diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 30e77884..5130b998 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -109,6 +109,21 @@ jobs:
       - name: Check style
         run: cargo fmt --all -- --check
 
+
+  cargo-deny:
+    name: Run `cargo deny` checks
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout the code
+        uses: actions/checkout@v3.5.3
+
+      - name: Run `cargo-deny`
+        uses: EmbarkStudios/cargo-deny-action@v1.5.4
+
   
   check-schema:
     name: Check schema
@@ -376,6 +391,7 @@ jobs:
       - frontend-lint
       - frontend-test
       - rustfmt
+      - cargo-deny
       - clippy
       - check-schema
       - test
diff --git a/Cargo.lock b/Cargo.lock
index c780b29a..9809ba67 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -85,9 +85,9 @@ dependencies = [
 
 [[package]]
 name = "aho-corasick"
-version = "1.0.2"
+version = "1.0.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "43f6cb1bf222025340178f382c426f13757b2960e89779dfcb319c32542a5a41"
+checksum = "86b8f9420f797f2d9e935edf629310eb938a0d839f984e25327f3c7eed22300c"
 dependencies = [
  "memchr",
 ]
@@ -154,9 +154,9 @@ dependencies = [
 
 [[package]]
 name = "anstyle-wincon"
-version = "1.0.1"
+version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "180abfa45703aebe0093f79badacc01b8fd4ea2e35118747e5811127f926e188"
+checksum = "c677ab05e09154296dd37acecd46420c17b9713e8366facafa8fc0885167cf4c"
 dependencies = [
  "anstyle",
  "windows-sys 0.48.0",
@@ -177,7 +177,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "chrono",
- "futures 0.3.28",
+ "futures",
  "graceful-shutdown",
  "http",
  "log",
@@ -201,7 +201,7 @@ dependencies = [
  "async-stream",
  "chrono",
  "cron",
- "futures 0.3.28",
+ "futures",
  "tokio",
  "tower",
 ]
@@ -304,7 +304,7 @@ dependencies = [
  "async-stream",
  "async-trait",
  "base64 0.13.1",
- "bytes 1.4.0",
+ "bytes",
  "chrono",
  "fast_chemail",
  "fnv",
@@ -364,7 +364,7 @@ version = "6.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8afef4917e23f7e651074dbfca64d82f194b817f00bd74d9df05d5408eb83e1e"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "indexmap 2.0.0",
  "serde",
  "serde_json",
@@ -392,9 +392,9 @@ dependencies = [
 
 [[package]]
 name = "async-lock"
-version = "2.7.0"
+version = "2.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fa24f727524730b077666307f2734b4a1a1c57acb79193127dcc8914d5242dd7"
+checksum = "287272293e9d8c41773cec55e365490fe034813a2f172f502d6ddcf75b2f582b"
 dependencies = [
  "event-listener",
 ]
@@ -526,11 +526,11 @@ dependencies = [
  "aws-smithy-json",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.4.0",
+ "bytes",
  "fastrand 1.9.0",
  "http",
  "hyper",
- "time 0.3.25",
+ "time",
  "tokio",
  "tower",
  "tracing",
@@ -574,7 +574,7 @@ dependencies = [
  "aws-smithy-http",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.4.0",
+ "bytes",
  "http",
  "http-body",
  "lazy_static",
@@ -600,7 +600,7 @@ dependencies = [
  "aws-smithy-json",
  "aws-smithy-types",
  "aws-types",
- "bytes 1.4.0",
+ "bytes",
  "http",
  "regex",
  "tokio-stream",
@@ -627,7 +627,7 @@ dependencies = [
  "aws-smithy-types",
  "aws-smithy-xml",
  "aws-types",
- "bytes 1.4.0",
+ "bytes",
  "http",
  "regex",
  "tower",
@@ -663,7 +663,7 @@ dependencies = [
  "percent-encoding",
  "regex",
  "sha2",
- "time 0.3.25",
+ "time",
  "tracing",
 ]
 
@@ -689,7 +689,7 @@ dependencies = [
  "aws-smithy-http",
  "aws-smithy-http-tower",
  "aws-smithy-types",
- "bytes 1.4.0",
+ "bytes",
  "fastrand 1.9.0",
  "http",
  "http-body",
@@ -707,7 +707,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2b3b693869133551f135e1f2c77cb0b8277d9e3e17feaf2213f735857c4f0d28"
 dependencies = [
  "aws-smithy-types",
- "bytes 1.4.0",
+ "bytes",
  "bytes-utils",
  "futures-core",
  "http",
@@ -728,7 +728,7 @@ checksum = "3ae4f6c5798a247fac98a867698197d9ac22643596dc3777f0c76b91917616b9"
 dependencies = [
  "aws-smithy-http",
  "aws-smithy-types",
- "bytes 1.4.0",
+ "bytes",
  "http",
  "http-body",
  "pin-project-lite",
@@ -765,7 +765,7 @@ dependencies = [
  "itoa",
  "num-integer",
  "ryu",
- "time 0.3.25",
+ "time",
 ]
 
 [[package]]
@@ -802,7 +802,7 @@ dependencies = [
  "async-trait",
  "axum-core",
  "bitflags 1.3.2",
- "bytes 1.4.0",
+ "bytes",
  "futures-util",
  "headers",
  "http",
@@ -833,7 +833,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "759fa577a247914fd3f7f76d62972792636412fbfd634cd452f6a385a74d2d2c"
 dependencies = [
  "async-trait",
- "bytes 1.4.0",
+ "bytes",
  "futures-util",
  "http",
  "http-body",
@@ -851,7 +851,7 @@ checksum = "a93e433be9382c737320af3924f7d5fc6f89c155cf2bf88949d8f5126fab283f"
 dependencies = [
  "axum",
  "axum-core",
- "bytes 1.4.0",
+ "bytes",
  "cookie",
  "futures-util",
  "http",
@@ -956,9 +956,9 @@ checksum = "bef38d45163c2f1dde094a7dfd33ccf595c92905c8f8f4fdc18d06fb1037718a"
 
 [[package]]
 name = "bitflags"
-version = "2.3.3"
+version = "2.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "630be753d4e58660abd17930c71b647fe46c27ea6b63cc59e1e3851406972e42"
+checksum = "b4682ae6287fcf752ecaabbfcc7b6f9b72aa33933dc23a554d853aea8eea8635"
 dependencies = [
  "serde",
 ]
@@ -1037,16 +1037,6 @@ version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "14c189c53d098945499cdfa7ecc63567cf3886b3332b312a5b4585d8d3a6a610"
 
-[[package]]
-name = "bytes"
-version = "0.4.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "206fdffcfa2df7cbe15601ef46c813fce0965eb3286db6b56c583b814b51c81c"
-dependencies = [
- "byteorder",
- "iovec",
-]
-
 [[package]]
 name = "bytes"
 version = "1.4.0"
@@ -1062,7 +1052,7 @@ version = "0.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e47d3a8076e283f3acd27400535992edb3ba4b5bb72f8891ad8fbe7932a7d4b9"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "either",
 ]
 
