diff --git a/.github/workflows/cargo-machete.yml b/.github/workflows/cargo-machete.yml
new file mode 100644
index 0000000000..89f0662d13
--- /dev/null
+++ b/.github/workflows/cargo-machete.yml
@@ -0,0 +1,25 @@
+name: cargo machete
+
+on:
+  pull_request:
+  push:
+    branches:
+      - 'mq-working-branch-*'
+
+permissions:
+  contents: read
+
+jobs:
+  cargo-machete:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # 4.2.2
+    - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      with:
+        toolchain: 1.87.0
+    - uses: taiki-e/install-action@2c41309d51ede152b6f2ee6bf3b71e6dc9a8b7df # 2.49.27
+      with:
+        tool: cargo-machete@0.9.2
+        fallback: cargo-binstall
+    - name: Check for unused dependencies
+      run: cargo machete --with-metadata --skip-target-dir
diff --git a/Cargo.lock b/Cargo.lock
index 3865db1e26..f8911e78be 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -135,12 +135,6 @@ version = "1.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "69f7f8c3906b62b754cd5326047894316021dcfe5a194c8ea52bdd94934a3457"
 
-[[package]]
-name = "arrayref"
-version = "0.3.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "76a2e8124351fda1ef8aaaa3bbd7ebbcb486bbcd4225aca0aa0d84bb2db8fecb"
-
 [[package]]
 name = "assert-json-diff"
 version = "2.0.2"
@@ -468,7 +462,6 @@ dependencies = [
  "libc",
  "libdd-common",
  "libdd-crashtracker",
- "libdd-profiling",
  "nix 0.29.0",
  "once_cell",
  "os_info",
@@ -716,7 +709,6 @@ name = "build_common"
 version = "44.0.0"
 dependencies = [
  "cbindgen",
- "serde",
  "serde_json",
 ]
 
@@ -1385,7 +1377,6 @@ version = "0.0.1"
 dependencies = [
  "anyhow",
  "arc-swap",
- "arrayref",
  "base64 0.22.1",
  "bincode",
  "chrono",
@@ -1394,7 +1385,6 @@ dependencies = [
  "datadog-sidecar-macros",
  "futures",
  "http 1.1.0",
- "http-body-util",
  "httpmock",
  "libc",
  "libdd-capabilities",
@@ -1416,13 +1406,10 @@ dependencies = [
  "libdd-trace-utils",
  "manual_future",
  "memory-stats",
- "microseh",
  "nix 0.29.0",
  "prctl",
  "priority-queue",
  "rand 0.8.8",
- "rmp-serde",
- "sendfd",
  "serde",
  "serde_json",
  "serde_with",
@@ -1437,8 +1424,6 @@ dependencies = [
  "tracing-log",
  "tracing-subscriber",
  "winapi 0.3.9",
- "windows 0.51.1",
- "windows-sys 0.52.0",
  "zwohash",
 ]
 
@@ -1461,10 +1446,8 @@ dependencies = [
  "libdd-telemetry-ffi",
  "libdd-tinybytes",
  "libdd-trace-utils",
- "paste",
  "rmp-serde",
  "serde_json",
- "tempfile",
  "tracing",
 ]
 
@@ -2739,7 +2722,6 @@ dependencies = [
  "rustls",
  "serde",
  "serde_json",
- "serial_test",
  "thiserror 2.0.17",
  "tokio",
  "tracing",
@@ -2791,7 +2773,6 @@ dependencies = [
  "const_format",
  "criterion",
  "futures",
- "futures-core",
  "futures-util",
  "hex",
  "http 1.1.0",
@@ -2814,7 +2795,6 @@ dependencies = [
  "regex-lite",
  "reqwest",
  "rustls",
- "rustls-native-certs",
  "rustls-platform-verifier",
  "rustls-webpki",
  "serde",
@@ -2822,7 +2802,6 @@ dependencies = [
  "tempfile",
  "thiserror 2.0.17",
  "tokio",
- "tokio-rustls",
  "tower-service",
  "windows-sys 0.52.0",
 ]
@@ -2894,7 +2873,6 @@ dependencies = [
  "libdd-common",
  "libdd-common-ffi",
  "libdd-crashtracker",
- "serde",
  "serde_json",
  "symbolic-common",
  "symbolic-demangle",
@@ -2915,7 +2893,6 @@ dependencies = [
  "duplicate",
  "either",
  "futures",
- "getrandom 0.2.15",
  "h2",
  "http 1.1.0",
  "http-body-util",
@@ -2932,7 +2909,6 @@ dependencies = [
  "libdd-shared-runtime",
  "libdd-telemetry",
  "libdd-tinybytes",
- "libdd-trace-normalization",
  "libdd-trace-obfuscation",
  "libdd-trace-protobuf",
  "libdd-trace-stats",
@@ -3050,12 +3026,9 @@ dependencies = [
  "pyo3",
  "semver",
  "serde",
- "serde-bool",
  "serde_json",
- "serde_with",
  "thiserror 2.0.17",
  "tokio",
- "url",
 ]
 
