diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e0d06714..3995e8e5f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -290,31 +290,14 @@ jobs:
         key: cargo-${{ matrix.toolchain }}-${{ matrix.platform.name }}-${{ hashFiles('Cargo.lock') }}
 
   cargo-deny:
-    name: Run cargo-deny on ${{ matrix.platform.name }}
+    name: Run cargo-deny
     runs-on: ubuntu-latest
 
-    # TODO: remove this matrix when https://github.com/EmbarkStudios/cargo-deny/issues/324 is resolved
-    strategy:
-      fail-fast: false
-      matrix:
-        platform:
-          - { name: 'Android', target: aarch64-linux-android }
-          - { name: 'iOS', target: aarch64-apple-ios }
-          - { name: 'Linux', target: x86_64-unknown-linux-gnu }
-          - { name: 'macOS', target: aarch64-apple-darwin }
-          - { name: 'Redox OS', target: x86_64-unknown-redox }
-          - { name: 'Web', target: wasm32-unknown-unknown }
-          - { name: 'Windows GNU', target: x86_64-pc-windows-gnu }
-          - { name: 'Windows MSVC', target: x86_64-pc-windows-msvc }
-
     steps:
     - uses: taiki-e/checkout-action@v1
     - uses: EmbarkStudios/cargo-deny-action@v2
       with:
-        command: check
         log-level: error
-        manifest-path: winit/Cargo.toml
-        arguments: --all-features --target ${{ matrix.platform.target }}
 
   eslint:
     name: ESLint
diff --git a/deny.toml b/deny.toml
index 90367660a..8f10c78a3 100644
--- a/deny.toml
+++ b/deny.toml
@@ -1,27 +1,25 @@
 # https://embarkstudios.github.io/cargo-deny
 # cargo install cargo-deny
-# cargo update && cargo deny --target aarch64-apple-ios check
-# Note: running just `cargo deny check` without a `--target` will result in
-# false positives due to https://github.com/EmbarkStudios/cargo-deny/issues/324
+# cargo update && cargo deny check
 [graph]
 all-features = true
 exclude-dev = true
 targets = [
-    { triple = "aarch64-apple-darwin" },
-    { triple = "aarch64-apple-ios" },
-    { triple = "aarch64-linux-android" },
-    { triple = "i686-pc-windows-gnu" },
-    { triple = "i686-pc-windows-msvc" },
-    { triple = "i686-unknown-linux-gnu" },
+    "aarch64-apple-darwin",
+    "aarch64-apple-ios",
+    "aarch64-linux-android",
+    "i686-pc-windows-gnu",
+    "i686-pc-windows-msvc",
+    "i686-unknown-linux-gnu",
     { triple = "wasm32-unknown-unknown", features = [
         "atomics",
     ] },
-    { triple = "x86_64-apple-darwin" },
-    { triple = "x86_64-apple-ios" },
-    { triple = "x86_64-pc-windows-gnu" },
-    { triple = "x86_64-pc-windows-msvc" },
-    { triple = "x86_64-unknown-linux-gnu" },
-    { triple = "x86_64-unknown-redox" },
+    "x86_64-apple-darwin",
+    "x86_64-apple-ios",
+    "x86_64-pc-windows-gnu",
+    "x86_64-pc-windows-msvc",
+    "x86_64-unknown-linux-gnu",
+    "x86_64-unknown-redox",
 ]
 
 [licenses]
@@ -33,6 +31,7 @@ allow = [
     "MIT",          # https://tldrlegal.com/license/mit-license
     "Unicode-3.0",  # https://spdx.org/licenses/Unicode-3.0.html
     "Zlib",         # https://spdx.org/licenses/Zlib.html
+    "MPL-2.0",      # https://www.mozilla.org/en-US/MPL/2.0/
 ]
 confidence-threshold = 1.0
 private = { ignore = true }
@@ -40,47 +39,23 @@ private = { ignore = true }
 [bans]
 multiple-versions = "deny"
 skip = [
-    { crate = "bitflags@1", reason = "the ecosystem is in the process of migrating" },
-    { crate = "rustix@0.38", reason = "the ecosystem is in the process of migrating" },
-    { crate = "linux-raw-sys@0.4", reason = "the ecosystem is in the process of migrating" },
     { crate = "jni-sys@0.3", reason = "uses the semver trick to depend on v0.4, but `ndk` hasn't been updated to v0.4 yet" },
     { crate = "thiserror@1.0", reason = "dep of `ndk` crate, yet to be updated" },
     { crate = "thiserror-impl@1.0", reason = "dep of `thiserror`" },
+    { crate = "objc2@0.5", reason = "used by crossfont" },
+    { crate = "objc2-foundation@0.2", reason = "used by crossfont" },
+]
+skip-tree = [
+    { crate = "windows-sys", reason = "foundational but bumps fairly often, nothing we can do about it not having a shared version" },
 ]
-wildcards = "allow" # at least until https://github.com/EmbarkStudios/cargo-deny/issues/241 is fixed
 
 [bans.build]
+bypass = [
+    { crate = "android-activity", allow-globs = ["android-games-sdk/import-games-sdk.sh"] },
+    { crate = "freetype-sys", allow-globs = ["freetype2/*"] },
+    # `crossfont` still depends (partially transitively) on `winapi`.
+    { crate = "winapi-i686-pc-windows-gnu", allow-globs = ["lib/lib*.a"] },
+    { crate = "winapi-x86_64-pc-windows-gnu", allow-globs = ["lib/lib*.a"] },
+]
 include-archives = true
 interpreted = "deny"
-
-[[bans.build.bypass]]
-allow-globs = ["android-games-sdk/import-games-sdk.sh"]
-crate = "android-activity"
-
-[[bans.build.bypass]]
-allow-globs = ["ci/*", "githooks/*"]
-crate = "zerocopy"
-
-[[bans.build.bypass]]
-allow-globs = ["cherry-pick-stable.sh"]
-crate = "libc"
-
-[[bans.build.bypass]]
-allow-globs = ["freetype2/*"]
-crate = "freetype-sys"
-
-[[bans.build.bypass]]
-allow-globs = ["lib/*.a"]
-crate = "windows_i686_gnu"
-
-[[bans.build.bypass]]
-allow-globs = ["lib/*.lib"]
-crate = "windows_i686_msvc"
-
-[[bans.build.bypass]]
-allow-globs = ["lib/*.a"]
-crate = "windows_x86_64_gnu"
-
-[[bans.build.bypass]]
-allow-globs = ["lib/*.lib"]
-crate = "windows_x86_64_msvc"