@@ -1086,11 +1076,12 @@ dependencies = [
 
 [[package]]
 name = "cc"
-version = "1.0.79"
+version = "1.0.82"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "50d30906286121d95be3d479533b458f87493b30a4b5f79a607db8f5d11aa91f"
+checksum = "305fe645edc1442a0fa8b6726ba61d422798d37a52e12eaecf4b022ebbb88f01"
 dependencies = [
  "jobserver",
+ "libc",
 ]
 
 [[package]]
@@ -1131,25 +1122,11 @@ checksum = "ec837a71355b28f6556dbd569b37b3f363091c0bd4b2e735674521b4c5fd9bc5"
 dependencies = [
  "android-tzdata",
  "iana-time-zone",
- "js-sys",
  "num-traits",
  "serde",
- "time 0.1.45",
- "wasm-bindgen",
  "winapi",
 ]
 
-[[package]]
-name = "chrono-tz"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58549f1842da3080ce63002102d5bc954c7bc843d4f47818e642abdc36253552"
-dependencies = [
- "chrono",
- "chrono-tz-build 0.0.2",
- "phf 0.10.1",
-]
-
 [[package]]
 name = "chrono-tz"
 version = "0.8.3"
@@ -1157,19 +1134,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1369bc6b9e9a7dfdae2055f6ec151fe9c554a9d23d357c0237cee2e25eaabb7"
 dependencies = [
  "chrono",
- "chrono-tz-build 0.2.0",
- "phf 0.11.2",
-]
-
-[[package]]
-name = "chrono-tz-build"
-version = "0.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db058d493fb2f65f41861bfed7e3fe6335264a9f0f92710cab5bdf01fef09069"
-dependencies = [
- "parse-zoneinfo",
- "phf 0.10.1",
- "phf_codegen 0.10.0",
+ "chrono-tz-build",
+ "phf",
 ]
 
 [[package]]
@@ -1179,8 +1145,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e2f5ebdc942f57ed96d560a6d1a459bae5851102a25d5bf89dc04ae453e31ecf"
 dependencies = [
  "parse-zoneinfo",
- "phf 0.11.2",
- "phf_codegen 0.11.2",
+ "phf",
+ "phf_codegen",
 ]
 
 [[package]]
@@ -1299,7 +1265,7 @@ dependencies = [
  "rand 0.8.5",
  "sha2",
  "subtle",
- "time 0.3.25",
+ "time",
  "version_check",
 ]
 
@@ -1711,12 +1677,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "deunicode"
-version = "0.4.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "850878694b7933ca4c9569d30a34b55031b9b139ee1fc7b94a527c4ef960d690"
-
 [[package]]
 name = "digest"
 version = "0.10.7"
@@ -1750,12 +1710,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "dotenv"
-version = "0.15.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77c90badedccf4105eca100756a0b1289e191f6fcbdadd3cee1d2f614f97da8f"
-
 [[package]]
 name = "dotenvy"
 version = "0.15.7"
@@ -1768,12 +1722,9 @@ version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d9f037c488d179e21c87ef5fa9c331e8e62f5dddfa84618b41bb197da03edff1"
 dependencies = [
- "chrono",
  "nom",
  "rust_decimal",
- "serde",
  "thiserror",
- "time 0.3.25",
 ]
 
 [[package]]
@@ -1878,9 +1829,9 @@ checksum = "5443807d6dff69373d433ab9ef5378ad8df50ca6298caf15de6e52e24aaf54d5"
 
 [[package]]
 name = "errno"
-version = "0.3.1"
+version = "0.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4bcfec3a70f97c962c307b2d2c56e358cf1d00b558d74262b5f929ee8cc7e73a"
+checksum = "6b30f669a7961ef1631673d2766cc92f52d64f7ef354d4fe0ddfd30ed52f0f4f"
 dependencies = [
  "errno-dragonfly",
  "libc",
@@ -2007,12 +1958,6 @@ dependencies = [
  "percent-encoding",
 ]
 
-[[package]]
-name = "futures"
-version = "0.1.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a471a38ef8ed83cd6e40aa59c1ffe17db6855c18e3604d9c4ed8c08ebc28678"
-
 [[package]]
 name = "futures"
 version = "0.3.28"
@@ -2122,7 +2067,6 @@ version = "0.3.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "26b01e40b772d54cf6c6d721c1d1abd0647a0106a12ecaa1c186273392a69533"
 dependencies = [
- "futures 0.1.31",
  "futures-channel",
  "futures-core",
  "futures-io",
@@ -2150,7 +2094,7 @@ version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "27d12c0aed7f1e24276a241aadc4cb8ea9f83000f34bc062b7cc2d51e3b0fabd"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "debugid",
  "fxhash",
  "serde",
@@ -2213,9 +2157,9 @@ dependencies = [
 
 [[package]]
 name = "globset"
-version = "0.4.12"
+version = "0.4.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aca8bbd8e0707c1887a8bbb7e6b40e228f251ff5d62c8220a4a7a53c73aff006"
+checksum = "759c97c1e17c55525b57192c06a267cda0ac5210b222d6b82189a2338fa1c13d"
 dependencies = [
  "aho-corasick",
  "bstr",
@@ -2275,7 +2219,7 @@ version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97ec8491ebaf99c8eaa73058b045fe58073cd6be7f596ac993ced0b0a0c01049"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "fnv",
  "futures-core",
  "futures-sink",
@@ -2284,7 +2228,7 @@ dependencies = [
  "indexmap 1.9.3",
  "slab",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util",
  "tracing",
 ]
 
@@ -2354,7 +2298,7 @@ checksum = "f3e372db8e5c0d213e0cd0b9be18be2aca3d44cf2fe30a9d46a65581cd454584"
 dependencies = [
  "base64 0.13.1",
  "bitflags 1.3.2",
- "bytes 1.4.0",
+ "bytes",
  "headers-core",
  "http",
  "httpdate",
@@ -2436,7 +2380,7 @@ version = "0.2.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bd6effc99afb63425aff9b05836f029929e345a6148a14b7ecd5ab67af944482"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "fnv",
  "itoa",
 ]
@@ -2447,7 +2391,7 @@ version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5f38f16d184e36f2408a55281cd658ecbd3ca05cce6d6510a176eca393e26d1"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "http",
  "pin-project-lite",
 ]
@@ -2491,15 +2435,6 @@ version = "1.0.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c4a1e36c821dbe04574f602848a19f742f4fb3c98d40449f11bcad18d6b17421"
 