 [[package]]
@@ -3114,7 +3087,6 @@ dependencies = [
  "anyhow",
  "bincode",
  "criterion",
- "futures",
  "glibc_version",
  "io-lifetimes",
  "libc",
@@ -3127,14 +3099,11 @@ dependencies = [
  "memfd",
  "nix 0.29.0",
  "page_size",
- "pretty_assertions",
- "sendfd",
  "serde",
  "spawn_worker",
  "tempfile",
  "tokio",
  "tracing",
- "tracing-subscriber",
  "winapi 0.3.9",
  "windows-sys 0.48.0",
  "zwohash",
@@ -3160,7 +3129,6 @@ dependencies = [
  "memfd",
  "prost",
  "rand 0.8.8",
- "rmp",
  "rmp-serde",
  "serde",
  "serde_yaml",
@@ -3178,7 +3146,6 @@ dependencies = [
  "libdd-common",
  "libdd-common-ffi",
  "libdd-library-config",
- "tempfile",
 ]
 
 [[package]]
@@ -3230,7 +3197,6 @@ dependencies = [
  "serde_json",
  "tokio",
  "tokio-util",
- "uuid",
 ]
 
 [[package]]
@@ -3281,24 +3247,19 @@ dependencies = [
  "bitmaps",
  "bolero",
  "byteorder",
- "bytes",
  "chrono",
  "criterion",
  "crossbeam-channel",
  "crossbeam-utils",
  "cxx",
  "cxx-build",
- "futures",
  "hashbrown 0.17.1",
  "http 1.1.0",
- "http-body-util",
- "httparse",
  "indexmap 2.12.1",
  "libdd-alloc",
  "libdd-common",
  "libdd-profiling",
  "libdd-profiling-protobuf",
- "mime",
  "parking_lot",
  "proptest",
  "prost",
@@ -3327,8 +3288,6 @@ dependencies = [
  "anyhow",
  "build_common",
  "function_name",
- "futures",
- "http-body-util",
  "hyper",
  "libc",
  "libdd-common",
@@ -3424,10 +3383,8 @@ dependencies = [
  "manual_future",
  "prost",
  "rand 0.8.8",
- "ring",
  "serde",
  "serde_json",
- "serde_with",
  "sha2",
  "strum",
  "strum_macros",
@@ -3485,7 +3442,6 @@ dependencies = [
  "base64 0.22.1",
  "bytes",
  "futures",
- "getrandom 0.2.15",
  "hashbrown 0.17.1",
  "http 1.1.0",
  "httpmock",
@@ -3515,7 +3471,6 @@ version = "44.0.0"
 dependencies = [
  "build_common",
  "function_name",
- "libc",
  "libdd-capabilities-impl",
  "libdd-common",
  "libdd-common-ffi",
@@ -3609,7 +3564,6 @@ dependencies = [
  "rmp-serde",
  "serde",
  "tokio",
- "tokio-util",
  "tracing",
  "web-time",
 ]
@@ -3881,17 +3835,6 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
-[[package]]
-name = "microseh"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26b2a7c5ccfb370edd57fda423f3a551516ee127e10bc22a6215e8c63b20a38"
-dependencies = [
- "cc",
- "libc",
- "windows-sys 0.42.0",
-]
-
 [[package]]
 name = "mime"
 version = "0.3.17"
@@ -5333,16 +5276,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "sendfd"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "604b71b8fc267e13bb3023a2c901126c8f349393666a6d98ac1ae5729b701798"
-dependencies = [
- "libc",
- "tokio",
-]
-
 [[package]]
 name = "serde"
 version = "1.0.228"
@@ -5353,15 +5286,6 @@ dependencies = [
  "serde_derive",
 ]
 
-[[package]]
-name = "serde-bool"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8fdd050c9c2ed5ae1fb29e71be0a6efdd9df43c7cb13ea5826528cfe10c51db0"
-dependencies = [
- "serde",
-]
-
 [[package]]
 name = "serde-transcode"
 version = "1.1.1"
@@ -5977,8 +5901,6 @@ name = "test_spawn_from_lib"
 version = "0.0.1"
 dependencies = [
  "anyhow",
- "io-lifetimes",
- "libc",
  "spawn_worker",
  "tempfile",
 ]
@@ -6923,21 +6845,6 @@ dependencies = [
  "windows-targets 0.53.5",
 ]
 
