diff --git a/deny.toml b/deny.toml
index 9a9fd0dd0b..0f3ff5b3ed 100644
--- a/deny.toml
+++ b/deny.toml
@@ -29,9 +29,25 @@ ignore = [
 git-fetch-with-cli = true
 
 [licenses]
-default = "allow"
-unlicensed = "allow"
-copyleft = "allow"
+allow-osi-fsf-free = "either"
+copyleft = "deny"
+unlicensed = "deny"
+default = "deny"
+
+exceptions = [
+    # We should probably NOT bundle CA certs but use the OS ones.
+    { name = "webpki-roots", allow = ["MPL-2.0"] },
+    # Currently needed for testing only via mockito.
+    { name = "colored", allow = ["MPL-2.0"] },
+]
+
+[[licenses.clarify]]
+name = "ring"
+expression = "BSD-4-Clause AND ISC AND MIT AND OpenSSL"
+license-files = [
+    # https://github.com/briansmith/ring/blob/95948b3977013aed16db92ae32e6b8384496a740/LICENSE
+    { path = "LICENSE", hash = 0xbd0eed23 },
+]
 
 [sources.allow-org]
 github = ["influxdata", "apache"]
diff --git a/flightsql/Cargo.toml b/flightsql/Cargo.toml
index ff28eb09c2..a9590316f0 100644
--- a/flightsql/Cargo.toml
+++ b/flightsql/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
 name = "flightsql"
-version = "0.1.0"
-edition = "2021"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
diff --git a/ingester2_test_ctx/Cargo.toml b/ingester2_test_ctx/Cargo.toml
index 33ad0ca9ca..18dda522fd 100644
--- a/ingester2_test_ctx/Cargo.toml
+++ b/ingester2_test_ctx/Cargo.toml
@@ -1,7 +1,9 @@
 [package]
 name = "ingester2_test_ctx"
-version = "0.1.0"
-edition = "2021"
+version.workspace = true
+authors.workspace = true
+edition.workspace = true
+license.workspace = true
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html