-[[package]]
-name = "humansize"
-version = "2.1.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6cb51c9a029ddc91b07a787f1d86b53ccfa49b0e86688c946ebe8d3555685dd7"
-dependencies = [
- "libm",
-]
-
 [[package]]
 name = "humantime"
 version = "2.1.0"
@@ -2512,7 +2447,7 @@ version = "0.14.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ffb1cfd654a8219eaef89881fdb3bb3b1cdc5fa75ded05d6933b2b382e395468"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "futures-channel",
  "futures-core",
  "futures-util",
@@ -2730,15 +2665,6 @@ dependencies = [
  "windows-sys 0.48.0",
 ]
 
-[[package]]
-name = "iovec"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2b3ea6ff95e175473f8ffe6a7eb7c00d054240321b84c57051175fe3c1e075e"
-dependencies = [
- "libc",
-]
-
 [[package]]
 name = "iri-string"
 version = "0.7.0"
@@ -2756,7 +2682,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cb0889898416213fab133e1d33a0e5858a48177452750691bde3666d0fdbaf8b"
 dependencies = [
  "hermit-abi",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
@@ -2811,7 +2737,6 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror",
- "treediff",
 ]
 
 [[package]]
@@ -2922,9 +2847,9 @@ checksum = "ef53942eb7bf7ff43a617b3e2c1c4a5ecf5944a7c1bc12d7ee39bbb15e5c1519"
 
 [[package]]
 name = "linux-raw-sys"
-version = "0.4.3"
+version = "0.4.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "09fc20d2ca12cb9f044c93e3bd6d32d523e6e2ec3db4f7b2939cd99026ecd3f0"
+checksum = "57bcfdad1b858c2db7c38303a6d2ad4dfaf5eb53dfeb0910128b2c26d6158503"
 
 [[package]]
 name = "listenfd"
@@ -2965,12 +2890,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "maplit"
-version = "1.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3e2e65a1a2e43cfcb47a895c4c8b10d1f4a61097f9f254f183aee60cad9c651d"
-
 [[package]]
 name = "mas-axum-utils"
 version = "0.1.0"
@@ -3015,7 +2934,7 @@ dependencies = [
  "axum",
  "camino",
  "clap",
- "dotenv",
+ "dotenvy",
  "httpdate",
  "hyper",
  "indoc",
@@ -3065,7 +2984,6 @@ dependencies = [
  "tracing-opentelemetry",
  "tracing-subscriber",
  "url",
- "watchman_client",
  "zeroize",
 ]
 
@@ -3205,7 +3123,7 @@ dependencies = [
  "serde_with",
  "sqlx",
  "thiserror",
- "time 0.3.25",
+ "time",
  "tokio",
  "tower",
  "tower-http",
@@ -3224,7 +3142,7 @@ dependencies = [
  "aws-smithy-http",
  "aws-types",
  "axum",
- "bytes 1.4.0",
+ "bytes",
  "futures-util",
  "headers",
  "http",
@@ -3340,7 +3258,7 @@ name = "mas-listener"
 version = "0.1.0"
 dependencies = [
  "anyhow",
- "bytes 1.4.0",
+ "bytes",
  "futures-util",
  "http-body",
  "hyper",
@@ -3391,11 +3309,11 @@ version = "0.1.0"
 dependencies = [
  "assert_matches",
  "base64ct",
- "bitflags 2.3.3",
- "bytes 1.4.0",
+ "bitflags 2.4.0",
+ "bytes",
  "chrono",
  "form_urlencoded",
- "futures 0.3.28",
+ "futures",
  "futures-util",
  "headers",
  "http",
@@ -3601,9 +3519,9 @@ dependencies = [
 
 [[package]]
 name = "matchit"
-version = "0.7.0"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b87248edafb776e59e6ee64a79086f65890d3510f2c656c000bf2a7e8a0aea40"
+checksum = "ed1202b2a6f884ae56f04cff409ab315c5ce26b5e58d7412e484f01fd52f52ef"
 
 [[package]]
 name = "md-5"
@@ -3695,7 +3613,7 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "01acbdc23469fd8fe07ab135923371d5f5a422fbf9c522158677c8eb15bc51c2"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "encoding_rs",
  "futures-util",
  "http",
@@ -3836,13 +3754,13 @@ checksum = "dd8b5dd2ae5ed71462c540258bedcb51965123ad7e7ccf4b9a8cafaa4a63576d"
 [[package]]
 name = "opa-wasm"
 version = "0.1.0"
-source = "git+https://github.com/matrix-org/rust-opa-wasm.git#5177edfcb0e5baae0e8d73992efeac7c7b2dd685"
+source = "git+https://github.com/matrix-org/rust-opa-wasm.git#007d1dc34777c4e386778aef8180e8895f5284dd"
 dependencies = [
  "anyhow",
  "base64 0.21.2",
  "cc",
  "chrono",
- "chrono-tz 0.8.3",
+ "chrono-tz",
  "chronoutil",
  "digest",
  "duration-str",
@@ -3896,7 +3814,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c7594ec0e11d8e33faf03530a4c49af7064ebba81c1480e01be67d90b356508b"
 dependencies = [
  "async-trait",
- "bytes 1.4.0",
+ "bytes",
  "http",
  "hyper",
  "opentelemetry_api",
@@ -4251,9 +4169,9 @@ checksum = "9b2a4787296e9989611394c33f193f676704af1686e70b8f8033ab5ba9a35a94"
 
 [[package]]
 name = "pest"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d2d1d55045829d65aad9d389139882ad623b33b904e7c9f1b10c5b8927298e5"
+checksum = "1acb4a4365a13f749a93f1a094a7805e5cfa0955373a9de860d962eaa3a5fe5a"
 dependencies = [
  "thiserror",
  "ucd-trie",
@@ -4261,9 +4179,9 @@ dependencies = [
 
 [[package]]
 name = "pest_derive"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f94bca7e7a599d89dea5dfa309e217e7906c3c007fb9c3299c40b10d6a315d3"
+checksum = "666d00490d4ac815001da55838c500eafb0320019bbaa44444137c48b443a853"
 dependencies = [
  "pest",
  "pest_generator",
@@ -4271,9 +4189,9 @@ dependencies = [
 
 [[package]]
 name = "pest_generator"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "99d490fe7e8556575ff6911e45567ab95e71617f43781e5c05490dc8d75c965c"
+checksum = "68ca01446f50dbda87c1786af8770d535423fa8a53aec03b8f4e3d7eb10e0929"
 dependencies = [
  "pest",
  "pest_meta",
@@ -4284,41 +4202,22 @@ dependencies = [
 
 [[package]]
 name = "pest_meta"
-version = "2.7.1"
+version = "2.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2674c66ebb4b4d9036012091b537aae5878970d6999f81a265034d85b136b341"
+checksum = "56af0a30af74d0445c0bf6d9d051c979b516a1a5af790d251daee76005420a48"
 dependencies = [
  "once_cell",
  "pest",
  "sha2",
 ]
 