-[[package]]
-name = "windows-sys"
-version = "0.42.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5a3e1820f08b8513f676f7ab6c1f99ff312fb97b553d30ff4dd86f9f15728aa7"
-dependencies = [
- "windows_aarch64_gnullvm 0.42.2",
- "windows_aarch64_msvc 0.42.2",
- "windows_i686_gnu 0.42.2",
- "windows_i686_msvc 0.42.2",
- "windows_x86_64_gnu 0.42.2",
- "windows_x86_64_gnullvm 0.42.2",
- "windows_x86_64_msvc 0.42.2",
-]
-
 [[package]]
 name = "windows-sys"
 version = "0.45.0"
diff --git a/Cargo.toml b/Cargo.toml
index 84837be117..c7111d5728 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -69,6 +69,31 @@ members = [
 # https://doc.rust-lang.org/cargo/reference/resolver.html
 resolver = "2"
 
+[workspace.metadata.cargo-machete]
+ignored = [
+  # Used from build scripts, which cargo-machete does not scan.
+  "bindgen",
+  "build_common",
+  "cc",
+  "cc_utils",
+  "cxx-build",
+  "glibc_version",
+  "prost-build",
+  "protoc-bin-vendored",
+  # Hidden by symlinked source, benchmark discovery, or proc-macro expansion.
+  "anyhow",
+  "criterion",
+  "strum",
+  # Intentional feature or dependency-resolution wiring without direct imports.
+  "cargo-platform",
+  "getrandom",
+  "libdd-capabilities-impl",
+  "rustls-webpki",
+  # Self dev-dependencies enable optional features in their own tests.
+  "libdd-profiling-protobuf",
+  "libdd-tinybytes",
+]
+
 # These are used by many packages, but not all. For instance, the sidecar and
 # serverless packages wanted to maintain their own version numbers. Some of
 # their depenencies also remain under their own versioning.
@@ -95,7 +120,6 @@ allocator-api2 = { version = "0.2.21", default-features = false }
 anyhow = { version = "1.0", default-features = false }
 arbitrary = { version = "1.3", default-features = false }
 arc-swap = { version = "1.7.1", default-features = false }
-arrayref = { version = "0.3.7", default-features = false }
 assert_no_alloc = { version = "1.1.2", default-features = false }
 async-trait = { version = "0.1", default-features = false }
 base64 = { version = "0.22", default-features = false }
@@ -179,7 +203,6 @@ maplit = { version = "1.0", default-features = false }
 md5 = { version = "0.7.0", default-features = false }
 memfd = { version = "0.6", default-features = false }
 memory-stats = { version = "1.2.0", default-features = false }
-microseh = { version = "0.1.1", default-features = false }
 mime = { version = "0.3.16", default-features = false }
 multer = { version = "3.1", default-features = false }
 nix = { version = "0.29", default-features = false }
@@ -218,14 +241,11 @@ rmp-serde = { version = "1.3.0", default-features = false }
 rmpv = { version = "1.3.0", default-features = false }
 rustc-hash = { version = "2.1.1", default-features = false }
 rustls = { version = "0.23", default-features = false }
-rustls-native-certs = { version = ">=0.8.1, <0.8.3", default-features = false }
 rustls-platform-verifier = { version = "0.6", default-features = false }
 rustls-webpki = { version = ">=0.103.13", default-features = false }
 schemars = { version = "0.8.21", default-features = false }
 semver = { version = "1.0", default-features = false }
-sendfd = { version = "0.4", default-features = false }
 serde = { version = "1.0", default-features = false }
-serde-bool = { version = "0.1.3", default-features = false }
 serde-transcode = { version = "1.1", default-features = false }
 serde_bytes = { version = "0.11.9", default-features = false }
 # serde_json requires at least one of `std` or `alloc`. We set `alloc` here as
@@ -260,7 +280,6 @@ thiserror = { version = "2.0.3", default-features = false }
 thread_local = { version = "1.1", default-features = false }
 time = { version = "0.3", default-features = false }
 tokio = { version = "1.49", default-features = false }
-tokio-rustls = { version = "0.26", default-features = false }
 tokio-util = { version = "0.7.11", default-features = false }
 toml = { version = "0.8.19", default-features = false }
 tonic = { version = "0.14", default-features = false }
