diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 8fe8f59d3..ca9d2bbeb 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -65,6 +65,29 @@ jobs:
           RUSTDOCFLAGS: -D warnings
         run: cargo +nightly doc --no-deps --workspace --all-features
 
+  check-external-types:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust (nightly-2024-05-01)
+        uses: actions-rust-lang/setup-rust-toolchain@v1.9.0
+        with:
+          toolchain: nightly-2024-05-01
+
+      - name: Install just
+        uses: taiki-e/install-action@v2.38.0
+        with:
+          tool: just
+
+      - name: Install cargo-check-external-types
+        uses: taiki-e/cache-cargo-install-action@v1.2.2
+        with:
+          tool: cargo-check-external-types
+
+      - name: check external types
+        run: just check-external-types-all +nightly-2024-05-01
+
   public-api-diff:
     runs-on: ubuntu-latest
     steps:
@@ -76,7 +99,7 @@ jobs:
       - name: Checkout PR branch
         uses: actions/checkout@v4
 
-      - name: Install Rust
+      - name: Install Rust (nightly-2024-06-07)
         uses: actions-rust-lang/setup-rust-toolchain@v1.9.0
         with:
           toolchain: nightly-2024-06-07
diff --git a/actix-files/Cargo.toml b/actix-files/Cargo.toml
index 7adb8eaf5..57cd4e913 100644
--- a/actix-files/Cargo.toml
+++ b/actix-files/Cargo.toml
@@ -13,9 +13,14 @@ categories = ["asynchronous", "web-programming::http-server"]
 license = "MIT OR Apache-2.0"
 edition = "2021"
 
-[lib]
-name = "actix_files"
-path = "src/lib.rs"
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_http::*",
+    "actix_service::*",
+    "actix_web::*",
+    "http::*",
+    "mime::*",
+]
 
 [features]
 experimental-io-uring = ["actix-web/experimental-io-uring", "tokio-uring"]
diff --git a/actix-http-test/Cargo.toml b/actix-http-test/Cargo.toml
index bfb0a3539..0947579a5 100644
--- a/actix-http-test/Cargo.toml
+++ b/actix-http-test/Cargo.toml
@@ -18,9 +18,17 @@ edition = "2021"
 [package.metadata.docs.rs]
 features = []
 
-[lib]
-name = "actix_http_test"
-path = "src/lib.rs"
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_codec::*",
+    "actix_http::*",
+    "actix_server::*",
+    "awc::*",
+    "bytes::*",
+    "futures_core::*",
+    "http::*",
+    "tokio::*",
+]
 
 [features]
 default = []
diff --git a/actix-http/Cargo.toml b/actix-http/Cargo.toml
index 87e2b391d..4dc0f0bd8 100644
--- a/actix-http/Cargo.toml
+++ b/actix-http/Cargo.toml
@@ -34,9 +34,26 @@ features = [
     "compress-zstd",
 ]
 
-[lib]
-name = "actix_http"
-path = "src/lib.rs"
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_codec::*",
+    "actix_service::*",
+    "actix_tls::*",
+    "actix_utils::*",
+    "bytes::*",
+    "bytestring::*",
+    "encoding_rs::*",
+    "futures_core::*",
+    "h2::*",
+    "http::*",
+    "httparse::*",
+    "language_tags::*",
+    "mime::*",
+    "openssl::*",
+    "rustls::*",
+    "tokio_util::*",
+    "tokio::*",
+]
 
 [features]
 default = []
diff --git a/actix-multipart/Cargo.toml b/actix-multipart/Cargo.toml
index f1289d3a2..5e9b78d84 100644
--- a/actix-multipart/Cargo.toml
+++ b/actix-multipart/Cargo.toml
@@ -16,6 +16,21 @@ edition = "2021"
 rustdoc-args = ["--cfg", "docsrs"]
 all-features = true
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_http::*",
+    "actix_multipart_derive::*",
+    "actix_utils::*",
+    "actix_web::*",
+    "bytes::*",
+    "futures_core::*",
+    "mime::*",
+    "serde_json::*",
+    "serde_plain::*",
+    "serde::*",
+    "tempfile::*",
+]
+
 [features]
 default = ["tempfile", "derive"]
 derive = ["actix-multipart-derive"]
diff --git a/actix-router/Cargo.toml b/actix-router/Cargo.toml
index 56e4bed2f..7e7e3beb8 100644
--- a/actix-router/Cargo.toml
+++ b/actix-router/Cargo.toml
@@ -12,9 +12,11 @@ repository = "https://github.com/actix/actix-web"
 license = "MIT OR Apache-2.0"
 edition = "2021"
 
-[lib]
-name = "actix_router"
-path = "src/lib.rs"
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "http::*",
+    "serde::*",
+]
 
