diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 62b0907..1ef776e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,11 +44,6 @@ jobs:
     runs-on: [self-hosted, Linux, ARM64, spark-1]
     steps:
       - uses: actions/checkout@v5
-      - name: toolchain
-        run: |
-          echo "PATH=$PATH"
-          command -v cargo || echo "cargo NOT on PATH"
-          cargo --version
       - run: cargo fmt --all --check
       - run: cargo clippy --workspace --all-targets --all-features
       - run: cargo test --workspace --all-features
diff --git a/deny.toml b/deny.toml
index 1962587..37bd5e2 100644
--- a/deny.toml
+++ b/deny.toml
@@ -16,9 +16,18 @@ allow = [
     "Unicode-3.0",
     "Zlib",
     "CC0-1.0",
-    "MPL-2.0",           # file-level copyleft; acceptable as a leaf dependency
     "Apache-2.0 WITH LLVM-exception",
+    # CDLA-Permissive-2.0 covers `webpki-root-certs` — the Mozilla CA root
+    # bundle. It is a DATA licence on a certificate list, not a code licence,
+    # and it is permissive with no reciprocal obligations on anything that uses
+    # the data. Reached via hickory-resolver -> rustls-platform-verifier.
+    "CDLA-Permissive-2.0",
 ]
+
+# MPL-2.0 is deliberately NOT allowed. Nothing needs it today, and a policy
+# that pre-authorises licences it does not use is a policy nobody reads
+# carefully. If a dependency ever pulls it in, CI fails and someone decides on
+# purpose — which is the point.
 confidence-threshold = 0.9
 
 # Everything not in `allow` fails — including every GPL, LGPL and AGPL variant.