diff --git a/LICENSE-3rdparty.csv b/LICENSE-3rdparty.csv
index 0d78132813..993782fc88 100644
--- a/LICENSE-3rdparty.csv
+++ b/LICENSE-3rdparty.csv
@@ -15,7 +15,6 @@ anstyle-wincon,https://github.com/rust-cli/anstyle,MIT OR Apache-2.0,The anstyle
 anyhow,https://github.com/dtolnay/anyhow,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 arbitrary,https://github.com/rust-fuzz/arbitrary,MIT OR Apache-2.0,"The Rust-Fuzz Project Developers, Nick Fitzgerald <fitzgen@gmail.com>, Manish Goregaokar <manishsmail@gmail.com>, Simonas Kazlauskas <arbitrary@kazlauskas.me>, Brian L. Troutwine <brian@troutwine.us>, Corey Farwell <coreyf@rwell.org>"
 arc-swap,https://github.com/vorner/arc-swap,MIT OR Apache-2.0,Michal 'vorner' Vaner <vorner@vorner.cz>
-arrayref,https://github.com/droundy/arrayref,BSD-2-Clause,David Roundy <roundyd@physics.oregonstate.edu>
 assert-json-diff,https://github.com/davidpdrsn/assert-json-diff,MIT,David Pedersen <david.pdrsn@gmail.com>
 async-attributes,https://github.com/async-rs/async-attributes,MIT OR Apache-2.0,Yoshua Wuyts <yoshuawuyts@gmail.com>
 async-channel,https://github.com/smol-rs/async-channel,Apache-2.0 OR MIT,Stjepan Glavina <stjepang@gmail.com>
@@ -242,7 +241,6 @@ memfd,https://github.com/lucab/memfd-rs,MIT OR Apache-2.0,"Luca Bruno <lucab@luc
 memmap2,https://github.com/RazrFalcon/memmap2-rs,MIT OR Apache-2.0,"Dan Burkert <dan@danburkert.com>, Yevhenii Reizner <razrfalcon@gmail.com>"
 memoffset,https://github.com/Gilnaa/memoffset,MIT,Gilad Naaman <gilad.naaman@gmail.com>
 memory-stats,https://github.com/Arc-blroth/memory-stats,MIT OR Apache-2.0,Arc-blroth <45273859+Arc-blroth@users.noreply.github.com>
-microseh,https://github.com/sonodima/microseh,MIT,sonodima
 mime,https://github.com/hyperium/mime,MIT OR Apache-2.0,Sean McArthur <sean@seanmonstar.com>
 mime_guess,https://github.com/abonander/mime_guess,MIT,Austin Bonander <austin.bonander@gmail.com>
 minicov,https://github.com/Amanieu/minicov,Apache-2.0 OR MIT,Amanieu d'Antras <amanieu@gmail.com>
@@ -374,9 +372,7 @@ sdd,https://github.com/wvwwvwwv/scalable-delayed-dealloc,Apache-2.0,wvwwvwwv <wv
 security-framework,https://github.com/kornelski/rust-security-framework,MIT OR Apache-2.0,"Steven Fackler <sfackler@gmail.com>, Kornel <kornel@geekhood.net>"
 security-framework-sys,https://github.com/kornelski/rust-security-framework,MIT OR Apache-2.0,"Steven Fackler <sfackler@gmail.com>, Kornel <kornel@geekhood.net>"
 semver,https://github.com/dtolnay/semver,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
-sendfd,https://github.com/standard-ai/sendfd,Apache-2.0 OR BSD-3-Clause,"Simonas Kazlauskas <simonas@standard.ai>, Bernardo Meurer <bernardo@standard.ai>, Léo Gaspard <leo@standard.ai>"
 serde,https://github.com/serde-rs/serde,MIT OR Apache-2.0,"Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com>"
-serde-bool,https://github.com/x52dev/serde-utils,MIT OR Apache-2.0,Rob Ede <robjtede@icloud.com>
 serde-transcode,https://github.com/sfackler/serde-transcode,MIT OR Apache-2.0,Steven Fackler <sfackler@palantir.com>
 serde_bytes,https://github.com/serde-rs/bytes,MIT OR Apache-2.0,David Tolnay <dtolnay@gmail.com>
 serde_core,https://github.com/serde-rs/serde,MIT OR Apache-2.0,"Erick Tryzelaar <erick.tryzelaar@gmail.com>, David Tolnay <dtolnay@gmail.com>"
diff --git a/bin_tests/Cargo.toml b/bin_tests/Cargo.toml
index db94baea3f..d83d1e10da 100644
--- a/bin_tests/Cargo.toml
+++ b/bin_tests/Cargo.toml
@@ -14,7 +14,6 @@ build = "build.rs"
 once_cell = { workspace = true, features = ["std"] }
 anyhow = { workspace = true, default-features = true }
 current_platform.workspace = true
-libdd-profiling = { path = "../libdd-profiling" }
 libdd-crashtracker = { path = "../libdd-crashtracker" }
 libdd-common = { path = "../libdd-common" }
 tempfile.workspace = true
diff --git a/build-common/Cargo.toml b/build-common/Cargo.toml
index bb848a0dda..3dd79db7d5 100644
--- a/build-common/Cargo.toml
+++ b/build-common/Cargo.toml
@@ -15,7 +15,6 @@ cbindgen = []
 
