diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 008603f23..755c6fea9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -229,7 +229,7 @@ jobs:
     strategy:
       matrix:
         checks:
-          - bans 
+          - bans
           - sources
 
     # Prevent sudden announcement of a new advisory from failing ci:
@@ -244,3 +244,10 @@ jobs:
       with:
         command: check ${{ matrix.checks }}
         args: --all-features --workspace
+
+    # this check runs with optional features off
+    # so we expect some warnings about "skip tree root was not found"
+    - uses: EmbarkStudios/cargo-deny-action@v1
+      with:
+        command: check ${{ matrix.checks }}
+        args: --workspace
diff --git a/deny.toml b/deny.toml
index e289d437a..044043425 100644
--- a/deny.toml
+++ b/deny.toml
@@ -46,9 +46,6 @@ skip-tree = [
     # ticket #2984: owo-colors dependencies
     { name = "color-eyre", version = "=0.5.11" },
 
-    # ticket #2998: hdrhistogram dependencies
-    { name = "hdrhistogram", version = "=6.3.4" },
-
     # ticket #3061: reqwest and minreq dependencies
     { name = "webpki-roots", version = "=0.18.0" },
 
@@ -59,6 +56,12 @@ skip-tree = [
     # alternative: downgrade Zebra to `bigint`
     { name = "bigint", version = "=4.4.3" },
 
+    # upgrade sentry, metrics-exporter-prometheus, reqwest, hyper,
+    # which needs #2953: upgrade tracing to the latest major version
+    #
+    # also wait for tower-test and tokio-test to upgrade
+    { name = "tokio-util", version = "=0.6.9" },
+
     # recent major version bumps
     # we should re-check these dependencies in February 2022