diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 19d92324..9357cf6e 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -56,5 +56,6 @@ jobs:
           # and still passes. dependency-submission.yml provides snapshots for main.
           # Fail the PR when it introduces a vulnerability at or above this severity.
           fail-on-severity: high
-          # Block copyleft / incompatible licenses that conflict with this MIT project.
-          deny-licenses: GPL-1.0-or-later, GPL-2.0-or-later, GPL-3.0-or-later, LGPL-2.0-or-later, LGPL-2.1-or-later, LGPL-3.0-or-later, AGPL-3.0-or-later
+          # Fail closed with licenses derived from the project's full dependency tree,
+          # replacing the deprecated deny-licenses option.
+          allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0