",
  "rustls-native-certs",
  "tokio",
- "tokio-rustls 0.26.6",
+ "tokio-rustls",
  "tower-service",
 ]
 
@@ -3958,7 +3852,7 @@ version = "0.5.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b90d566bffbce6a75bd8b09a05aa8c2cb1fabb6cb348f8840c9e4c90a0d83b0"
 dependencies = [
- "hyper 1.11.1",
+ "hyper",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -3975,10 +3869,10 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "httparse",
- "hyper 1.11.1",
+ "hyper",
  "ipnet",
  "libc",
  "percent-encoding",
@@ -3997,7 +3891,7 @@ checksum = "986c5ce3b994526b3cd75578e62554abd09f0899d6206de48b3e96ab34ccc8c7"
 dependencies = [
  "hex",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper",
  "hyper-util",
  "pin-project-lite",
  "tokio",
@@ -4520,19 +4414,13 @@ version = "11.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e75fe14a82d81e5f5af639997db37d8b96045938a7ac6ab18cdbe1c7467e05e1"
 dependencies = [
+ "aws-lc-rs",
  "base64 0.22.1",
- "ed25519-dalek",
  "getrandom 0.2.17",
- "hmac 0.12.1",
  "js-sys",
- "p256",
- "p384",
  "pem",
- "rand 0.8.8",
- "rsa",
  "serde",
  "serde_json",
- "sha2 0.10.9",
  "signature",
  "simple_asn1",
  "zeroize",
@@ -5274,7 +5162,7 @@ dependencies = [
  "base64 0.22.1",
  "chrono",
  "getrandom 0.2.17",
- "http 1.5.0",
+ "http",
  "rand 0.8.8",
  "serde",
  "serde_json",
@@ -6418,7 +6306,7 @@ dependencies = [
  "quinn-proto",
  "quinn-udp",
  "rustc-hash",
- "rustls 0.23.45",
+ "rustls",
  "socket2 0.5.10",
  "thiserror 2.0.21",
  "tokio",
@@ -6440,7 +6328,7 @@ dependencies = [
  "rand_pcg",
  "ring",
  "rustc-hash",
- "rustls 0.23.45",
+ "rustls",
  "rustls-pki-types",
  "slab",
  "thiserror 2.0.21",
@@ -6460,7 +6348,7 @@ dependencies = [
  "once_cell",
  "socket2 0.5.10",
  "tracing",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -6769,11 +6657,11 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.11.1",
- "hyper-rustls 0.27.10",
+ "hyper",
+ "hyper-rustls",
  "hyper-util",
  "js-sys",
  "log",
@@ -6781,7 +6669,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "quinn",
- "rustls 0.23.45",
+ "rustls",
  "rustls-pki-types",
  "rustls-platform-verifier",
  "serde",
@@ -6789,7 +6677,7 @@ dependencies = [
  "serde_urlencoded",
  "sync_wrapper",
  "tokio",
- "tokio-rustls 0.26.6",
+ "tokio-rustls",
  "tokio-util",
  "tower",
  "tower-http 0.6.11",
@@ -6809,7 +6697,7 @@ checksum = "07bc3f1384cffa4f274dad2d4ddd73aed32fed8f786d96c6be8aa4e5fd3c3b58"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 1.5.0",
+ "http",
  "reqwest",
  "serde",
  "thiserror 2.0.21",
@@ -6848,7 +6736,7 @@ dependencies = [
  "cfg-if",
  "getrandom 0.2.17",
  "libc",
- "untrusted",
+ "untrusted 0.9.0",
  "windows-sys 0.52.0",
 ]
 
@@ -7005,33 +6893,21 @@ dependencies = [
  "errno",
  "libc",
  "linux-raw-sys",
- "windows-sys 0.52.0",
-]
-
-[[package]]
-name = "rustls"
-version = "0.21.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f56a14d1f48b391359b22f731fd4bd7e43c97f3c50eee276f3aa09c94784d3e"
-dependencies = [
- "log",
- "ring",
- "rustls-webpki 0.101.7",
- "sct",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
 name = "rustls"
-version = "0.23.45"
+version = "0.23.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d41d731c7d2f962d1ccc364cec258de3c0e93b38c2fb3ba97ac74513048d634"
+checksum = "48e13bd8c0e9365c43cfa5c9e8f9ad49d3c8444926c9aac819e0e4dc503c8fdf"
 dependencies = [
  "aws-lc-rs",
  "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
- "rustls-webpki 0.103.15",
+ "rustls-webpki",
  "subtle",
  "zeroize",
 ]
@@ -7069,14 +6945,14 @@ dependencies = [
  "jni 0.22.4",
  "log",
  "once_cell",
- "rustls 0.23.45",
+ "rustls",
  "rustls-native-certs",
  "rustls-platform-verifier-android",
- "rustls-webpki 0.103.15",
+ "rustls-webpki",
  "security-framework",
  "security-framework-sys",
  "webpki-root-certs",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -7087,24 +6963,14 @@ checksum = "eec689c0bc40ff2458a5977b6619cb718087084a18e02a131c599b62d05e1a5f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.101.7"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8b6275d1ee7a1cd780b64aca7726599a1dbc893b1e64144529e55c3c2f745765"
-dependencies = [
- "ring",
- "untrusted",
-]
-
-[[package]]
-name = "rustls-webpki"
-version = "0.103.15"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f3c3cf1d8b1e7d4927e2d154c3fcb02979afb9939629c62cd9048d4f07b60ac2"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "aws-lc-rs",
  "ring",
  "rustls-pki-types",
- "untrusted",
+ "untrusted 0.9.0",
 ]
 