-[[package]]
-name = "phf"
-version = "0.10.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fabbf1ead8a5bcbc20f5f8b939ee3f5b0f6f281b6ad3468b84656b658b455259"
-dependencies = [
- "phf_shared 0.10.0",
-]
-
 [[package]]
 name = "phf"
 version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ade2d8b8f33c7333b51bcf0428d37e217e9f32192ae4772156f65063b8ce03dc"
 dependencies = [
- "phf_shared 0.11.2",
-]
-
-[[package]]
-name = "phf_codegen"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fb1c3a8bc4dd4e5cfce29b44ffc14bedd2ee294559a294e2a4d4c9e9a6a13cd"
-dependencies = [
- "phf_generator 0.10.0",
- "phf_shared 0.10.0",
+ "phf_shared",
 ]
 
 [[package]]
@@ -4327,18 +4226,8 @@ version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e8d39688d359e6b34654d328e262234662d16cc0f60ec8dcbe5e718709342a5a"
 dependencies = [
- "phf_generator 0.11.2",
- "phf_shared 0.11.2",
-]
-
-[[package]]
-name = "phf_generator"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d5285893bb5eb82e6aaf5d59ee909a06a16737a8970984dd7746ba9283498d6"
-dependencies = [
- "phf_shared 0.10.0",
- "rand 0.8.5",
+ "phf_generator",
+ "phf_shared",
 ]
 
 [[package]]
@@ -4347,20 +4236,10 @@ version = "0.11.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "48e4cc64c2ad9ebe670cb8fd69dd50ae301650392e81c05f9bfcb2d5bdbc24b0"
 dependencies = [
- "phf_shared 0.11.2",
+ "phf_shared",
  "rand 0.8.5",
 ]
 
-[[package]]
-name = "phf_shared"
-version = "0.10.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b6796ad771acdc0123d2a88dc428b5e38ef24456743ddb1744ed628f9815c096"
-dependencies = [
- "siphasher",
- "uncased",
-]
-
 [[package]]
 name = "phf_shared"
 version = "0.11.2"
@@ -4372,18 +4251,18 @@ dependencies = [
 
 [[package]]
 name = "pin-project"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "030ad2bc4db10a8944cb0d837f158bdfec4d4a4873ab701a95046770d11f8842"
+checksum = "fda4ed1c6c173e3fc7a83629421152e01d7b1f9b7f65fb301e490e8cfc656422"
 dependencies = [
  "pin-project-internal",
 ]
 
 [[package]]
 name = "pin-project-internal"
-version = "1.1.2"
+version = "1.1.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec2e072ecce94ec471b13398d5402c188e76ac03cf74dd1a975161b23a3f6d9c"
+checksum = "4359fd9c9171ec6e8c62926d6faaf553a8dc3f64e1507e76da7911b4f6a04405"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4553,7 +4432,7 @@ version = "0.11.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "0b82eaa1d779e9a4bc1c3217db8ffbeabaae1dca241bf70183242128d48681cd"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "prost-derive",
 ]
 
@@ -4748,13 +4627,13 @@ dependencies = [
 
 [[package]]
 name = "regex"
-version = "1.9.1"
+version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b2eae68fc220f7cf2532e4494aded17545fce192d59cd996e0fe7887f4ceb575"
+checksum = "81bc1d4caf89fac26a70747fe603c130093b53c773888797a6329091246d651a"
 dependencies = [
  "aho-corasick",
  "memchr",
- "regex-automata 0.3.3",
+ "regex-automata 0.3.6",
  "regex-syntax 0.7.4",
 ]
 
@@ -4769,9 +4648,9 @@ dependencies = [
 
 [[package]]
 name = "regex-automata"
-version = "0.3.3"
+version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "39354c10dd07468c2e73926b23bb9c2caca74c5501e38a35da70406f1d923310"
+checksum = "fed1ceff11a1dddaee50c9dc8e4938bd106e9d89ae372f192311e7da498e3b69"
 dependencies = [
  "aho-corasick",
  "memchr",
@@ -4845,9 +4724,9 @@ dependencies = [
 
 [[package]]
 name = "rust_decimal"
-version = "1.30.0"
+version = "1.31.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d0446843641c69436765a35a5a77088e28c2e6a12da93e84aa3ab1cd4aa5a042"
+checksum = "4a2ab0025103a60ecaaf3abf24db1db240a4e1c15837090d2c32f625ac98abea"
 dependencies = [
  "arrayvec",
  "num-traits",
@@ -4890,14 +4769,14 @@ dependencies = [
 
 [[package]]
 name = "rustix"
-version = "0.38.4"
+version = "0.38.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a962918ea88d644592894bc6dc55acc6c0956488adcebbfb6e273506b7fd6e5"
+checksum = "19ed4fa021d81c8392ce04db050a3da9a60299050b7ae1cf482d862b54a7218f"
 dependencies = [
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "errno",
  "libc",
- "linux-raw-sys 0.4.3",
+ "linux-raw-sys 0.4.5",
  "windows-sys 0.48.0",
 ]
 
@@ -4909,7 +4788,7 @@ checksum = "1d1feddffcfcc0b33f5c6ce9a29e341e4cd59c3f78e7ee45f4a40c038b1d6cbb"
 dependencies = [
  "log",
  "ring",
- "rustls-webpki 0.101.2",
+ "rustls-webpki 0.101.3",
  "sct",
 ]
 
@@ -4946,9 +4825,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.101.2"
+version = "0.101.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "513722fd73ad80a71f72b61009ea1b584bcfa1483ca93949c8f290298837fa59"
+checksum = "261e9e0888cba427c3316e6322805653c9425240b6fd96cee7cb671ab70ab8d0"
 dependencies = [
  "ring",
  "untrusted",
@@ -5240,7 +5119,7 @@ dependencies = [
  "serde",
  "serde_json",
  "thiserror",
- "time 0.3.25",
+ "time",
  "url",
  "uuid",
 ]
@@ -5254,19 +5133,6 @@ dependencies = [
  "serde_derive",
 ]
 
-[[package]]
-name = "serde_bser"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b929ea725591083cbca8b8ea178ed6efc918eccd40b784e199ce88967104199"
-dependencies = [
- "anyhow",
- "byteorder",
- "bytes 0.4.12",
- "serde",
- "thiserror",
-]
-
 [[package]]
 name = "serde_derive"
 version = "1.0.183"
@@ -5347,7 +5213,7 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_with_macros",
- "time 0.3.25",
+ "time",
 ]
 
 [[package]]
@@ -5462,15 +5328,6 @@ version = "0.3.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "826167069c09b99d56f31e9ae5c99049e932a98c9dc2dac47645b08dbbf76ba7"
 