 [dependencies]
 cbindgen = { version = "0.29" }
-serde = "1.0"
 serde_json = "1.0"
 
 [lib]
diff --git a/datadog-sidecar-ffi/Cargo.toml b/datadog-sidecar-ffi/Cargo.toml
index b528abb5f3..1035f0b90d 100644
--- a/datadog-sidecar-ffi/Cargo.toml
+++ b/datadog-sidecar-ffi/Cargo.toml
@@ -23,7 +23,6 @@ libdd-remote-config = { path = "../libdd-remote-config" }
 libdd-live-debugger = { path = "../libdd-live-debugger" }
 libdd-dogstatsd-client = { path = "../libdd-dogstatsd-client" }
 libdd-tinybytes = { path = "../libdd-tinybytes", features = ["bytes_string"] }
-paste.workspace = true
 libc.workspace = true
 tracing.workspace = true
 rmp-serde.workspace = true
@@ -39,7 +38,6 @@ libdd-crashtracker-ffi = { path = "../libdd-crashtracker-ffi", features = ["coll
 [dev-dependencies]
 http = { workspace = true, features = ["std"] }
 libdd-trace-utils = { path = "../libdd-trace-utils", features = ["test-utils"] }
-tempfile.workspace = true
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = [
diff --git a/datadog-sidecar/Cargo.toml b/datadog-sidecar/Cargo.toml
index 978f722228..b488a3a840 100644
--- a/datadog-sidecar/Cargo.toml
+++ b/datadog-sidecar/Cargo.toml
@@ -17,7 +17,6 @@ stats-obfuscation = ["libdd-trace-stats/stats-obfuscation", "libdd-data-pipeline
 [dependencies]
 anyhow = { workspace = true, default-features = true }
 arc-swap = { workspace = true, optional = true }
-arrayref.workspace = true
 priority-queue = { workspace = true, default-features = true }
 libdd-common = { path = "../libdd-common" }
 libdd-capabilities = { path = "../libdd-capabilities", version = "3.0.1" }
@@ -37,13 +36,11 @@ libdd-tinybytes = { path = "../libdd-tinybytes" }
 futures.workspace = true
 manual_future.workspace = true
 http = { workspace = true, features = ["std"] }
-http-body-util.workspace = true
 
 libdd-ipc = { path = "../libdd-ipc", features = ["tiny-bytes"] }
 libdd-ipc-macros = { path = "../libdd-ipc-macros" }
 
 rand = { workspace = true, default-features = true }
-rmp-serde.workspace = true
 serde = { workspace = true, default-features = true, features = ["derive", "rc"] }
 serde_with = { workspace = true, default-features = true }
 bincode.workspace = true
@@ -68,14 +65,6 @@ libc.workspace = true
 # watchdog and self telemetry
 memory-stats = { workspace = true, features = ["always_use_statm"] }
 
-[target.'cfg(windows)'.dependencies.windows]
-features = [
-    "Win32_Foundation",
-    "Wdk_Storage_FileSystem",
-    "Win32_System_IO",
-    "Win32_System_WindowsProgramming",
-]
-version = "0.51.0"
 
 # unstable-only feature
 [target.'cfg(all(tokio_unstable, target_os = "linux"))'.dependencies]
@@ -90,16 +79,12 @@ libdd-capabilities-impl = { path = "../libdd-capabilities-impl" }
 
 [target.'cfg(unix)'.dependencies]
 nix = { workspace = true, features = ["socket", "mman"] }
-sendfd = { workspace = true, features = ["tokio"] }
 
 [target.'cfg(windows)'.dependencies]
 libdd-common-ffi = { path = "../libdd-common-ffi", default-features = false }
 libdd-crashtracker-ffi = { path = "../libdd-crashtracker-ffi", default-features = false, features = ["collector", "collector_windows"] }
 winapi = { version = "0.3.9", features = ["securitybaseapi", "sddl", "winerror", "winbase"] }
-windows-sys = { version = "0.52.0", features = ["Win32_System_SystemInformation"] }
 
