diff --git a/lib/Cargo.toml b/lib/Cargo.toml
index b92c17b..51e6713 100644
--- a/lib/Cargo.toml
+++ b/lib/Cargo.toml
@@ -52,6 +52,10 @@ allow_attributes_without_reason = "deny"
 string_slice = "deny"
 # Reject leftover `dbg!` debugging macros so they never ship to production.
 dbg_macro = "deny"
+# Reject leftover `todo!()` placeholder macros, which panic at runtime if
+# they ship accidentally. Closes the last common panic-causing macro not
+# already covered by the no-panic lints above.
+todo = "deny"
 # Allow pedantic lints that are too noisy for this codebase
 missing_errors_doc = "allow"
 missing_panics_doc = "allow"