-[[package]]
-name = "slug"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3bc762e6a4b6c6fcaade73e77f9ebc6991b676f88bb2358bddb56560f073373"
-dependencies = [
- "deunicode",
-]
-
 [[package]]
 name = "smallvec"
 version = "1.11.0"
@@ -5567,7 +5424,7 @@ dependencies = [
  "ahash",
  "atoi",
  "byteorder",
- "bytes 1.4.0",
+ "bytes",
  "chrono",
  "crc",
  "crossbeam-queue",
@@ -5650,9 +5507,9 @@ checksum = "8ca69bf415b93b60b80dc8fda3cb4ef52b2336614d8da2de5456cc942a110482"
 dependencies = [
  "atoi",
  "base64 0.21.2",
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "byteorder",
- "bytes 1.4.0",
+ "bytes",
  "chrono",
  "crc",
  "digest",
@@ -5694,7 +5551,7 @@ checksum = "a0db2df1b8731c3651e204629dd55e52adbae0462fa1bdcbed56a2302c18181e"
 dependencies = [
  "atoi",
  "base64 0.21.2",
- "bitflags 2.3.3",
+ "bitflags 2.4.0",
  "byteorder",
  "chrono",
  "crc",
@@ -5813,9 +5670,9 @@ dependencies = [
 
 [[package]]
 name = "strum_macros"
-version = "0.25.1"
+version = "0.25.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6069ca09d878a33f883cc06aaa9718ede171841d3832450354410b718b097232"
+checksum = "ad8d03b598d3d0fff69bf533ee3ef19b8eeb342729596df84bcc7e1f96ec4059"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -5860,20 +5717,20 @@ checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.10"
+version = "0.12.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1d2faeef5759ab89935255b1a4cd98e0baf99d1085e37d36599c625dac49ae8e"
+checksum = "9d0e916b1148c8e263850e1ebcbd046f333e0683c724876bb0da63ea4373dc8a"
 
 [[package]]
 name = "tempfile"
-version = "3.7.0"
+version = "3.7.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5486094ee78b2e5038a6382ed7645bc084dc2ec433426ca4c3cb61e2007b8998"
+checksum = "dc02fddf48964c42031a0b3fe0428320ecf3a73c401040fc0096f97794310651"
 dependencies = [
  "cfg-if",
  "fastrand 2.0.0",
  "redox_syscall 0.3.5",
- "rustix 0.38.4",
+ "rustix 0.38.8",
  "windows-sys 0.48.0",
 ]
 
@@ -5883,19 +5740,13 @@ version = "1.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a5ab29bb4f3e256ae6ad5c3e2775aa1f8829f2c0c101fc407bfd3a6df15c60c5"
 dependencies = [
- "chrono",
- "chrono-tz 0.6.1",
  "globwalk",
- "humansize",
  "lazy_static",
- "percent-encoding",
  "pest",
  "pest_derive",
- "rand 0.8.5",
  "regex",
  "serde",
  "serde_json",
- "slug",
  "thread_local",
  "unic-segment",
 ]
@@ -5960,17 +5811,6 @@ dependencies = [
  "threadpool",
 ]
 
-[[package]]
-name = "time"
-version = "0.1.45"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1b797afad3f312d1c66a56d11d0316f916356d11bd158fbc6ca6389ff6bf805a"
-dependencies = [
- "libc",
- "wasi 0.10.0+wasi-snapshot-preview1",
- "winapi",
-]
-
 [[package]]
 name = "time"
 version = "0.3.25"
@@ -6021,7 +5861,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2d3ce25f50619af8b0aec2eb23deebe84249e19e2ddd393a6e16e3300a6dadfd"
 dependencies = [
  "backtrace",
- "bytes 1.4.0",
+ "bytes",
  "libc",
  "mio",
  "num_cpus",
@@ -6082,35 +5922,19 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "53474327ae5e166530d17f2d956afcb4f8a004de581b3cae10f12006bc8163e3"
 dependencies = [
  "async-stream",
- "bytes 1.4.0",
+ "bytes",
  "futures-core",
  "tokio",
  "tokio-stream",
 ]
 
-[[package]]
-name = "tokio-util"
-version = "0.6.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "36943ee01a6d67977dd3f84a5a1d2efeb4ada3a1ae771cadfaa535d9d9fc6507"
-dependencies = [
- "bytes 1.4.0",
- "futures-core",
- "futures-io",
- "futures-sink",
- "log",
- "pin-project-lite",
- "slab",
- "tokio",
-]
-
 [[package]]
 name = "tokio-util"
 version = "0.7.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "806fe8c2c87eccc8b3267cbae29ed3ab2d0bd37fca70ab622e46aaa9375ddb7d"
 dependencies = [
- "bytes 1.4.0",
+ "bytes",
  "futures-core",
  "futures-sink",
  "pin-project-lite",
@@ -6153,7 +5977,7 @@ dependencies = [
  "async-trait",
  "axum",
  "base64 0.21.2",
- "bytes 1.4.0",
+ "bytes",
  "futures-core",
  "futures-util",
  "h2",
@@ -6187,7 +6011,7 @@ dependencies = [
  "rand 0.8.5",
  "slab",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util",
  "tower-layer",
  "tower-service",
  "tracing",
@@ -6199,8 +6023,8 @@ version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "55ae70283aba8d2a8b411c695c437fe25b8b5e44e23e780662002fc72fb47a82"
 dependencies = [
- "bitflags 2.3.3",
- "bytes 1.4.0",
+ "bitflags 2.4.0",
+ "bytes",
  "futures-core",
  "futures-util",
  "http",
@@ -6213,7 +6037,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "tokio",
- "tokio-util 0.7.8",
+ "tokio-util",
  "tower",
  "tower-layer",
  "tower-service",
@@ -6252,7 +6076,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "09d48f71a791638519505cefafe162606f706c25592e4bde4d97600c0195312e"
 dependencies = [
  "crossbeam-channel",
- "time 0.3.25",
+ "time",
  "tracing-subscriber",
 ]
 
@@ -6283,7 +6107,7 @@ version = "0.2.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "97d095ae15e245a057c8e8451bab9b3ee1e1f68e9ba2b4fbc18d0ac5237835f2"
 dependencies = [
- "futures 0.3.28",
+ "futures",
  "futures-task",
  "pin-project",
  "tracing",
@@ -6332,15 +6156,6 @@ dependencies = [
  "tracing-log",
 ]
 
-[[package]]
-name = "treediff"
-version = "4.0.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "52984d277bdf2a751072b5df30ec0377febdb02f7696d64c2d7d54630bac4303"
-dependencies = [
- "serde_json",
-]
-
 [[package]]
 name = "try-lock"
 version = "0.2.4"
@@ -6613,12 +6428,6 @@ version = "0.9.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
 
-[[package]]
-name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
-
 [[package]]
 name = "wasi"
 version = "0.11.0+wasi-snapshot-preview1"
@@ -6948,24 +6757,6 @@ dependencies = [
  "wit-parser",
 ]
 
