diff --git a/deny.toml b/deny.toml
index 9e42d46..899f025 100644
--- a/deny.toml
+++ b/deny.toml
@@ -66,4 +66,14 @@ allow-registry = ["https://github.com/rust-lang/crates.io-index"]
 # block/buzz is the upstream Buzz SDK, rev-pinned in crates/lumbridge-buzz.
 # It has no crates.io release; BUZZ_INTEGRATION.md records why we use its signed
 # protocol semantics rather than inventing a dialect.
-allow-git = ["https://github.com/block/buzz"]
+allow-git = [
+    "https://github.com/block/buzz",
+    # The UI framework, pinned by decision 0023 to a full revision because
+    # crates.io publishing of gpui stopped in October 2025 and the platform
+    # backends now live in crates Zed does not publish at all.
+    "https://github.com/zed-industries/zed",
+    # Not optional and not obvious: gpui_wgpu reaches font-kit through a Git
+    # source of Zed's own, so adopting the framework brings two Git sources
+    # rather than one. Naming it here is what stops that arriving unnoticed.
+    "https://github.com/zed-industries/font-kit",
+]