-[target.'cfg(windows_seh_wrapper)'.dependencies]
-microseh.workspace = true
 
 [dev-dependencies]
 libc.workspace = true
diff --git a/libdd-agent-client/Cargo.toml b/libdd-agent-client/Cargo.toml
index da4a551f54..63a57dab5a 100644
--- a/libdd-agent-client/Cargo.toml
+++ b/libdd-agent-client/Cargo.toml
@@ -36,5 +36,4 @@ tracing.workspace = true
 [dev-dependencies]
 httpmock.workspace = true
 rustls = { workspace = true, features = ["ring"] }
-serial_test.workspace = true
 tokio = { workspace = true, features = ["rt", "macros"] }
diff --git a/libdd-common/Cargo.toml b/libdd-common/Cargo.toml
index ccfc470fa3..9e0d279f5b 100644
--- a/libdd-common/Cargo.toml
+++ b/libdd-common/Cargo.toml
@@ -18,7 +18,6 @@ bench = false
 [dependencies]
 anyhow.workspace = true
 futures = { workspace = true, features = ["alloc", "executor"] }
-futures-core.workspace = true
 futures-util.workspace = true
 hex = { workspace = true, default-features = true }
 httparse = { workspace = true, features = ["std"], optional = true }
@@ -37,10 +36,8 @@ regex-lite = { workspace = true, default-features = true, optional = true }
 # backend. We install the ring provider explicitly in connector/mod.rs instead.
 reqwest = { workspace = true, features = ["rustls-no-provider", "hickory-dns"], optional = true }
 criterion = { workspace = true, optional = true }
-rustls-native-certs = { workspace = true, optional = true }
 rustls-platform-verifier = { workspace = true, optional = true }
 thiserror = { workspace = true, default-features = true }
-tokio-rustls = { workspace = true, optional = true }
 serde = { workspace = true, default-features = true, features = ["derive"] }
 static_assertions.workspace = true
 const_format.workspace = true
@@ -100,7 +97,7 @@ http-client = [
     "dep:tokio",
 ]
 # TLS plumbing without a crypto provider. Use `https` or `fips` to select one.
-tls-core = ["http-client", "tokio-rustls", "rustls", "hyper-rustls","rustls-native-certs", "rustls-platform-verifier"]
+tls-core = ["http-client", "rustls", "hyper-rustls", "rustls-platform-verifier"]
 # Default HTTPS: ring as crypto provider
 https = ["tls-core", "rustls/ring", "hyper-rustls/ring"]
 use_webpki_roots = ["hyper-rustls/webpki-roots"]
diff --git a/libdd-crashtracker-ffi/Cargo.toml b/libdd-crashtracker-ffi/Cargo.toml
index 099de42a57..2ae3e53061 100644
--- a/libdd-crashtracker-ffi/Cargo.toml
+++ b/libdd-crashtracker-ffi/Cargo.toml
@@ -46,9 +46,6 @@ symbolic-common = { workspace = true, optional = true }
 function_name.workspace = true
 libc.workspace = true
 serde_json.workspace = true
-# serde is not referenced by this crate's code; keep only the `derive` feature
-# (serde_json in tests pulls in the rest transitively).
-serde = { workspace = true, features = ["derive"] }
 
 [target.'cfg(windows)'.dependencies]
 windows = { version = "0.59.0", features = ["Win32_System_Diagnostics_Debug", "Win32_System_ErrorReporting"] }
diff --git a/libdd-data-pipeline/Cargo.toml b/libdd-data-pipeline/Cargo.toml
index 7c7dc1e896..438f3daae8 100644
--- a/libdd-data-pipeline/Cargo.toml
+++ b/libdd-data-pipeline/Cargo.toml
@@ -38,7 +38,6 @@ libdd-common = { version = "6.0.0", path = "../libdd-common", default-features =
 libdd-shared-runtime = { version = "4.0.0", path = "../libdd-shared-runtime", default-features = false }
 libdd-telemetry = { version = "8.0.0", path = "../libdd-telemetry", default-features = false, optional = true}
 libdd-trace-protobuf = { version = "5.0.0", path = "../libdd-trace-protobuf" }
-libdd-trace-normalization = { version = "4.0.0", path = "../libdd-trace-normalization" }
 libdd-trace-stats = { version = "9.0.0", path = "../libdd-trace-stats", default-features = false, features = ["dogstatsd"] }
 libdd-trace-utils = { version = "12.0.0", path = "../libdd-trace-utils", default-features = false }
 libdd-trace-obfuscation = { version = "8.0.0", path = "../libdd-trace-obfuscation", default-features = false }
@@ -61,7 +60,6 @@ hyper-util = { workspace = true, features = ["tokio"] }
 rand.workspace = true
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
-getrandom = { workspace = true, features = ["js"] }
 uuid = { workspace = true, features = ["js", "std"] }
 
 [lib]
diff --git a/libdd-ffe/Cargo.toml b/libdd-ffe/Cargo.toml
index 6b71754be9..28e77d8824 100644
--- a/libdd-ffe/Cargo.toml
+++ b/libdd-ffe/Cargo.toml
@@ -27,10 +27,7 @@ http = { workspace = true, features = ["std"], optional = true }
 tokio = { workspace = true, features = ["time"], optional = true }
 # Uses semver::Version::parse in runtime code; parse is available without std (alloc fallback).
 semver.workspace = true
-serde-bool.workspace = true
-serde_with = { workspace = true, features = ["base64", "hex", "macros"] }
 thiserror.workspace = true
-url = { workspace = true, features = ["std"] }
 lru = { workspace = true, default-features = true, optional = true }
 libdd-trace-protobuf = { version = "5.0.0", path = "../libdd-trace-protobuf", optional = true }
 # Hand-written generated-style code uses #[derive(::prost::Message)] and ::prost::alloc types.
diff --git a/libdd-ipc/Cargo.toml b/libdd-ipc/Cargo.toml
index 76678943ef..d089612323 100644
--- a/libdd-ipc/Cargo.toml
+++ b/libdd-ipc/Cargo.toml
@@ -14,7 +14,6 @@ rust-version.workspace = true
 anyhow.workspace = true
 zwohash.workspace = true
 bincode.workspace = true
-futures.workspace = true
 io-lifetimes = { workspace = true, features = ["close"] }
 page_size.workspace = true
 memfd.workspace = true
@@ -32,8 +31,6 @@ tracing.workspace = true
 
