diff --git a/Cargo.lock b/Cargo.lock
index bb73cbe12ae9..8a8c22a3fed4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3123,7 +3123,6 @@ dependencies = [
  "http-body-util",
  "hyper",
  "lazy_static",
- "tempfile",
  "test-log",
  "tokio",
  "tracing",
diff --git a/Cargo.toml b/Cargo.toml
index 659d68f47e18..f16c88bf7281 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -54,8 +54,8 @@ rustix = { workspace = true, features = ["mm", "param"] }
 wasmtime = { workspace = true, features = ['component-model', 'async', 'default', 'winch'] }
 env_logger = { workspace = true }
 log = { workspace = true }
-filecheck = "0.5.0"
-tempfile = "3.1.0"
+filecheck = { workspace = true }
+tempfile = { workspace = true }
 test-programs = { path = "crates/test-programs" }
 wasmtime-runtime = { workspace = true }
 tokio = { version = "1.8.0", features = ["rt", "time", "macros", "rt-multi-thread"] }
@@ -181,8 +181,24 @@ winch-test-macros = { path = "winch/test-macros" }
 wasi-preview1-component-adapter = { path = "crates/wasi-preview1-component-adapter" }
 byte-array-literals = { path = "crates/wasi-preview1-component-adapter/byte-array-literals" }
 
+# Bytecode Alliance maintained dependencies:
+# ---------------------------
+regalloc2 = "0.8.1"
+
+# cap-std family:
 target-lexicon = { version = "0.12.3", default-features = false, features = ["std"] }
-anyhow = "1.0.22"
+cap-std = "1.0.0"
+cap-rand = "1.0.0"
+io-lifetimes = { version = "1.0.0", default-features = false }
+rustix = "0.37.13"
+
+# wit-bindgen:
+wit-bindgen = "0.6.0"
+
+# FIXME: the above wit-bindgen depends on versions ahead of the wasm-tools
+# dependencies below. When the below are updated, remove the exception
+# for duplicate wasm-encoder, wasmparser, and wit-parser from deny.toml
+# wasm-tools family:
 wasmparser = "0.104.0"
 wat = "1.0.63"
 wast = "57.0.0"
@@ -191,20 +207,21 @@ wasm-encoder = "0.26.0"
 wasm-smith = "0.12.7"
 wasm-mutate = "0.2.24"
 wit-parser = "0.7.1"
+wit-component = "0.7.2"
+
+# Non-Bytecode Alliance maintained dependencies:
+# --------------------------
+object = { version = "0.30.3", default-features = false, features = ['read_core', 'elf', 'std'] }
+gimli = { version = "0.27.0", default-features = false, features = ['read', 'std'] }
+anyhow = "1.0.22"
 windows-sys = "0.48.0"
 env_logger = "0.10"
-rustix = "0.37.13"
 log = { version = "0.4.8", default-features = false }
-object = { version = "0.30.3", default-features = false, features = ['read_core', 'elf', 'std'] }
-gimli = { version = "0.27.0", default-features = false, features = ['read', 'std'] }
 clap = { version = "3.2.0", features = ["color", "suggestions", "derive"] }
 hashbrown = "0.13.2"
-cap-std = "1.0.0"
-cap-rand = "1.0.0"
 capstone = "0.9.0"
 once_cell = "1.12.0"
 smallvec = { version = "1.6.1", features = ["union"] }
-io-lifetimes = { version = "1.0.0", default-features = false }
 tracing = "0.1.26"
 bitflags = "1.2"
 thiserror = "1.0.15"
@@ -216,8 +233,10 @@ serde = "1.0.94"
 serde_json = "1.0.80"
 glob = "0.3.0"
 libfuzzer-sys = "0.4.0"
-regalloc2 = "0.8.1"
 walkdir = "2.3.3"
+cfg-if = "1.0"
+tempfile = "3.1.0"
+filecheck = "0.5.0"
 
 [features]
 default = [
diff --git a/cranelift/Cargo.toml b/cranelift/Cargo.toml
index c94f0f40f501..03bcba84929a 100644
--- a/cranelift/Cargo.toml
+++ b/cranelift/Cargo.toml
@@ -19,7 +19,7 @@ path = "tests/filetests.rs"
 harness = false
 