 [[package]]
@@ -7228,16 +7094,6 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "sct"
-version = "0.7.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "da046153aa2352493d6cb7da4b6e5c0c057d8a1d0a9aa8560baffdd945acd414"
-dependencies = [
- "ring",
- "untrusted",
-]
-
 [[package]]
 name = "sec1"
 version = "0.7.3"
@@ -7272,7 +7128,7 @@ dependencies = [
  "cbc",
  "futures-util",
  "getrandom 0.4.3",
- "hkdf 0.13.0",
+ "hkdf",
  "hybrid-array",
  "num",
  "once_cell",
@@ -7342,7 +7198,7 @@ dependencies = [
  "cfg_aliases",
  "httpdate",
  "reqwest",
- "rustls 0.23.45",
+ "rustls",
  "sentry-backtrace",
  "sentry-contexts",
  "sentry-core",
@@ -7431,7 +7287,7 @@ version = "0.49.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "624ee2c60caf72fa2cd6be00334b3a3ce0c6df3b1f01941ea62e3d244492d334"
 dependencies = [
- "http 1.5.0",
+ "http",
  "pin-project",
  "sentry-core",
  "tower-layer",
@@ -8309,7 +8165,7 @@ dependencies = [
  "glob",
  "gtk",
  "heck 0.5.0",
- "http 1.5.0",
+ "http",
  "jni 0.21.1",
  "libc",
  "log",
@@ -8527,7 +8383,7 @@ dependencies = [
  "cookie",
  "dpi",
  "gtk",
- "http 1.5.0",
+ "http",
  "jni 0.21.1",
  "objc2",
  "objc2-ui-kit",
@@ -8550,7 +8406,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8d61892587aea2a85245bcaec98c6fe46268874c0a0deae5535fb71ca7b93eae"
 dependencies = [
  "gtk",
- "http 1.5.0",
+ "http",
  "jni 0.21.1",
  "log",
  "objc2",
@@ -8582,7 +8438,7 @@ dependencies = [
  "dom_query",
  "dunce",
  "glob",
- "http 1.5.0",
+ "http",
  "infer",
  "json-patch",
  "log",
@@ -8625,10 +8481,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "32497e9a4c7b38532efcdebeef879707aa9f794296a4f0244f6f69e9bc8574bd"
 dependencies = [
  "fastrand",
- "getrandom 0.4.3",
+ "getrandom 0.3.4",
  "once_cell",
  "rustix",
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -8740,7 +8596,7 @@ dependencies = [
  "etcetera",
  "ferroid",
  "futures",
- "http 1.5.0",
+ "http",
  "itertools",
  "log",
  "memchr",
@@ -8910,23 +8766,13 @@ dependencies = [
  "syn 3.0.9",
 ]
 
-[[package]]
-name = "tokio-rustls"
-version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
-dependencies = [
- "rustls 0.21.12",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.26.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9cc2678c2cdd569ef8215e2afd7954ada2ae20b4fdd2c5fe6139a3b02d105db"
 dependencies = [
- "rustls 0.23.45",
+ "rustls",
  "tokio",
 ]
 
@@ -9061,11 +8907,11 @@ dependencies = [
  "axum",
  "base64 0.22.1",
  "bytes",
- "h2 0.4.19",
- "http 1.5.0",
- "http-body 1.1.0",
+ "h2",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper",
  "hyper-timeout",
  "hyper-util",
  "percent-encoding",
@@ -9119,8 +8965,8 @@ dependencies = [
  "bitflags 2.13.2",
  "bytes",
  "futures-util",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "pin-project-lite",
  "tower",
  "tower-layer",
@@ -9136,8 +8982,8 @@ checksum = "08a05a66a4fdd61cbbe0a1d755ffe0ca6aba159dd4820936a0ff8a8278245b9c"
 dependencies = [
  "bitflags 2.13.2",
  "bytes",
- "http 1.5.0",
- "http-body 1.1.0",
+ "http",
+ "http-body",
  "percent-encoding",
  "pin-project-lite",
  "tower-layer",
@@ -9341,6 +9187,12 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b4ac048d71ede7ee76d585517add45da530660ef4390e49b098733c6e897f254"
 