 [dev-dependencies]
 criterion.workspace = true
-# Unused in this crate's sources; kept with defaults (the crate needs its own `std` to compile).
-pretty_assertions = { workspace = true, default-features = true }
 tempfile.workspace = true
 tokio = { workspace = true, features = [
     "macros",
@@ -43,14 +40,10 @@ tokio = { workspace = true, features = [
     "fs",
     "io-util",
 ] }
-# Both appear unused in this crate's tests/benches; keep them with no default features.
-tracing.workspace = true
-tracing-subscriber.workspace = true
 spawn_worker = { path = "../spawn_worker" }
 
 [target.'cfg(not(windows))'.dependencies]
 nix = { workspace = true, features = ["fs", "mman", "process", "poll", "socket", "uio", "user"] }
-sendfd = { workspace = true, features = ["tokio"] }
 tokio = { workspace = true, features = ["sync", "io-util"] }
 
 [target.'cfg(target_env = "gnu")'.build-dependencies]
diff --git a/libdd-library-config-ffi/Cargo.toml b/libdd-library-config-ffi/Cargo.toml
index 83fb5346bd..9f6e689f97 100644
--- a/libdd-library-config-ffi/Cargo.toml
+++ b/libdd-library-config-ffi/Cargo.toml
@@ -28,7 +28,6 @@ regex-lite = ["libdd-common-ffi/regex-lite"]
 build_common = { path = "../build-common" }
 
 [dev-dependencies]
-tempfile.workspace = true
 
 [lints.clippy]
 std_instead_of_alloc = "warn"
diff --git a/libdd-library-config/Cargo.toml b/libdd-library-config/Cargo.toml
index 784bff8011..a6b917adad 100644
--- a/libdd-library-config/Cargo.toml
+++ b/libdd-library-config/Cargo.toml
@@ -27,8 +27,6 @@ serde_yaml.workspace = true
 prost = { workspace = true, features = ["std"] }
 anyhow.workspace = true
 rand = { workspace = true, default-features = true }
-# Direct dep unused in sources (only rmp-serde is used, which pulls rmp itself).
-rmp.workspace = true
 rmp-serde.workspace = true
 
 libdd-trace-protobuf = { version = "5.0.0", path = "../libdd-trace-protobuf" }
diff --git a/libdd-live-debugger-ffi/Cargo.toml b/libdd-live-debugger-ffi/Cargo.toml
index e04c8df03c..c351402fc5 100644
--- a/libdd-live-debugger-ffi/Cargo.toml
+++ b/libdd-live-debugger-ffi/Cargo.toml
@@ -15,7 +15,6 @@ libdd-live-debugger = { path = "../libdd-live-debugger" }
 libdd-common = { path = "../libdd-common" }
 libdd-common-ffi = { path = "../libdd-common-ffi", default-features = false }
 percent-encoding = { workspace = true, features = ["std"] }
-uuid = { workspace = true, features = ["v4", "std"] }
 serde_json.workspace = true
 tokio.workspace = true
 tokio-util = { workspace = true, features = ["rt"] }
diff --git a/libdd-profiling-ffi/Cargo.toml b/libdd-profiling-ffi/Cargo.toml
index 06da30ac6c..fb42241094 100644
--- a/libdd-profiling-ffi/Cargo.toml
+++ b/libdd-profiling-ffi/Cargo.toml
@@ -80,8 +80,6 @@ libdd-telemetry-ffi = { path = "../libdd-telemetry-ffi", default-features = fals
 libdd-ddsketch-ffi = { path = "../libdd-ddsketch-ffi", default-features = false, optional = true }
 libdd-log-ffi = { path = "../libdd-log-ffi", default-features = false, optional = true }
 function_name.workspace = true
-futures.workspace = true
-http-body-util.workspace = true
 hyper = { workspace = true, features = ["http1", "client"] }
 libc.workspace = true
 serde_json.workspace = true
diff --git a/libdd-profiling/Cargo.toml b/libdd-profiling/Cargo.toml
index 2b7bcb7356..06b7b45a51 100644
--- a/libdd-profiling/Cargo.toml
+++ b/libdd-profiling/Cargo.toml
@@ -32,21 +32,16 @@ bitmaps = { workspace = true, default-features = true }
 # std is byteorder's only default feature; the workspace disables default
 # features, so enable std explicitly.
 byteorder = { workspace = true, features = ["std"] }
-bytes = { workspace = true, features = ["std"] }
 chrono = { workspace = true, features = ["std", "clock"] }
 crossbeam-channel = { workspace = true, default-features = true }
 crossbeam-utils = { workspace = true, default-features = true }
 cxx = { workspace = true, default-features = true, optional = true }
-futures.workspace = true
 hashbrown.workspace = true
 http = { workspace = true, features = ["std"] }
-http-body-util.workspace = true
-httparse = { workspace = true, features = ["std"] }
 indexmap = { workspace = true, default-features = true }
 libdd-alloc = { version = "1.0.0", path = "../libdd-alloc" }
 libdd-common = { version = "6.0.0", path = "../libdd-common", default-features = false, features = ["reqwest", "test-utils"] }
 libdd-profiling-protobuf = { version = "2.0.0", path = "../libdd-profiling-protobuf", features = ["prost_impls"] }
-mime.workspace = true
 parking_lot.workspace = true
 # Only the prost::Message trait is used here; the Message derives live in
 # libdd-profiling-protobuf (which enables prost/derive for its generated code).
diff --git a/libdd-remote-config/Cargo.toml b/libdd-remote-config/Cargo.toml
index cbdb7c61bc..8a6561765f 100644
--- a/libdd-remote-config/Cargo.toml
+++ b/libdd-remote-config/Cargo.toml
@@ -12,7 +12,6 @@ description = "Datadog Remote Configuration client and config parsers"
 [features]
 default = ["client", "https"]
 agentless = [
-    "dep:ring",
     "dep:tuf",
     "dep:chrono",
     "dep:prost",
@@ -66,7 +65,6 @@ time = { workspace = true, features = ["parsing", "serde", "formatting"], option
 tracing = { workspace = true, optional = true }
 serde.workspace = true
 serde_json = { workspace = true, features = ["raw_value"] }
-serde_with.workspace = true
 rand = { workspace = true, default-features = true, optional = true }
 thiserror = { workspace = true, default-features = true }
 hashbrown = { workspace = true, default-features = true }
@@ -88,8 +86,8 @@ hyper-util = { workspace = true, features = [
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 getrandom = { workspace = true, features = ["js"] }
-# For `tuf` ring needs this feature for `SystemRandom` on wasm.
-ring = { workspace = true, default-features = true, features = ["wasm32_unknown_unknown_js"], optional = true }
+# Enable `tuf`'s `SystemRandom` implementation in JavaScript runtimes.
+tuf = { workspace = true, optional = true, features = ["wasm32_unknown_unknown_js"] }
 
