diff --git a/.github/workflows/reusable/cargo-deny.yml b/.github/workflows/reusable/cargo-deny.yml
new file mode 100644
index 0000000..54416b8
--- /dev/null
+++ b/.github/workflows/reusable/cargo-deny.yml
@@ -0,0 +1,28 @@
+# Reusable cargo-deny — call from consumer repos:
+#   jobs:
+#     cargo-deny:
+#       uses: KooshaPari/phenotype-tooling/.github/workflows/reusable/cargo-deny.yml@main
+name: Reusable cargo-deny
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.2.2
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@3c5f7ea28cd621ae0bf5283f0e981fb97b8a7af9
+        with:
+          toolchain: stable
+
+      - name: Run cargo-deny
+        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb # v6
+        with:
+          rust-version: stable