diff --git a/.github/workflows/dusk_ci.yml b/.github/workflows/dusk_ci.yml
index 2b97c517..d2280274 100644
--- a/.github/workflows/dusk_ci.yml
+++ b/.github/workflows/dusk_ci.yml
@@ -75,3 +75,7 @@ jobs:
   test_stable_std:
     name: Stable tests std
     uses: dusk-network/.github/.github/workflows/run-tests.yml@main
+
+  cargo_deny:
+    name: Cargo Deny
+    uses: dusk-network/.github/.github/workflows/cargo-deny.yml@main
diff --git a/Cargo.toml b/Cargo.toml
index bc3c45e6..a39e6060 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -26,12 +26,12 @@ ff = {version = "0.13", default-features = false}
 itertools = {version = "0.9", default-features = false}
 hashbrown = {version = "0.9", default-features=false, features = ["ahash"]}
 msgpacker = {version = "=0.4.8", default-features=false, features = ["alloc", "derive"], optional=true}
-miniz_oxide = {version = "0.7", default-features=false, features = ["with-alloc"], optional = true}
+miniz_oxide = {version = "0.9", default-features=false, features = ["with-alloc"], optional = true}
 rayon = {version = "1.3", optional = true}
 sha2 = {version = "0.10", default-features = false, optional = true}
 cfg-if = "1.0"
 # Dusk related deps for WASMI serde
-rkyv = {version = "0.7", optional = true, default-features = false}
+rkyv = {version = ">=0.7.46", optional = true, default-features = false}
 bytecheck = {version = "0.6", optional = true, default-features = false}
 backtrace = {version = "0.3", optional = true}
 dusk-cdf = {version = "0.5", optional = true}
@@ -39,9 +39,9 @@ zeroize = { version = "1", optional = true }
 
 [dev-dependencies]
 criterion = "0.5"
-tempdir = "0.3"
+tempfile = "3.25"
 rand = "0.8"
-rkyv = {version = "0.7", default-features = false, features = ["size_32"]}
+rkyv = {version = ">=0.7.46", default-features = false, features = ["size_32"]}
 
 [features]
 default = ["std"]
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..71b5c76a
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,30 @@
+[advisories]
+ignore = []
+
+[licenses]
+allow = [
+  "MPL-2.0",
+  "MIT",
+  "Apache-2.0",
+  "Apache-2.0 WITH LLVM-exception",
+  "BSD-2-Clause",
+  "BSD-3-Clause",
+  "Unicode-3.0",
+]
+confidence-threshold = 0.8
+
+[licenses.private]
+ignore = false
+
+[bans]
+multiple-versions = "warn"
+wildcards = "allow"
+skip = [
+  { crate = "syn@1.0.109", reason = "Unavoidable transitive split between rkyv 0.7.x proc-macro dependencies (syn 1.x) and newer proc-macro dependencies (syn 2.x)" },
+]
+
+[sources]
+unknown-registry = "deny"
+unknown-git = "deny"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = []
diff --git a/tests/debugger.rs b/tests/debugger.rs
index b143353c..37e9f213 100644
--- a/tests/debugger.rs
+++ b/tests/debugger.rs
@@ -22,7 +22,7 @@ impl Circuit for EmptyCircuit {
 fn generate_cdf_works() -> io::Result<()> {
     let rng = &mut rand::thread_rng();
 
-    let dir = tempdir::TempDir::new("plonk-cdf")?;
+    let dir = tempfile::Builder::new().prefix("plonk-cdf_").tempdir()?;
     let path = dir.path().canonicalize()?.join("test.cdf");
 
     let label = b"transcript-arguments";