diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 392da23d1..474176c03 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,15 @@ jobs:
       - name: Run clippy
         run: scripts/clippy.sh
 
+  cargo_deny:
+    name: cargo deny
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+      - uses: EmbarkStudios/cargo-deny-action@v1
+        with:
+          arguments: --all-features --workspace
+
   docs:
     name: Rust doc comments
     runs-on: ubuntu-latest
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e2d91b675..b6b48021f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@
 ### Changes
 - Make smeared timestamp generation non-async. #4075
 - Set minimum TLS version to 1.2. #4096
+- Run `cargo-deny` in CI. #4101
 
 ### Fixes
 - Do not block async task executor while decrypting the messages. #4079
diff --git a/deltachat-repl/Cargo.toml b/deltachat-repl/Cargo.toml
index bab15c6d7..ed209d9af 100644
--- a/deltachat-repl/Cargo.toml
+++ b/deltachat-repl/Cargo.toml
@@ -1,6 +1,7 @@
 [package]
 name = "deltachat-repl"
 version = "1.110.0"
+license = "MPL-2.0"
 edition = "2021"
 
 [dependencies]
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 000000000..a49d4bf51
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,16 @@
+[advisories]
+ignore = [
+    "RUSTSEC-2020-0071",
+]
+
+[licenses]
+allow = [
+    "0BSD",
+    "Apache-2.0",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "CC0-1.0",
+    "MIT",
+    "BSL-1.0", # Boost Software License 1.0
+    "Unicode-DFS-2016",
+]