 [features]
 default = ["http", "unicode"]
diff --git a/actix-test/Cargo.toml b/actix-test/Cargo.toml
index 41267c969..e810ae80b 100644
--- a/actix-test/Cargo.toml
+++ b/actix-test/Cargo.toml
@@ -18,6 +18,22 @@ categories = [
 license = "MIT OR Apache-2.0"
 edition = "2021"
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_codec::*",
+    "actix_http_test::*",
+    "actix_http::*",
+    "actix_service::*",
+    "actix_web::*",
+    "awc::*",
+    "bytes::*",
+    "futures_core::*",
+    "http::*",
+    "openssl::*",
+    "rustls::*",
+    "tokio::*",
+]
+
 [features]
 default = []
 
diff --git a/actix-web-actors/Cargo.toml b/actix-web-actors/Cargo.toml
index 114ec5a87..3c74a4f47 100644
--- a/actix-web-actors/Cargo.toml
+++ b/actix-web-actors/Cargo.toml
@@ -9,9 +9,15 @@ repository = "https://github.com/actix/actix-web"
 license = "MIT OR Apache-2.0"
 edition = "2021"
 
-[lib]
-name = "actix_web_actors"
-path = "src/lib.rs"
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix::*",
+    "actix_http::*",
+    "actix_web::*",
+    "bytes::*",
+    "bytestring::*",
+    "futures_core::*",
+]
 
 [dependencies]
 actix = { version = ">=0.12, <0.14", default-features = false }
diff --git a/actix-web/Cargo.toml b/actix-web/Cargo.toml
index 10a507680..3827d4400 100644
--- a/actix-web/Cargo.toml
+++ b/actix-web/Cargo.toml
@@ -35,9 +35,31 @@ features = [
     "secure-cookies",
 ]
 
-[lib]
-name = "actix_web"
-path = "src/lib.rs"
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_http::*",
+    "actix_router::*",
+    "actix_rt::*",
+    "actix_server::*",
+    "actix_service::*",
+    "actix_utils::*",
+    "actix_web_codegen::*",
+    "bytes::*",
+    "cookie::*",
+    "cookie",
+    "futures_core::*",
+    "http::*",
+    "language_tags::*",
+    "mime::*",
+    "openssl::*",
+    "rustls::*",
+    "serde_json::*",
+    "serde_urlencoded::*",
+    "serde::*",
+    "serde::*",
+    "tokio::*",
+    "url::*",
+]
 
 [features]
 default = [
diff --git a/awc/Cargo.toml b/awc/Cargo.toml
index 6ab408ea6..4fc2057f6 100644
--- a/awc/Cargo.toml
+++ b/awc/Cargo.toml
@@ -15,10 +15,6 @@ repository = "https://github.com/actix/actix-web"
 license = "MIT OR Apache-2.0"
 edition = "2021"
 
-[lib]
-name = "awc"
-path = "src/lib.rs"
-
 [package.metadata.docs.rs]
 rustdoc-args = ["--cfg", "docsrs"]
 features = [
@@ -33,6 +29,27 @@ features = [
     "compress-zstd",
 ]
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "actix_codec::*",
+    "actix_http::*",
+    "actix_rt::*",
+    "actix_service::*",
+    "actix_tls::*",
+    "bytes::*",
+    "cookie::*",
+    "cookie",
+    "futures_core::*",
+    "h2::*",
+    "http::*",
+    "openssl::*",
+    "rustls::*",
+    "serde_json::*",
+    "serde_urlencoded::*",
+    "serde::*",
+    "tokio::*",
+]
+
 [features]
 default = ["compress-brotli", "compress-gzip", "compress-zstd", "cookies"]
 
@@ -134,7 +151,7 @@ rcgen = "0.13"
 rustls-pemfile = "2"
 tokio = { version = "1.24.2", features = ["rt-multi-thread", "macros"] }
 zstd = "0.13"
-tls-rustls-0_23 = { package = "rustls", version = "0.23" } # add rustls 0.23 with default features to make aws_lc_rs work in tests 
+tls-rustls-0_23 = { package = "rustls", version = "0.23" } # add rustls 0.23 with default features to make aws_lc_rs work in tests
 
 [[example]]
 name = "client"
diff --git a/justfile b/justfile
index 7f6dbb61e..28b4dfd0a 100644
--- a/justfile
+++ b/justfile
@@ -74,3 +74,29 @@ doc-watch:
 update-readmes: && fmt
     cd ./actix-files && cargo rdme --force
     cd ./actix-router && cargo rdme --force
+
+# Check for unintentional external type exposure on all crates in workspace.
+check-external-types-all toolchain="+nightly":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    exit=0
+    for f in $(find . -mindepth 2 -maxdepth 2 -name Cargo.toml | grep -vE "\-codegen/|\-derive/|\-macros/"); do
+        if ! just check-external-types-manifest "$f" {{toolchain}}; then exit=1; fi
+        echo
+        echo
+    done
+    exit $exit
+
+# Check for unintentional external type exposure on all crates in workspace.
+check-external-types-all-table toolchain="+nightly":
+    #!/usr/bin/env bash
+    set -euo pipefail
+    for f in $(find . -mindepth 2 -maxdepth 2 -name Cargo.toml | grep -vE "\-codegen/|\-derive/|\-macros/"); do
+        echo
+        echo "Checking for $f"
+        just check-external-types-manifest "$f" {{toolchain}} --output-format=markdown-table
+    done
+
+# Check for unintentional external type exposure on a crate.
+check-external-types-manifest manifest_path toolchain="+nightly" *extra_args="":
+    cargo {{toolchain}} check-external-types --manifest-path "{{manifest_path}}" {{extra_args}}