-[[package]]
-name = "watchman_client"
-version = "0.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "839fea2d85719bb69089290d7970bba2131f544448db8f990ea75813c30775ca"
-dependencies = [
- "anyhow",
- "bytes 1.4.0",
- "futures 0.3.28",
- "maplit",
- "serde",
- "serde_bser",
- "thiserror",
- "tokio",
- "tokio-util 0.6.10",
- "winapi",
-]
-
 [[package]]
 name = "web-sys"
 version = "0.3.64"
@@ -7001,7 +6792,7 @@ version = "0.24.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
 dependencies = [
- "rustls-webpki 0.101.2",
+ "rustls-webpki 0.101.3",
 ]
 
 [[package]]
@@ -7190,9 +6981,9 @@ checksum = "1a515f5799fe4961cb532f983ce2b23082366b898e52ffbce459c86f67c8378a"
 
 [[package]]
 name = "winnow"
-version = "0.5.1"
+version = "0.5.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "25b5872fa2e10bd067ae946f927e726d7d603eaeb6e02fa6a350e0722d2b8c11"
+checksum = "4344c9f03e6918ce61d94ea6b0500964bb42ee9ca9b2c9c8931990e20b481144"
 dependencies = [
  "memchr",
 ]
@@ -7207,7 +6998,7 @@ dependencies = [
  "async-trait",
  "base64 0.21.2",
  "deadpool",
- "futures 0.3.28",
+ "futures",
  "futures-timer",
  "http-types",
  "hyper",
@@ -7252,9 +7043,9 @@ dependencies = [
 
 [[package]]
 name = "yansi"
-version = "1.0.0-rc"
+version = "1.0.0-rc.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9ee746ad3851dd3bc40e4a028ab3b00b99278d929e48957bcb2d111874a7e43e"
+checksum = "1367295b8f788d371ce2dbc842c7b709c73ee1364d30351dd300ec2203b12377"
 
 [[package]]
 name = "zeroize"
diff --git a/Cargo.toml b/Cargo.toml
index 81af65ee..5bb2421f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,6 +2,13 @@
 default-members = ["crates/cli"]
 members = ["crates/*"]
 
+[workspace.dependencies]
+
+[workspace.dependencies.chrono]
+version = "0.4.26"
+default-features = false
+features = ["serde", "clock"]
+
 [profile.dev.package.num-bigint-dig]
 opt-level = 3
 
diff --git a/crates/axum-utils/Cargo.toml b/crates/axum-utils/Cargo.toml
index f7f2de26..d490b34d 100644
--- a/crates/axum-utils/Cargo.toml
+++ b/crates/axum-utils/Cargo.toml
@@ -9,7 +9,7 @@ license = "Apache-2.0"
 async-trait = "0.1.72"
 axum = { version = "0.6.20", features = ["headers"] }
 axum-extra = { version = "0.7.7", features = ["cookie-private"] }
-chrono = "0.4.26"
+chrono.workspace = true
 data-encoding = "2.4.0"
 futures-util = "0.3.28"
 headers = "0.3.8"
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index 59d17cf4..b28f69e7 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -11,7 +11,7 @@ anyhow = "1.0.72"
 axum = "0.6.20"
 camino = "1.1.6"
 clap = { version = "4.3.21", features = ["derive"] }
-dotenv = "0.15.0"
+dotenvy = "0.15.7"
 httpdate = "1.0.2"
 hyper = { version = "0.14.27", features = ["full"] }
 itertools = "0.11.0"
@@ -26,7 +26,6 @@ tokio = { version = "1.30.0", features = ["full"] }
 tower = { version = "0.4.13", features = ["full"] }
 tower-http = { version = "0.4.3", features = ["fs"] }
 url = "2.4.0"
-watchman_client = "0.8.0"
 zeroize = "1.6.0"
 
 tracing = "0.1.37"
diff --git a/crates/cli/src/commands/server.rs b/crates/cli/src/commands/server.rs
index c0f1c0e6..4b091a3d 100644
--- a/crates/cli/src/commands/server.rs
+++ b/crates/cli/src/commands/server.rs
@@ -32,7 +32,7 @@ use tracing::{info, info_span, warn, Instrument};
 
 use crate::util::{
     database_from_config, mailer_from_config, password_manager_from_config,
-    policy_factory_from_config, templates_from_config, watch_templates,
+    policy_factory_from_config, register_sighup, templates_from_config,
 };
 
 #[derive(Parser, Debug, Default)]
@@ -44,10 +44,6 @@ pub(super) struct Options {
     /// Do not start the task worker
     #[arg(long)]
     no_worker: bool,
-
-    /// Watch for changes for templates on the filesystem
-    #[arg(short, long)]
-    watch: bool,
 }
 
 impl Options {
@@ -134,10 +130,8 @@ impl Options {
         // Explicitly the config to properly zeroize secret keys
         drop(config);
 
-        // Watch for changes in templates if the --watch flag is present
-        if self.watch {
-            watch_templates(&templates).await?;
-        }
+        // Listen for SIGHUP
+        register_sighup(&templates)?;
 
         let graphql_schema = mas_handlers::graphql_schema(&pool, conn);
 
diff --git a/crates/cli/src/main.rs b/crates/cli/src/main.rs
index 09cf9913..926a1a98 100644
--- a/crates/cli/src/main.rs
+++ b/crates/cli/src/main.rs
@@ -48,7 +48,7 @@ async fn main() -> anyhow::Result<()> {
 async fn try_main() -> anyhow::Result<()> {
     // Load environment variables from .env files
     // We keep the path to log it afterwards
-    let dotenv_path: Result<Option<_>, _> = dotenv::dotenv()
+    let dotenv_path: Result<Option<_>, _> = dotenvy::dotenv()
         .map(Some)
         // Display the error if it is something other than the .env file not existing
         .or_else(|e| if e.not_found() { Ok(None) } else { Err(e) });
diff --git a/crates/cli/src/util.rs b/crates/cli/src/util.rs
index b257a52b..8fb6bd7e 100644
--- a/crates/cli/src/util.rs
+++ b/crates/cli/src/util.rs
@@ -179,60 +179,27 @@ pub async fn database_from_config(config: &DatabaseConfig) -> Result<PgPool, any
         .context("could not connect to the database")
 }
 
