diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index e78783c..f6c88c6 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -26,3 +26,28 @@ jobs:
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       - run: |
           cargo clippy -- -Dwarnings
+  lock_machete:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - run: |
+          rustup toolchain install
+      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - run: |
+          cargo install cargo-machete
+      - run: |
+          cargo machete
+      - name: Ensure Cargo.lock is current
+        run: |
+          cargo check
+          if ! git diff --quiet -- Cargo.lock; then
+            echo "Cargo.lock is out of date"
+            {
+              echo "## Cargo.lock is out of date"
+              echo 'Run `cargo check` locally and commit the updated `Cargo.lock`.'
+            } >> "$GITHUB_STEP_SUMMARY"
+            echo "::group::Cargo.lock diff"
+            git diff -- Cargo.lock
+            echo "::endgroup::"
+            exit 1
+          fi
diff --git a/Cargo.lock b/Cargo.lock
index 6bcd0cb..2081413 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3532,7 +3532,6 @@ dependencies = [
  "chrono",
  "cookie",
  "crc32c",
- "diesel",
  "dropshot",
  "dropshot-authorization-header",
  "futures",
@@ -3549,7 +3548,6 @@ dependencies = [
  "partial-struct",
  "percent-encoding",
  "rand 0.10.1",
- "rand_core 0.10.1",
  "reqwest",
  "rsa",
  "schemars 0.8.22",
@@ -3563,7 +3561,6 @@ dependencies = [
  "tap",
  "thiserror 2.0.18",
  "tokio",
- "toml 1.1.2+spec-1.1.0",
  "tracing",
  "tracing-subscriber",
  "url",
@@ -4275,7 +4272,6 @@ dependencies = [
  "clap",
  "regex",
  "semver 1.0.28",
- "serde",
 ]
 
 [[package]]
diff --git a/v-api/Cargo.toml b/v-api/Cargo.toml
index 490e485..35e0a58 100644
--- a/v-api/Cargo.toml
+++ b/v-api/Cargo.toml
@@ -16,7 +16,6 @@ base64 = { workspace = true }
 chrono = { workspace = true, features = ["serde"] }
 cookie = { workspace = true }
 crc32c = { workspace = true }
-diesel = { workspace = true }
 dropshot = { workspace = true }
 dropshot-authorization-header = { path = "../dropshot-authorization-header" }
 futures = { workspace = true }
@@ -32,7 +31,6 @@ newtype-uuid = { workspace = true }
 partial-struct = { workspace = true }
 percent-encoding = { workspace = true }
 rand = { workspace = true, features = ["std"] }
-rand_core = { workspace = true }
 reqwest = { workspace = true }
 rsa = { workspace = true, features = ["sha2"] }
 schemars = { workspace = true, features = ["chrono"] }
@@ -46,7 +44,6 @@ steno = { workspace = true, optional = true }
 tap = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["rt-multi-thread", "macros"] }
-toml = { workspace = true }
 tracing = { workspace = true }
 url = { workspace = true }
 uuid = { workspace = true, features = ["v4", "serde"]  }
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index 9aa29d8..2741bf8 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -8,4 +8,3 @@ publish.workspace = true
 clap = { workspace = true }
 regex = { workspace = true }
 semver = { workspace = true }
-serde = { workspace = true }