+[[package]]
+name = "untrusted"
+version = "0.7.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a156c684c91ea7d62626509bce3cb4e1d9ed5c4d978f7b4352658f96a4c26b4a"
+
 [[package]]
 name = "untrusted"
 version = "0.9.0"
@@ -9356,7 +9208,7 @@ dependencies = [
  "base64 0.23.1",
  "log",
  "percent-encoding",
- "rustls 0.23.45",
+ "rustls",
  "rustls-pki-types",
  "ureq-proto",
  "utf8-zero",
@@ -9370,7 +9222,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f86fd172ccca569e458f61b6bdd6220965a9ef36e672a6852953b51a0e1583be"
 dependencies = [
  "base64 0.23.1",
- "http 1.5.0",
+ "http",
  "httparse",
  "log",
 ]
@@ -9704,18 +9556,18 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b96554aa2acc8ccdb7e1c9a58a7a68dd5d13bccc69cd124cb09406db612a1c9b"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]
 
 [[package]]
 name = "webpki-roots"
-version = "1.0.9"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+checksum = "1c1c8e20c8a38fc7d65abfe74eb7280e4aa667e8eec8bc84996d2874810748d9"
 dependencies = [
  "rustls-pki-types",
 ]
@@ -9867,7 +9719,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.52.0",
+ "windows-sys 0.60.2",
 ]
 
 [[package]]
@@ -10381,9 +10233,9 @@ dependencies = [
  "base64 0.22.1",
  "deadpool",
  "futures",
- "http 1.5.0",
+ "http",
  "http-body-util",
- "hyper 1.11.1",
+ "hyper",
  "hyper-util",
  "log",
  "once_cell",
@@ -10437,7 +10289,7 @@ dependencies = [
  "dunce",
  "gdkx11",
  "gtk",
- "http 1.5.0",
+ "http",
  "javascriptcore-rs",
  "jni 0.21.1",
  "libc",
diff --git a/Cargo.toml b/Cargo.toml
index 13fc1df11..c2621e9cd 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -30,6 +30,7 @@ members = [
 version = "0.72.1"
 edition = "2024"
 license = "MIT"
+publish = false
 
 [workspace.lints.clippy]
 panic = "deny"
@@ -42,8 +43,14 @@ split-debuginfo = "packed"
 strip = "debuginfo"
 
 [workspace.dependencies]
+ak-agent = { path = "ak-agent" }
 ak-api-cli = { path = "ak-api-cli" }
 ak-api-cli-gen = { path = "ak-api-cli-gen" }
+ak-ee-wcp-wire = { path = "ee/wcp/wire" }
+ak-flow-executor = { path = "ak-flow-executor" }
+ak-meta = { path = "ak-meta" }
+ak-platform = { path = "ak-platform" }
+ak-platform-keyring = { path = "ak-platform-keyring" }
 authentik-client = { git = "https://github.com/goauthentik/client-rust", rev = "d608f835c32c64346ebeb199cb48810080890123", version = "2026.11.0-rc1", default-features = false, features = [
     "rustls",
 ] }
@@ -57,7 +64,6 @@ pbjson = "0.9.0"
 pbjson-types = "0.9.0"
 psl = "2"
 sentry = { version = "0.49.0", default-features = false, features = ["backtrace", "contexts", "debug-images", "panic", "reqwest", "rustls", "tower", "tracing"] }
-sentry_eyre = "0.3"
 serde = { version = "1.0.228", features = ["derive"] }
 serde_json = "1.0.150"
 ssh-agent-lib = "0.6.0"
@@ -75,10 +81,29 @@ tracing-subscriber = "0.3"
 tempfile = "3"
 sha2 = "0.11"
 hex = "0.4"
+base64 = "0.23.0"
+clap_complete = "4"
+core-foundation = "0.10"
+ctor = "1.0.7"
+dtor = "1.0.5"
+httptest = "0.16"
+jsonwebtoken = { version = "11", features = ["aws_lc_rs"] }
+libc = "0.2.186"
+proc-macro2 = "1"
+prost = "0.14"
+quote = "1"
+reqwest-middleware = "0.5.2"
+sentry-tower = "0.49.0"
+ssh-key = "0.6"
+syn = "3"
+sysinfo = { version = "0.39.6", default-features = false }
+tauri = "2"
+tauri-build = "2"
+tokio-util = "0.7"
+tower-http = "0.7.0"
+windows_exe_info = "0.5.2"
+zbus = "5"
 winreg = { version = "0.56", features = ["serialization-serde"] }
-# Shared by the ee/wcp crates only. Deliberately older than the 0.62 that
-# ak-sysd pins inline: the credential-provider code is written against 0.61's
-# `#[implement]` and UI::Shell surface. Both resolve side by side.
 windows-core = "0.62"
 windows = { version = "0.62", features = [
     "Win32_Foundation",
diff --git a/Makefile b/Makefile
index 63b218f60..f773e69fa 100644
--- a/Makefile
+++ b/Makefile
@@ -82,6 +82,7 @@ lint-rs-ci:
 		${RS_LINT_EXCLUDE} \
 		${RS_TEST_FLAGS} \
 		-- -D warnings
+	cargo deny --config "${PWD}/.cargo/deny.toml" --locked --workspace check
 
 lint-spellcheck:
 	pnpm install
diff --git a/ak-agent-desktop/src-tauri/Cargo.toml b/ak-agent-desktop/src-tauri/Cargo.toml
index 6689a3adb..150e22034 100644
--- a/ak-agent-desktop/src-tauri/Cargo.toml
+++ b/ak-agent-desktop/src-tauri/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-agent-desktop"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lib]
 # The `_lib` suffix may seem redundant but it is necessary
@@ -12,20 +13,20 @@ name = "ak_agent_desktop_lib"
 crate-type = ["staticlib", "cdylib", "rlib"]
 