-/// Watch for changes in the templates folders
-pub async fn watch_templates(templates: &Templates) -> anyhow::Result<()> {
-    use watchman_client::{prelude::*, SubscriptionData};
-
-    let client = Connector::new()
-        .connect()
-        .await
-        .context("could not connect to watchman")?;
-
-    let templates = templates.clone();
-
-    // Find which root we're supposed to watch
-    let root = templates.watch_root();
-
-    // Create a subscription on the root
-    let resolved = client
-        .resolve_root(CanonicalPath::canonicalize(root)?)
-        .await?;
-
-    // Only look for *.txt, *.html and *.subject files
-    let request = SubscribeRequest {
-        expression: Some(Expr::Suffix(vec![
-            "txt".into(),
-            "html".into(),
-            "subject".into(),
-        ])),
-        ..SubscribeRequest::default()
-    };
-
-    let (mut subscription, _) = client.subscribe::<NameOnly>(&resolved, request).await?;
-
-    tokio::spawn(async move {
-        loop {
-            let event = match subscription.next().await {
-                Ok(event) => event,
-                Err(error) => {
-                    error!(%error, "Stopped watching templates because of an error in the watchman subscription");
+/// Reload templates on SIGHUP
+pub fn register_sighup(templates: &Templates) -> anyhow::Result<()> {
+    #[cfg(unix)]
+    {
+        let mut signal = tokio::signal::unix::signal(tokio::signal::unix::SignalKind::hangup())?;
+        let templates = templates.clone();
+        tokio::spawn(async move {
+            loop {
+                if signal.recv().await.is_none() {
+                    // No more signals will be received, breaking
                     break;
-                }
-            };
+                };
 
-            if let SubscriptionData::FilesChanged(QueryResult {
-                files: Some(files), ..
-            }) = event
-            {
-                let files: Vec<_> = files.into_iter().map(|f| f.name.into_inner()).collect();
-                info!(?files, "Files changed, reloading templates");
+                info!("SIGHUP received, reloading templates");
 
                 templates.clone().reload().await.unwrap_or_else(|err| {
                     error!(?err, "Error while reloading templates");
                 });
             }
-        }
-    });
+        });
+    }
 
     Ok(())
 }
diff --git a/crates/config/Cargo.toml b/crates/config/Cargo.toml
index 5fb27a65..462351e2 100644
--- a/crates/config/Cargo.toml
+++ b/crates/config/Cargo.toml
@@ -14,7 +14,7 @@ thiserror = "1.0.44"
 anyhow = "1.0.72"
 
 camino = { version = "1.1.6", features = ["serde1"] }
-chrono = { version = "0.4.26", features = ["serde"] }
+chrono.workspace = true
 figment = { version = "0.10.10", features = ["env", "yaml", "test"] }
 schemars = { version = "0.8.12", features = ["url", "chrono"] }
 ulid = { version = "1.0.0", features = ["serde"] }
diff --git a/crates/data-model/Cargo.toml b/crates/data-model/Cargo.toml
index eef70be0..d03e994b 100644
--- a/crates/data-model/Cargo.toml
+++ b/crates/data-model/Cargo.toml
@@ -6,7 +6,7 @@ edition = "2021"
 license = "Apache-2.0"
 
 [dependencies]
-chrono = "0.4.26"
+chrono.workspace = true
 thiserror = "1.0.44"
 serde = "1.0.183"
 url = { version = "2.4.0", features = ["serde"] }
diff --git a/crates/graphql/Cargo.toml b/crates/graphql/Cargo.toml
index b7f66588..fae571d1 100644
--- a/crates/graphql/Cargo.toml
+++ b/crates/graphql/Cargo.toml
@@ -9,7 +9,7 @@ license = "Apache-2.0"
 anyhow = "1.0.72"
 async-graphql = { version = "6.0.1", features = ["chrono", "url"] }
 async-trait = "0.1.72"
-chrono = "0.4.26"
+chrono.workspace = true
 lettre = { version = "0.10.4", default-features = false  }
 serde = { version = "1.0.183", features = ["derive"] }
 thiserror = "1.0.44"
diff --git a/crates/handlers/Cargo.toml b/crates/handlers/Cargo.toml
index 5d94aaf6..0cb07b74 100644
--- a/crates/handlers/Cargo.toml
+++ b/crates/handlers/Cargo.toml
@@ -50,7 +50,7 @@ zeroize = "1.6.0"
 
 # Various data types and utilities
 camino = "1.1.6"
-chrono = { version = "0.4.26", features = ["serde"] }
+chrono.workspace = true
 time = "0.3.25"
 url = { version = "2.4.0", features = ["serde"] }
 mime = "0.3.17"
diff --git a/crates/jose/Cargo.toml b/crates/jose/Cargo.toml
index a53303f7..767f0ff1 100644
--- a/crates/jose/Cargo.toml
+++ b/crates/jose/Cargo.toml
@@ -7,7 +7,7 @@ license = "Apache-2.0"
 
 [dependencies]
 base64ct = { version = "1.6.0", features = ["std"] }
-chrono = { version = "0.4.26", features = ["serde"] }
+chrono.workspace = true
 digest = "0.10.7"
 ecdsa = { version = "0.16.8", features = ["signing", "verifying"] }
 elliptic-curve = "0.13.5"
diff --git a/crates/oauth2-types/Cargo.toml b/crates/oauth2-types/Cargo.toml
index 032b993a..21ff252c 100644
--- a/crates/oauth2-types/Cargo.toml
+++ b/crates/oauth2-types/Cargo.toml
@@ -14,7 +14,7 @@ url = { version = "2.4.0", features = ["serde"] }
 parse-display = "0.8.2"
 indoc = "2.0.3"
 serde_with = { version = "3.2.0", features = ["chrono"] }
-chrono = "0.4.26"
+chrono.workspace = true
 sha2 = "0.10.7"
 data-encoding = "2.4.0"
 thiserror = "1.0.44"
diff --git a/crates/oidc-client/Cargo.toml b/crates/oidc-client/Cargo.toml
index aedda0d9..fb4bed8b 100644
--- a/crates/oidc-client/Cargo.toml
+++ b/crates/oidc-client/Cargo.toml
@@ -20,7 +20,7 @@ keystore = ["dep:mas-keystore"]
 [dependencies]
 base64ct = { version = "1.6.0", features = ["std"] }
 bytes = "1.4.0"
-chrono = "0.4.26"
+chrono.workspace = true
 form_urlencoded = "1.2.0"
 futures = "0.3.28"
 futures-util = "0.3.28"
diff --git a/crates/storage-pg/Cargo.toml b/crates/storage-pg/Cargo.toml
index 1026e7a6..94443ca0 100644
--- a/crates/storage-pg/Cargo.toml
+++ b/crates/storage-pg/Cargo.toml
@@ -10,7 +10,7 @@ async-trait = "0.1.72"
 sqlx = { version = "0.7.1", features = ["runtime-tokio-rustls", "postgres", "migrate", "chrono", "json", "uuid"] }
 sea-query = { version = "0.30.0", features = ["derive", "attr", "with-uuid", "with-chrono"] }
 sea-query-binder = { version = "0.5.0", features = ["sqlx-postgres", "with-uuid", "with-chrono"] }
-chrono = { version = "0.4.26", features = ["serde"] }
+chrono.workspace = true
 serde = { version = "1.0.183", features = ["derive"] }
 serde_json = "1.0.104"
 thiserror = "1.0.44"
diff --git a/crates/storage/Cargo.toml b/crates/storage/Cargo.toml
index 627956af..ac225b0d 100644
--- a/crates/storage/Cargo.toml
+++ b/crates/storage/Cargo.toml
@@ -7,7 +7,7 @@ license = "Apache-2.0"
 
