diff --git a/.github/workflows/clippy-fmt.yml b/.github/workflows/lint.yml
similarity index 60%
rename from .github/workflows/clippy-fmt.yml
rename to .github/workflows/lint.yml
index dab27736..3f75d624 100644
--- a/.github/workflows/clippy-fmt.yml
+++ b/.github/workflows/lint.yml
@@ -41,3 +41,26 @@ jobs:
           reporter: 'github-pr-check'
           github_token: ${{ secrets.GITHUB_TOKEN }}
           clippy_flags: --workspace --all-features --tests --examples --bins -- -Dclippy::todo -Aunknown_lints
+
+  check-external-types:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust (nightly-2023-10-10)
+        uses: actions-rust-lang/setup-rust-toolchain@v1.5.0
+        with:
+          toolchain: nightly-2023-10-10
+
+      - name: Install just
+        uses: taiki-e/install-action@v2.20.2
+        with:
+          tool: just
+
+      - name: Install cargo-check-external-types
+        uses: taiki-e/cache-cargo-install-action@v1.2.2
+        with:
+          tool: cargo-check-external-types@0.1.10
+
+      - name: check external types
+        run: just check-external-types-all
diff --git a/actix-codec/Cargo.toml b/actix-codec/Cargo.toml
index f2261827..91fefc7c 100644
--- a/actix-codec/Cargo.toml
+++ b/actix-codec/Cargo.toml
@@ -13,6 +13,15 @@ license = "MIT OR Apache-2.0"
 edition.workspace = true
 rust-version.workspace = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "bytes::*",
+    "futures_core::*",
+    "futures_sink::*",
+    "tokio::*",
+    "tokio_util::*",
+]
+
 [dependencies]
 bitflags = "2"
 bytes = "1"
diff --git a/actix-rt/Cargo.toml b/actix-rt/Cargo.toml
index dd460033..4e55eb1b 100644
--- a/actix-rt/Cargo.toml
+++ b/actix-rt/Cargo.toml
@@ -14,6 +14,11 @@ license = "MIT OR Apache-2.0"
 edition.workspace = true
 rust-version.workspace = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "tokio::*",
+]
+
 [features]
 default = ["macros"]
 macros = ["actix-macros"]
diff --git a/actix-server/Cargo.toml b/actix-server/Cargo.toml
index 8f0e8982..3a939218 100755
--- a/actix-server/Cargo.toml
+++ b/actix-server/Cargo.toml
@@ -15,6 +15,11 @@ license = "MIT OR Apache-2.0"
 edition.workspace = true
 rust-version.workspace = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "tokio::*",
+]
+
 [features]
 default = []
 io-uring = ["tokio-uring", "actix-rt/io-uring"]
diff --git a/actix-tls/Cargo.toml b/actix-tls/Cargo.toml
index e023c984..7d0ebfa5 100755
--- a/actix-tls/Cargo.toml
+++ b/actix-tls/Cargo.toml
@@ -17,6 +17,14 @@ rust-version.workspace = true
 all-features = true
 rustdoc-args = ["--cfg", "docsrs"]
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_service::*",
+    "actix_utils::*",
+    "futures_core::*",
+    "tokio::*",
+]
+
 [package.metadata.cargo-machete]
 ignored = [
     "rustls_021", # specified to force version with add_trust_anchors method
diff --git a/actix-tracing/Cargo.toml b/actix-tracing/Cargo.toml
index 829a4b85..0c64e9ab 100644
--- a/actix-tracing/Cargo.toml
+++ b/actix-tracing/Cargo.toml
@@ -12,6 +12,14 @@ license = "MIT OR Apache-2.0"
 edition.workspace = true
 rust-version.workspace = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_service::*",
+    "actix_utils::*",
+    "tracing::*",
+    "tracing_futures::*",
+]
+
 [dependencies]
 actix-service = "2"
 actix-utils = "3"
diff --git a/bytestring/Cargo.toml b/bytestring/Cargo.toml
index a328e5d7..dabfb74d 100644
--- a/bytestring/Cargo.toml
+++ b/bytestring/Cargo.toml
@@ -9,11 +9,17 @@ authors = [
 keywords = ["string", "bytes", "utf8", "web", "actix"]
 categories = ["no-std", "web-programming"]
 homepage = "https://actix.rs"
-repository = "https://github.com/actix/actix-net.git"
+repository = "https://github.com/actix/actix-net"
 license = "MIT OR Apache-2.0"
 edition.workspace = true
 rust-version.workspace = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "bytes::*",
+    "serde::*",
+]
+
 [dependencies]
 bytes = { version = "1.2", default-features = false }
 serde = { version = "1.0", optional = true }
diff --git a/justfile b/justfile
index f2e449d8..1dbc0b89 100644
--- a/justfile
+++ b/justfile
@@ -9,3 +9,28 @@ doc:
 doc-watch:
     RUSTDOCFLAGS="--cfg=docsrs" cargo +nightly doc --no-deps --workspace --features=rustls,openssl --open
     cargo watch -- RUSTDOCFLAGS="--cfg=docsrs" cargo +nightly doc --no-deps --workspace --features=rustls,openssl
+
+# Check for unintentional external type exposure on all crates in workspace.
+check-external-types-all:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for f in $(find . -mindepth 2 -maxdepth 2 -name Cargo.toml); do
+        echo "Checking for $f"
+        just check-external-types-manifest "$f" || true
+        echo
+        echo
+    done
+
+# Check for unintentional external type exposure on all crates in workspace.
+check-external-types-all-table:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for f in $(find . -mindepth 2 -maxdepth 2 -name Cargo.toml); do
+        echo
+        echo "Checking for $f"
+        just check-external-types-manifest "$f" --output-format=markdown-table
+    done
+
+# Check for unintentional external type exposure on a crate.
+check-external-types-manifest manifest_path *extra_args:
+    cargo +nightly check-external-types --manifest-path "{{manifest_path}}" {{extra_args}}
diff --git a/local-channel/Cargo.toml b/local-channel/Cargo.toml
index 613908e6..9577fc2f 100644
--- a/local-channel/Cargo.toml
+++ b/local-channel/Cargo.toml
@@ -12,6 +12,12 @@ license.workspace = true
 edition.workspace = true
 rust-version.workspace = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "futures_core::*",
+    "futures_sink::*",
+]
+
 [dependencies]
 futures-core = "0.3.17"
 futures-sink = "0.3.17"