 [build-dependencies]
-tauri-build = { version = "2", features = [] }
+tauri-build = { workspace = true }
 
 [dependencies]
-ak-agent = { path = "../../ak-agent" }
+ak-agent = { workspace = true }
 eyre = { workspace = true }
 hex = { workspace = true }
-ak-platform = { path = "../../ak-platform" }
-ak-platform-keyring = { path = "../../ak-platform-keyring" }
-ak-meta = { path = "../../ak-meta" }
+ak-platform = { workspace = true }
+ak-platform-keyring = { workspace = true }
+ak-meta = { workspace = true }
 authentik-client = { workspace = true }
 tracing = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
-tauri = { version = "2", features = ["tray-icon"] }
+tauri = { workspace = true, features = ["tray-icon"] }
 tauri-plugin-deep-link = "2"
 tauri-plugin-opener = "2"
 tauri-plugin-os = "2"
diff --git a/ak-agent/Cargo.toml b/ak-agent/Cargo.toml
index a6c56969e..29bad5357 100644
--- a/ak-agent/Cargo.toml
+++ b/ak-agent/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-agent"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
@@ -12,31 +13,31 @@ name = "ak-agent"
 path = "src/main.rs"
 
 [dependencies]
-ak-meta = { path = "../ak-meta" }
-ak-platform = { path = "../ak-platform" }
+ak-meta = { workspace = true }
+ak-platform = { workspace = true }
 ak-platform-authz = { path = "../ak-platform-authz" }
-ak-platform-keyring = { path = "../ak-platform-keyring" }
+ak-platform-keyring = { workspace = true }
 authentik-client = { workspace = true }
 chrono = { workspace = true }
 eyre = { workspace = true }
 hex = { workspace = true }
-jsonwebtoken = { version = "11", features = ["rust_crypto"] }
+jsonwebtoken = { workspace = true }
 oauth2 = { workspace = true }
 pbjson-types = { workspace = true }
 reqwest = { workspace = true }
-reqwest-middleware = "0.5.2"
+reqwest-middleware = { workspace = true }
 sentry = { workspace = true }
-sentry-tower = { version = "0.49.0", features = ["http"] }
+sentry-tower = { workspace = true, features = ["http"] }
 serde = { workspace = true }
 sha2 = { workspace = true }
 signature = "2"
 ssh-agent-lib = { workspace = true }
 ssh-encoding = "0.3"
-ssh-key = { version = "0.6", features = ["ed25519", "getrandom", "std"] }
+ssh-key = { workspace = true, features = ["ed25519", "getrandom", "std"] }
 tokio = { workspace = true }
 tonic = { workspace = true }
 tonic-prost = { workspace = true }
-tower-http = { version = "0.7.0", features = ["trace"] }
+tower-http = { workspace = true, features = ["trace"] }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
 url = { workspace = true }
@@ -44,7 +45,7 @@ uuid = { workspace = true }
 waitgroup = "0.1.2"
 
 [build-dependencies]
-windows_exe_info = "0.5.2"
+windows_exe_info = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }
diff --git a/ak-api-cli-gen/Cargo.toml b/ak-api-cli-gen/Cargo.toml
index 7a1ece40d..0af1a5fa9 100644
--- a/ak-api-cli-gen/Cargo.toml
+++ b/ak-api-cli-gen/Cargo.toml
@@ -3,15 +3,16 @@ name = "ak-api-cli-gen"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
 
 [dependencies]
 prettyplease = "0.3"
-proc-macro2 = "1"
-quote = "1"
-syn = { version = "3", features = ["full"] }
+proc-macro2 = { workspace = true }
+quote = { workspace = true }
+syn = { workspace = true, features = ["full"] }
 
 [dev-dependencies]
 insta = "1"
diff --git a/ak-api-cli/Cargo.toml b/ak-api-cli/Cargo.toml
index ffd043a97..98738eb3c 100644
--- a/ak-api-cli/Cargo.toml
+++ b/ak-api-cli/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-api-cli"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
diff --git a/ak-browser-support/Cargo.toml b/ak-browser-support/Cargo.toml
index aacb01e50..fbba1e852 100644
--- a/ak-browser-support/Cargo.toml
+++ b/ak-browser-support/Cargo.toml
@@ -3,13 +3,14 @@ name = "ak-browser-support"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
 