 [dependencies]
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 cranelift-codegen = { workspace = true, features = ["disas"] }
 cranelift-entity = { workspace = true }
 cranelift-interpreter = { workspace = true }
@@ -32,7 +32,7 @@ cranelift-module = { workspace = true }
 cranelift-object = { workspace = true }
 cranelift-jit = { workspace = true }
 cranelift = { workspace = true }
-filecheck = "0.5.0"
+filecheck = { workspace = true }
 log = { workspace = true }
 termcolor = "1.1.2"
 capstone = { workspace = true, optional = true }
diff --git a/cranelift/filetests/Cargo.toml b/cranelift/filetests/Cargo.toml
index 789dfa5c66a1..4ff5037bdf7f 100644
--- a/cranelift/filetests/Cargo.toml
+++ b/cranelift/filetests/Cargo.toml
@@ -19,7 +19,7 @@ cranelift-jit = { workspace = true, features = ["selinux-fix"] }
 cranelift-module = { workspace = true }
 cranelift-control = { workspace = true }
 file-per-thread-logger = "0.1.2"
-filecheck = "0.5.0"
+filecheck = { workspace = true }
 gimli = { workspace = true }
 log = { workspace = true }
 num_cpus = "1.8.0"
diff --git a/crates/asm-macros/Cargo.toml b/crates/asm-macros/Cargo.toml
index b8b667573f05..8b9d96cc9ae3 100644
--- a/crates/asm-macros/Cargo.toml
+++ b/crates/asm-macros/Cargo.toml
@@ -10,4 +10,4 @@ version.workspace = true
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-cfg-if = "1"
+cfg-if = { workspace = true }
diff --git a/crates/fiber/Cargo.toml b/crates/fiber/Cargo.toml
index 1ba28127520e..e2acc6c0f444 100644
--- a/crates/fiber/Cargo.toml
+++ b/crates/fiber/Cargo.toml
@@ -14,7 +14,7 @@ edition.workspace = true
 links = "wasmtime-fiber-shims"
 
 [dependencies]
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 
 [target.'cfg(unix)'.dependencies]
 rustix = { workspace = true, features = ["mm", "param"] }
diff --git a/crates/jit-icache-coherence/Cargo.toml b/crates/jit-icache-coherence/Cargo.toml
index 3347556171e2..8500c7924a77 100644
--- a/crates/jit-icache-coherence/Cargo.toml
+++ b/crates/jit-icache-coherence/Cargo.toml
@@ -9,7 +9,7 @@ repository = "https://github.com/bytecodealliance/wasmtime"
 edition.workspace = true
 
 [dependencies]
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 
 [target.'cfg(target_os = "windows")'.dependencies.windows-sys]
 workspace = true
diff --git a/crates/jit/Cargo.toml b/crates/jit/Cargo.toml
index 90a11f87e55a..a90737b47fcd 100644
--- a/crates/jit/Cargo.toml
+++ b/crates/jit/Cargo.toml
@@ -16,7 +16,7 @@ wasmtime-jit-debug = { workspace = true, features = ["perf_jitdump"], optional =
 wasmtime-runtime = { workspace = true }
 target-lexicon = { workspace = true }
 anyhow = { workspace = true }
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 gimli = { workspace = true }
 object = { workspace = true }
 serde = { version = "1.0.94", features = ["derive"] }
diff --git a/crates/runtime/Cargo.toml b/crates/runtime/Cargo.toml
index 0ff570f4cba4..279bc0b72e3b 100644
--- a/crates/runtime/Cargo.toml
+++ b/crates/runtime/Cargo.toml
@@ -19,7 +19,7 @@ libc = { version = "0.2.112", default-features = false }
 log = { workspace = true }
 memoffset = "0.8.0"
 indexmap = "1.0.2"
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 rand = { version = "0.8.3", features = ['small_rng'] }
 anyhow = { workspace = true }
 memfd = "0.6.2"
diff --git a/crates/test-programs/Cargo.toml b/crates/test-programs/Cargo.toml
index fb4594d91b5a..f32488e4b699 100644
--- a/crates/test-programs/Cargo.toml
+++ b/crates/test-programs/Cargo.toml
@@ -8,14 +8,13 @@ publish = false
 license = "Apache-2.0 WITH LLVM-exception"
 
 [build-dependencies]
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 cargo_metadata = "0.15.3"
-wit-component = "0.7.4"
-heck = "0.4.0"
+wit-component = { workspace = true }
+heck = { workspace = true }
 
 [dev-dependencies]
 anyhow = { workspace = true }
-tempfile = "3.1.0"
 test-log = { version = "0.2", default-features = false, features = ["trace"] }
 tracing = { workspace = true }
 tracing-subscriber = { version = "0.3.1", default-features = false, features = ['fmt', 'env-filter'] }
diff --git a/crates/test-programs/wasi-http-tests/Cargo.toml b/crates/test-programs/wasi-http-tests/Cargo.toml
index c74b578be87a..d6f90599f783 100644
--- a/crates/test-programs/wasi-http-tests/Cargo.toml
+++ b/crates/test-programs/wasi-http-tests/Cargo.toml
@@ -6,5 +6,5 @@ edition = "2021"
 publish = false
 
 [dependencies]
-anyhow = "1"
-wit-bindgen = "0.6.0"
+anyhow = { workspace = true }
+wit-bindgen = { workspace = true }
diff --git a/crates/wasmtime/Cargo.toml b/crates/wasmtime/Cargo.toml
index 0ebab2787c3a..26d89b0344b3 100644
--- a/crates/wasmtime/Cargo.toml
+++ b/crates/wasmtime/Cargo.toml
@@ -31,7 +31,7 @@ target-lexicon = { workspace = true }
 wasmparser = { workspace = true }
 anyhow = { workspace = true }
 libc = "0.2"
-cfg-if = "1.0"
+cfg-if = { workspace = true }
 log = { workspace = true }
 wat = { workspace = true, optional = true }
 serde = { version = "1.0.94", features = ["derive"] }