 [dependencies]
 async-trait = "0.1.72"
-chrono = "0.4.26"
+chrono.workspace = true
 thiserror = "1.0.44"
 futures-util = "0.3.28"
 
diff --git a/crates/tasks/Cargo.toml b/crates/tasks/Cargo.toml
index 49b1ad87..47f08e25 100644
--- a/crates/tasks/Cargo.toml
+++ b/crates/tasks/Cargo.toml
@@ -1,9 +1,9 @@
 [package]
 name = "mas-tasks"
 version = "0.1.0"
-authors = ["quentin gliech <quenting@element.io>"]
+authors = ["Quentin Gliech <quenting@element.io>"]
 edition = "2021"
-license = "apache-2.0"
+license = "Apache-2.0"
 
 [dependencies]
 anyhow = "1.0.72"
@@ -11,7 +11,7 @@ apalis-core = { version = "0.4.4", features = ["extensions", "tokio-comp", "stor
 apalis-cron = "0.4.4"
 async-stream = "0.3.5"
 async-trait = "0.1.72"
-chrono = "0.4.26"
+chrono.workspace = true
 event-listener = "2.5.3"
 futures-lite = "1.13.0"
 rand = "0.8.5"
diff --git a/crates/templates/Cargo.toml b/crates/templates/Cargo.toml
index 356daff9..8a6f8737 100644
--- a/crates/templates/Cargo.toml
+++ b/crates/templates/Cargo.toml
@@ -12,13 +12,13 @@ tokio = { version = "1.30.0", features = ["macros", "rt", "fs"] }
 anyhow = "1.0.72"
 thiserror = "1.0.44"
 
-tera = "1.19.0"
+tera = { version = "1.19.0", default-features = false }
 serde = { version = "1.0.183", features = ["derive"] }
 serde_json = "1.0.104"
 serde_urlencoded = "0.7.1"
 
 camino = "1.1.6"
-chrono = "0.4.26"
+chrono.workspace = true
 url = "2.4.0"
 http = "0.2.9"
 ulid = { version = "1.0.0", features = ["serde"] }
diff --git a/crates/templates/src/lib.rs b/crates/templates/src/lib.rs
index f9dbea55..7c7c6830 100644
--- a/crates/templates/src/lib.rs
+++ b/crates/templates/src/lib.rs
@@ -100,12 +100,6 @@ pub enum TemplateLoadingError {
 }
 
 impl Templates {
-    /// Directories to watch
-    #[must_use]
-    pub fn watch_root(&self) -> &Utf8Path {
-        &self.path
-    }
-
     /// Load the templates from the given config
     #[tracing::instrument(
         name = "templates.load",
diff --git a/deny.toml b/deny.toml
new file mode 100644
index 00000000..f2d59dec
--- /dev/null
+++ b/deny.toml
@@ -0,0 +1,99 @@
+targets = [
+    { triple = "x86_64-unknown-linux-gnu" },
+    { triple = "aarch64-unknown-linux-gnu" },
+    { triple = "x86_64-apple-darwin" },
+    { triple = "aarch64-apple-darwin" },
+]
+
+[advisories]
+db-path = "~/.cargo/advisory-db"
+db-urls = ["https://github.com/rustsec/advisory-db"]
+vulnerability = "deny"
+unmaintained = "warn"
+yanked = "warn"
+notice = "warn"
+ignore = [
+    # `wasmtime` depends on `mach`
+    # PR to migrate to `mach2`: https://github.com/bytecodealliance/wasmtime/pull/6164
+    "RUSTSEC-2020-0168",
+]
+
+[licenses]
+# Deny unlicensed crates and those with a copyleft license
+unlicensed = "deny"
+copyleft = "deny"
+default = "deny"
+
+# By default, allow all licenses that are OSI or FSF approved
+allow-osi-fsf-free = "both"
+allow = [
+    "MPL-2.0",
+    "0BSD", # Used by `quoted_printable`
+    "OpenSSL", # Used by `ring`
+    "Unicode-DFS-2016", # Used by `unicode-ident`
+]
+deny = []
+
+# Ring's license is a bit complicated, so we need to specify it manually
+[[licenses.clarify]]
+name = "ring"
+version = "*"
+expression = "MIT AND ISC AND OpenSSL"
+license-files = [
+    { path = "LICENSE", hash = 0xbd0eed23 }
+]
+
+[bans]
+# List of crates to deny
+deny = [
+    # We should never depend on openssl
+    { name = "openssl" },
+    { name = "openssl-sys" },
+    { name = "native-tls" },
+]
+
+# We try to avoid duplicating crates and track exceptions here
+multiple-versions = "warn"
+
+skip = [
+    { name = "webpki-roots" }, # We, lettre and sqlx have different versions :(
+    { name = "rustls-webpki" },
+    { name = "syn", version = "1.0.109" }, # There are a few crates still depdending on the 1.x
+    { name = "spin", version = "0.5.2" }, # lazy_static and ring depends on the old version
+    { name = "socket2", version = "0.4.9" }, # hyper depends on the old version
+    { name = "regex-syntax", version = "0.6.29" }, # tracing-subscriber[env-filter] -> matchers depends on the old version
+    { name = "regex-automata", version = "0.1.10" }, # ^
+    { name = "ordered-float", version = "2.10.0" }, # opentelemetry-jaeger -> thrift depends on the old version
+    { name = "rustix", version = "0.37.23" }, # wasmtime depends on the old version
+    { name = "object", version = "0.30.4" }, # wasmtime depends on the old version
+    { name = "memoffset", version = "0.8.0" }, # wasmtime depends on the old version
+    { name = "addr2line", version = "0.19.0" }, # wasmtime depends on the old version
+    { name = "itertools", version = "0.10.5" }, # wasmtime & others depends on the old version
+    { name = "idna", version = "0.3.0" }, # lettre depends on an old version
+    { name = "hashbrown" }, # Too many versions :(
+]
+
+skip-tree = [
+    # Let's ignore wiremock for now, we want to get rid of it
+    { name = "wiremock", depth = 3 },
+    { name = "rustix", version = "0.37.23", depth = 2 }, # wasmtime depends on the old version
+    { name = "darling", version = "0.14.4", depth = 2 }, # sea-query-attr depends on an old version
+]
+
+# We should never enable the (default) `oldtime` feature of `chrono`
+[[bans.features]]
+name = "chrono"
+deny = ["oldtime"]
+
+[sources]
+unknown-registry = "warn"
+unknown-git = "warn"
+allow-registry = ["https://github.com/rust-lang/crates.io-index"]
+allow-git = [
+    # We depend on an unrelease version
+    "https://github.com/dylanhart/ulid-rs",
+]
+
+[sources.allow-org]
+# Allow our own crates
+github = ["matrix-org"]