 [dependencies]
-ak-platform = { path = "../ak-platform" }
-ak-meta = { path = "../ak-meta" }
+ak-platform = { workspace = true }
+ak-meta = { workspace = true }
 tonic = { workspace = true }
 eyre = { workspace = true }
 tracing = { workspace = true }
@@ -26,4 +27,4 @@ tower = { workspace = true }
 sentry = { workspace = true }
 
 [dev-dependencies]
-hyper-util = { version = "0.1", features = ["tokio"] }
+hyper-util = { workspace = true, features = ["tokio"] }
diff --git a/ak-cli/Cargo.toml b/ak-cli/Cargo.toml
index 88c72f179..bd367da6a 100644
--- a/ak-cli/Cargo.toml
+++ b/ak-cli/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-cli"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
@@ -13,14 +14,14 @@ path = "src/main.rs"
 
 [dependencies]
 ak-api-cli = { workspace = true }
-ak-meta = { path = "../ak-meta" }
-ak-platform = { path = "../ak-platform" }
+ak-meta = { workspace = true }
+ak-platform = { workspace = true }
 authentik-client.workspace = true
-aws-sdk-sts = { version = "1.106.0", features = ["behavior-version-latest"] }
+aws-sdk-sts = { version = "1.106.0", default-features = false, features = ["behavior-version-latest", "default-https-client", "rt-tokio"] }
 aws-types = "1.3.16"
 chrono = { workspace = true }
 clap = { workspace = true }
-clap_complete = "4"
+clap_complete = { workspace = true }
 color-eyre.workspace = true
 eyre.workspace = true
 hex.workspace = true
diff --git a/ak-cli/src/commands/auth.rs b/ak-cli/src/commands/auth.rs
index f6f613f17..75c1d43a0 100644
--- a/ak-cli/src/commands/auth.rs
+++ b/ak-cli/src/commands/auth.rs
@@ -26,7 +26,7 @@ pub enum AuthCommands {
         #[arg(short, long, required = true)]
         client_id: String,
     },
-    /// Claude
+    /// Authenticate to Anthropic's Claude using Workload Identity Federation.
     Claude {
         #[arg(short, long, required = true)]
         client_id: String,
diff --git a/ak-flow-executor/Cargo.toml b/ak-flow-executor/Cargo.toml
index f1f93793b..b63931feb 100644
--- a/ak-flow-executor/Cargo.toml
+++ b/ak-flow-executor/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-flow-executor"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [[example]]
 name = "flow_authenticate"
@@ -10,9 +11,9 @@ name = "flow_authenticate"
 [dependencies]
 authentik-client = { workspace = true }
 eyre = { workspace = true }
-ak-meta = { path = "../ak-meta" }
+ak-meta = { workspace = true }
 reqwest = { workspace = true }
-reqwest-middleware = "0.5.2"
+reqwest-middleware = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
 reqwest_cookie_store = "0.10.0"
@@ -21,5 +22,5 @@ regex = "1.13.0"
 
 [dev-dependencies]
 tokio = { workspace = true, features = ["time"] }
-ak-platform = { path = "../ak-platform" }
-httptest = "0.16"
+ak-platform = { workspace = true }
+httptest = { workspace = true }
diff --git a/ak-meta-macros/Cargo.toml b/ak-meta-macros/Cargo.toml
index 987d7b6f9..8f63ae9f9 100644
--- a/ak-meta-macros/Cargo.toml
+++ b/ak-meta-macros/Cargo.toml
@@ -3,11 +3,12 @@ name = "ak-meta-macros"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lib]
 proc-macro = true
 
 [dependencies]
-proc-macro2 = "1"
-quote = "1"
-syn = { version = "3", features = ["full"] }
+proc-macro2 = { workspace = true }
+quote = { workspace = true }
+syn = { workspace = true, features = ["full"] }
diff --git a/ak-meta/Cargo.toml b/ak-meta/Cargo.toml
index 42d7f0281..43b656373 100644
--- a/ak-meta/Cargo.toml
+++ b/ak-meta/Cargo.toml
@@ -3,8 +3,9 @@ name = "ak-meta"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [dependencies]
 ak-meta-macros = { path = "../ak-meta-macros" }
-ak-platform = { path = "../ak-platform" }
+ak-platform = { workspace = true }
 sentry = { workspace = true }
diff --git a/ak-nss/Cargo.toml b/ak-nss/Cargo.toml
index 9cea5cbbc..06e9adb69 100644
--- a/ak-nss/Cargo.toml
+++ b/ak-nss/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-nss"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lib]
 name = "nss_authentik"
@@ -12,10 +13,10 @@ crate-type = ["cdylib", "rlib"]
 workspace = true
 