 [target.'cfg(not(target_arch = "wasm32"))'.dependencies]
 libdd-capabilities-impl = { path = "../libdd-capabilities-impl", version = "5.0.0", default-features = false }
diff --git a/libdd-telemetry-ffi/Cargo.toml b/libdd-telemetry-ffi/Cargo.toml
index 113805f60b..0372b7e2f7 100644
--- a/libdd-telemetry-ffi/Cargo.toml
+++ b/libdd-telemetry-ffi/Cargo.toml
@@ -28,7 +28,6 @@ libdd-telemetry = { path = "../libdd-telemetry" }
 libdd-common = { path = "../libdd-common" }
 libdd-common-ffi = { path = "../libdd-common-ffi", default-features = false }
 function_name.workspace = true
-libc.workspace = true
 paste.workspace = true
 
 [dev-dependencies]
diff --git a/libdd-telemetry/Cargo.toml b/libdd-telemetry/Cargo.toml
index 33258a1681..c72b290e6c 100644
--- a/libdd-telemetry/Cargo.toml
+++ b/libdd-telemetry/Cargo.toml
@@ -44,7 +44,6 @@ web-time.workspace = true
 sys-info.workspace = true
 
 [target.'cfg(target_arch = "wasm32")'.dependencies]
-getrandom = { workspace = true, features = ["js"] }
 uuid = { workspace = true, features = ["js", "std"] }
 
 [target."cfg(unix)".dependencies]
diff --git a/libdd-trace-stats/Cargo.toml b/libdd-trace-stats/Cargo.toml
index 6023acffb9..223271a74d 100644
--- a/libdd-trace-stats/Cargo.toml
+++ b/libdd-trace-stats/Cargo.toml
@@ -26,7 +26,6 @@ http = { workspace = true, features = ["std"] }
 rmp-serde.workspace = true
 serde = { workspace = true, features = ["derive"] }
 tokio = { workspace = true, features = ["macros", "time"] }
-tokio-util.workspace = true
 tracing.workspace = true
 async-trait.workspace = true
 # Cross-platform `SystemTime`; `std::time::SystemTime::now()` panics on wasm32.
diff --git a/tests/spawn_from_lib/Cargo.toml b/tests/spawn_from_lib/Cargo.toml
index 9089d6b98b..21edc9914c 100644
--- a/tests/spawn_from_lib/Cargo.toml
+++ b/tests/spawn_from_lib/Cargo.toml
@@ -15,8 +15,6 @@ bench = false
 prefer-dynamic = []
 
 [dependencies]
-libc.workspace = true
 anyhow = { workspace = true, default-features = true }
 spawn_worker = { path = "../../spawn_worker" }
 tempfile.workspace = true
-io-lifetimes = { workspace = true, features = ["close"] }