diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3f6418..2e66b4d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -58,10 +58,21 @@ jobs:
       - run: cargo fmt --check
 
   deny:
+    name: Cargo Deny (advisories/licenses/bans/sources)
     runs-on: ubuntu-latest
+    # Native install rather than the Docker-based cargo-deny-action: the action
+    # builds a container from a Docker Hub base image at runtime, which is rate-
+    # limited/flaky from GitHub Actions and made this gate red on a transient
+    # registry timeout. Mirrors the `vet` job below (taiki-e/install-action).
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: dtolnay/rust-toolchain@stable
+      - name: Install cargo-deny
+        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
+        with:
+          tool: cargo-deny
+      - name: Check dependency hygiene
+        run: cargo deny check
 
   vet:
     name: Cargo Vet (supply-chain)
diff --git a/deny.toml b/deny.toml
index b4aa2a0..e0210ba 100644
--- a/deny.toml
+++ b/deny.toml
@@ -7,7 +7,6 @@ allow = [
     "MIT",
     "Apache-2.0",
     "Unicode-3.0",
-    "Unicode-DFS-2016",
 ]
 confidence-threshold = 0.8