 [dependencies]
-ak-platform = { path = "../ak-platform" }
+ak-platform = { workspace = true }
 eyre = { workspace = true }
-ctor = "1.0.7"
-dtor = "1.0.5"
-libc = "0.2.186"
+ctor = { workspace = true }
+dtor = { workspace = true }
+libc = { workspace = true }
 libnss = "0.9.0"
 tracing = { workspace = true }
diff --git a/ak-pam/Cargo.toml b/ak-pam/Cargo.toml
index 4ebe41b92..0454a9fd7 100644
--- a/ak-pam/Cargo.toml
+++ b/ak-pam/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-pam"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lib]
 name = "pam_authentik"
@@ -12,13 +13,13 @@ crate-type = ["cdylib"]
 workspace = true
 
 [dependencies]
-ak-platform = { path = "../ak-platform" }
-ctap-hid-fido2 = "3.5.11"
-ctor = "1.0.7"
-dtor = "1.0.5"
+ak-platform = { workspace = true }
+ctap-hid-fido2 = { version = "3.5.11", default-features = false, features = ["aws-lc-rs"] }
+ctor = { workspace = true }
+dtor = { workspace = true }
 eyre.workspace = true
 gethostname = "1.1.0"
-libc = "0.2.186"
+libc = { workspace = true }
 pam-bindings = "0.3.0"
 serde_json.workspace = true
 serde.workspace = true
diff --git a/ak-platform-authz/Cargo.toml b/ak-platform-authz/Cargo.toml
index d5492f6e0..9ed25d36e 100644
--- a/ak-platform-authz/Cargo.toml
+++ b/ak-platform-authz/Cargo.toml
@@ -3,12 +3,13 @@ name = "ak-platform-authz"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [[example]]
 name = "authz_prompt"
 
 [dependencies]
-ak-platform = { path = "../ak-platform" }
+ak-platform = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 tonic = { workspace = true }
@@ -18,9 +19,9 @@ eyre = { workspace = true }
 apple-localauthentication = { version = "0.3.5", features = ["async"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-zbus = "5"
+zbus = { workspace = true }
 
 [target.'cfg(windows)'.dependencies]
-windows = { version = "0.62.2", features = [
+windows = { workspace = true, features = [
     "Security_Credentials_UI"
 ] }
diff --git a/ak-platform-e2e/Cargo.toml b/ak-platform-e2e/Cargo.toml
index d3c4a55db..5f6902922 100644
--- a/ak-platform-e2e/Cargo.toml
+++ b/ak-platform-e2e/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-platform-e2e"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints.clippy]
 unwrap_used = "allow"
@@ -10,14 +11,14 @@ expect_used = "allow"
 panic = "allow"
 
 [dependencies]
-ak-flow-executor = { path = "../ak-flow-executor" }
-ak-platform = { path = "../ak-platform" }
+ak-flow-executor = { workspace = true }
+ak-platform = { workspace = true }
 authentik-client.workspace = true
 eyre.workspace = true
 reqwest.workspace = true
 serde_json.workspace = true
 serde.workspace = true
-testcontainers = "0.28"
+testcontainers = { version = "0.28", default-features = false, features = ["aws-lc-rs"] }
 tokio = { workspace = true, features = ["time"] }
 tracing = { workspace = true }
 url.workspace = true
diff --git a/ak-platform-facts/Cargo.toml b/ak-platform-facts/Cargo.toml
index 96b77fc2f..6d9f066a4 100644
--- a/ak-platform-facts/Cargo.toml
+++ b/ak-platform-facts/Cargo.toml
@@ -3,23 +3,24 @@ name = "ak-platform-facts"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
 
 [dependencies]
-ak-meta = { path = "../ak-meta" }
+ak-meta = { workspace = true }
 authentik-client = { workspace = true }
 eyre = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tracing = { workspace = true }
-sysinfo = { version = "0.39.6", default-features = false, features = ["system", "disk", "network"] }
+sysinfo = { workspace = true, features = ["system", "disk", "network"] }
 osquery = { git = "https://github.com/BeryJu/osquery-rs", version = "0.2.3" }
 
 [target.'cfg(windows)'.dependencies]
 wmi = "0.18"
-winreg = "0.56"
+winreg = { workspace = true }
 
 [dev-dependencies]
 tempfile = { workspace = true }
diff --git a/ak-platform-keyring/Cargo.toml b/ak-platform-keyring/Cargo.toml
index f681c49bf..9070e1788 100644
--- a/ak-platform-keyring/Cargo.toml
+++ b/ak-platform-keyring/Cargo.toml
@@ -3,9 +3,10 @@ name = "ak-platform-keyring"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [dependencies]
-ak-platform = { path = "../ak-platform" }
+ak-platform = { workspace = true }
 eyre = { workspace = true }
 serde = { workspace = true }
 chrono = { workspace = true }
@@ -14,17 +15,17 @@ tracing = { workspace = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 security-framework = { version = "3.7", features = ["OSX_10_15"] }
-core-foundation = "0.10"
+core-foundation = { workspace = true }
 
