diff --git a/.github/workflows/licenses.yml b/.github/workflows/licenses.yml
new file mode 100644
index 0000000..3a487a5
--- /dev/null
+++ b/.github/workflows/licenses.yml
@@ -0,0 +1,23 @@
+name: licenses
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-deny:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
+
+      - name: install cargo-deny
+        run: cargo install --locked cargo-deny@0.19.5
+
+      - name: check licenses
+        run: cargo deny --manifest-path rust/conduit/Cargo.toml check licenses
diff --git a/rust/conduit/Cargo.toml b/rust/conduit/Cargo.toml
index 37427f0..663f54d 100644
--- a/rust/conduit/Cargo.toml
+++ b/rust/conduit/Cargo.toml
@@ -4,6 +4,7 @@ version = "0.0.1-RC2"
 edition = "2024"
 rust-version = "1.93"
 description = "BEP to OpenTelemetry trace converter"
+license = "Apache-2.0"
 
 [dependencies]
 # Proto / gRPC
diff --git a/rust/conduit/deny.toml b/rust/conduit/deny.toml
new file mode 100644
index 0000000..b64a4a2
--- /dev/null
+++ b/rust/conduit/deny.toml
@@ -0,0 +1,13 @@
+# Unless explicitly stated otherwise all files in this repository are licensed under the Apache-2.0 License.
+# This product includes software developed at Datadog (https://www.datadoghq.com/) Copyright 2026 Datadog, Inc.
+
+# Permissive licenses only. A crate offering several licenses (e.g. "MIT OR LGPL-2.1") passes
+# when one of them is allowed.
+[licenses]
+allow = [
+    "Apache-2.0",
+    "Apache-2.0 WITH LLVM-exception",
+    "BSD-3-Clause",
+    "MIT",
+    "Unicode-3.0",
+]