 [target.'cfg(windows)'.dependencies]
 keyring-core = { version = "1.0.0" }
 windows-native-keyring-store = "1.1.0"
-windows = { version = "0.62", features = ["Win32_Foundation", "Win32_Security_Cryptography", "Win32_System_Memory"] }
+windows = { workspace = true, features = ["Win32_Foundation", "Win32_Security_Cryptography", "Win32_System_Memory"] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 secret-service = { version = "5.1.0", features = ["rt-tokio-crypto-rust"] }
 tokio = { workspace = true, features = ["sync"] }
-zbus = "5"
+zbus = { workspace = true }
 zbus_names = "4.3.4"
 
 [dev-dependencies]
diff --git a/ak-platform/Cargo.toml b/ak-platform/Cargo.toml
index d3837bbd9..ab2eb3d32 100644
--- a/ak-platform/Cargo.toml
+++ b/ak-platform/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-platform"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [[example]]
 name = "log"
@@ -11,10 +12,10 @@ name = "log"
 name = "grpc_client"
 
 [dependencies]
-base64 = "0.23.0"
-jsonwebtoken = { version = "11", features = ["rust_crypto"] }
+base64 = { workspace = true }
+jsonwebtoken = { workspace = true }
 p256 = { version = "0.13", features = ["pkcs8", "jwk"] }
-sha2 = "0.11"
+sha2 = { workspace = true }
 uuid = { workspace = true }
 reqwest = { workspace = true }
 url = { workspace = true }
@@ -22,7 +23,7 @@ hyper-util = { workspace = true }
 log = { workspace = true }
 pbjson = { workspace = true }
 pbjson-types = { workspace = true }
-prost = "0.14"
+prost = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
@@ -39,22 +40,22 @@ http-body-util = "0.1.3"
 http-body = "1.0.1"
 simplelog = "0.12.2"
 tokio-stream = "0.1.18"
-tokio-util = "0.7"
+tokio-util = { workspace = true }
 interprocess = { version = "2", features = ["tokio"] }
 chrono = { workspace = true }
 notify = "8.2.0"
-sysinfo = { version = "0.39.3", default-features = false, features = ["system"] }
+sysinfo = { workspace = true, features = ["system"] }
 tracing = { workspace = true }
 env_filter = "2.0.0"
 serde_with = "3.21.0"
-tower-http = { version = "0.7.0", features = ["trace"] }
+tower-http = { workspace = true, features = ["trace"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 oslog = "0.2.0"
 
 [target.'cfg(unix)'.dependencies]
 syslog = "7.0.0"
-libc = "0.2.186"
+libc = { workspace = true }
 
 [target.'cfg(windows)'.dependencies]
 eventlog = "0.4.0"
diff --git a/ak-sysd/Cargo.toml b/ak-sysd/Cargo.toml
index 5c10d5931..1292a373c 100644
--- a/ak-sysd/Cargo.toml
+++ b/ak-sysd/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-sysd"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
@@ -12,39 +13,39 @@ name = "ak-sysd"
 path = "src/main.rs"
 
 [dependencies]
-ak-flow-executor = { path = "../ak-flow-executor" }
-ak-meta = { path = "../ak-meta" }
-ak-platform = { path = "../ak-platform" }
+ak-flow-executor = { workspace = true }
+ak-meta = { workspace = true }
+ak-platform = { workspace = true }
 ak-platform-facts = { path = "../ak-platform-facts" }
-ak-platform-keyring = { path = "../ak-platform-keyring" }
+ak-platform-keyring = { workspace = true }
 authentik-client = { workspace = true }
-base64 = "0.23.0"
+base64 = { workspace = true }
 chrono = { workspace = true }
 clap = { workspace = true }
-clap_complete = "4"
+clap_complete = { workspace = true }
 eyre = { workspace = true }
 hex = { workspace = true }
-jsonwebtoken = { version = "11", features = ["rust_crypto"] }
+jsonwebtoken = { workspace = true }
 pbjson-types = { workspace = true }
 rand = "0.10"
 reqwest = { workspace = true }
 rpassword = "7"
 rusqlite = { version = "0.40", features = ["bundled"] }
 sentry = { workspace = true }
-sentry-tower = { version = "0.49.0", features = ["http"] }
+sentry-tower = { workspace = true, features = ["http"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 sha2 = { workspace = true }
-ssh-key = { version = "0.6", features = ["ed25519", "getrandom", "std"] }
+ssh-key = { workspace = true, features = ["ed25519", "getrandom", "std"] }
 subtle = "2"
 tempfile = { workspace = true }
 tokio = { workspace = true, features = ["time", "signal"] }
-tokio-util = "0.7"
+tokio-util = { workspace = true }
 tonic = { workspace = true }
 tonic-prost = { workspace = true }
-tower-http = { version = "0.7.0", features = ["trace"] }
+tower-http = { workspace = true, features = ["trace"] }
 tracing = { workspace = true }
-reqwest-middleware = "0.5.2"
+reqwest-middleware = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
 signal-hook = "0.4"
@@ -67,16 +68,16 @@ tikv-jemallocator = { version = "0.7.0", features = [
 ] }
 
 [target.'cfg(target_os = "linux")'.dependencies]
-libc = "0.2.186"
+libc = { workspace = true }
 
 [target.'cfg(target_os = "macos")'.dependencies]
-core-foundation = "0.10"
+core-foundation = { workspace = true }
 core-foundation-sys = "0.8"
 
 [target.'cfg(windows)'.dependencies]
 windows-service = "0.8"
-winreg = { version = "0.56", features = ["serialization-serde"] }
-windows = { version = "0.62.2", features = [
+winreg = { workspace = true, features = ["serialization-serde"] }
+windows = { workspace = true, features = [
     "Win32_System_RemoteDesktop",
     "Win32_Security",
     "Win32_System_Threading",
@@ -85,8 +86,8 @@ windows = { version = "0.62.2", features = [
 ] }
 
 [build-dependencies]
-windows_exe_info = "0.5.2"
+windows_exe_info = { workspace = true }
 
 [dev-dependencies]
-ak-agent = { path = "../ak-agent" }
-httptest = "0.16"
+ak-agent = { workspace = true }
+httptest = { workspace = true }
diff --git a/ee/wcp/browser-host/Cargo.toml b/ee/wcp/browser-host/Cargo.toml
index 13246609f..4ce6a6547 100644
--- a/ee/wcp/browser-host/Cargo.toml
+++ b/ee/wcp/browser-host/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-ee-wcp-browser-host"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [[bin]]
 name = "ak_browser"
@@ -12,17 +13,17 @@ path = "src/main.rs"
 workspace = true
 
 [build-dependencies]
-tauri-build = { version = "2", features = [] }
+tauri-build = { workspace = true }
 
 [dependencies]
-ak-ee-wcp-wire = { path = "../wire" }
-ak-meta = { path = "../../../ak-meta" }
-ak-platform = { path = "../../../ak-platform" }
+ak-ee-wcp-wire = { workspace = true }
+ak-meta = { workspace = true }
+ak-platform = { workspace = true }
 log = { workspace = true }
 sentry = { workspace = true }
 uuid = { workspace = true }
 winreg = { workspace = true }
-tauri = { version = "2" }
+tauri = { workspace = true }
 webview2-com = "0.39"
 
 # Deliberately not `workspace = true`. The workspace pins windows/windows-core
@@ -32,8 +33,8 @@ webview2-com = "0.39"
 # version here would leave the tauri, webview2-com and raw Win32 call sites in
 # this file disagreeing about the same types. Nothing crosses a crate boundary
 # as a Win32 type, so the two versions coexist as they already do in Cargo.lock.
-windows-core = "0.62"
-windows = { version = "0.62", features = [
+windows-core = { workspace = true }
+windows = { workspace = true, features = [
     "Win32_Foundation",
     "Win32_Security",
     "Win32_Security_Authorization",
diff --git a/ee/wcp/credprovider/Cargo.toml b/ee/wcp/credprovider/Cargo.toml
index 38bb0ee87..f2acace43 100644
--- a/ee/wcp/credprovider/Cargo.toml
+++ b/ee/wcp/credprovider/Cargo.toml
@@ -3,6 +3,7 @@ name = "ak-ee-wcp"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lib]
 name = "ak_cred_provider"
@@ -12,9 +13,9 @@ crate-type = ["cdylib"]
 workspace = true
 
 [dependencies]
-ak-ee-wcp-wire = { path = "../wire" }
-ak-platform = { path = "../../../ak-platform" }
-ak-platform-keyring = { path = "../../../ak-platform-keyring" }
+ak-ee-wcp-wire = { workspace = true }
+ak-platform = { workspace = true }
+ak-platform-keyring = { workspace = true }
 log = { workspace = true }
 windows = { workspace = true }
 windows-core = { workspace = true }
diff --git a/ee/wcp/e2e/Cargo.toml b/ee/wcp/e2e/Cargo.toml
index abb887505..7d7e30cad 100644
--- a/ee/wcp/e2e/Cargo.toml
+++ b/ee/wcp/e2e/Cargo.toml
@@ -3,13 +3,14 @@ name = "ak-ee-wcp-e2e"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
 
 [dependencies]
-ak-ee-wcp-wire = { path = "../wire" }
-ak-platform = { path = "../../../ak-platform" }
+ak-ee-wcp-wire = { workspace = true }
+ak-platform = { workspace = true }
 log = { workspace = true }
 tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
 tonic = { workspace = true }
diff --git a/ee/wcp/wire/Cargo.toml b/ee/wcp/wire/Cargo.toml
index 8507f0f86..9cebc3511 100644
--- a/ee/wcp/wire/Cargo.toml
+++ b/ee/wcp/wire/Cargo.toml
@@ -3,11 +3,12 @@ name = "ak-ee-wcp-wire"
 version.workspace = true
 edition.workspace = true
 license.workspace = true
+publish.workspace = true
 
 [lints]
 workspace = true
 
 [dependencies]
-prost = "0.14"
+prost = { workspace = true }
 url = { workspace = true }
 windows-core = { workspace = true }