diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a7c6bcc2139..e84cfa174f3 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,8 +32,6 @@ jobs:
         run: |
           rustup target add thumbv7m-none-eabi
           sudo apt-get -y install gcc-arm-none-eabi
-      - name: Check for unknown cfg tags
-        run: ci/check-cfg-flags.py
       - name: shellcheck the CI script
         if: "matrix.platform == 'ubuntu-latest'"
         run: |
diff --git a/Cargo.toml b/Cargo.toml
index ec9edb3ac33..0aa7f7624d8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -42,3 +42,25 @@ panic = "abort"
 
 [patch.crates-io.possiblyrandom]
 path = "possiblyrandom"
+
+[workspace.lints.rust.unexpected_cfgs]
+level = "forbid"
+# When adding a new cfg attribute, ensure that it is added to this list.
+#
+# Note that Cargo automatically declares corresponding cfgs for every feature
+# defined in the member-level [features] tables as "expected".
+check-cfg = [
+    "cfg(fuzzing)",
+    "cfg(secp256k1_fuzz)",
+    "cfg(hashes_fuzz)",
+    "cfg(test)",
+    "cfg(debug_assertions)",
+    "cfg(c_bindings)",
+    "cfg(ldk_bench)",
+    "cfg(taproot)",
+    "cfg(async_signing)",
+    "cfg(require_route_graph_test)",
+    "cfg(dual_funding)",
+    "cfg(splicing)",
+    "cfg(async_payments)",
+]
diff --git a/ci/check-cfg-flags.py b/ci/check-cfg-flags.py
deleted file mode 100755
index d73bf50a1f6..00000000000
--- a/ci/check-cfg-flags.py
+++ /dev/null
@@ -1,170 +0,0 @@
-#!/usr/bin/env python3
-# Rust is fairly relaxed in checking the validity of arguments passed to #[cfg].
-# While it should probably be more strict when checking features, it cannot be
-# strict when checking loose cfg tags, because those can be anything and are
-# simply passed to rustc via unconstrained arguments.
-#
-# Thus, we do it for rustc manually, but scanning all our source and checking
-# that all our cfg tags match a known cfg tag.
-import sys, glob, re
-
-def check_feature(feature):
-    if feature == "std":
-        pass
-    elif feature == "no-std":
-        pass
-    elif feature == "possiblyrandom":
-        pass
-    elif feature == "getrandom":
-        pass
-    elif feature == "hashbrown":
-        pass
-    elif feature == "backtrace":
-        pass
-    elif feature == "grind_signatures":
-        pass
-    elif feature == "unsafe_revoked_tx_signing":
-        pass
-    elif feature == "futures":
-        pass
-    elif feature == "tokio":
-        pass
-    elif feature == "rest-client":
-        pass
-    elif feature == "rpc-client":
-        pass
-    elif feature == "serde":
-        pass
-    elif feature == "esplora-blocking":
-        pass
-    elif feature == "esplora-async":
-        pass
-    elif feature == "async-interface":
-        pass
-    elif feature == "electrum":
-        pass
-    elif feature == "time":
-        pass
-    elif feature == "_test_utils":
-        pass
-    elif feature == "_test_vectors":
-        pass
-    elif feature == "afl":
-        pass
-    elif feature == "honggfuzz":
-        pass
-    elif feature == "libfuzzer_fuzz":
-        pass
-    elif feature == "stdin_fuzz":
-        pass
-    elif feature == "max_level_off":
-        pass
-    elif feature == "max_level_error":
-        pass
-    elif feature == "max_level_warn":
-        pass
-    elif feature == "max_level_info":
-        pass
-    elif feature == "max_level_debug":
-        pass
-    elif feature == "max_level_trace":
-        pass
-    else:
-        print("Bad feature: " + feature)
-        assert False
-
-def check_target_os(os):
-    if os == "windows":
-        pass
-    else:
-        assert False
-
-def check_cfg_tag(cfg):
-    if cfg == "fuzzing":
-        pass
-    elif cfg == "secp256k1_fuzz":
-        pass
-    elif cfg == "hashes_fuzz":
-        pass
-    elif cfg == "test":
-        pass
-    elif cfg == "debug_assertions":
-        pass
-    elif cfg == "c_bindings":
-        pass
-    elif cfg == "ldk_bench":
-        pass
-    elif cfg == "taproot":
-        pass
-    elif cfg == "async_signing":
-        pass
-    elif cfg == "require_route_graph_test":
-        pass
-    elif cfg == "dual_funding":
-        pass
-    elif cfg == "splicing":
-        pass
-    elif cfg == "async_payments":
-        pass
-    else:
-        print("Bad cfg tag: " + cfg)
-        assert False
-
-def check_cfg_args(cfg):
-    if cfg.startswith("all(") or cfg.startswith("any(") or cfg.startswith("not("):
-        brackets = 1
-        pos = 4
-        while pos < len(cfg):
-            if cfg[pos] == "(":
-                brackets += 1
-            elif cfg[pos] == ")":
-                brackets -= 1
-                if brackets == 0:
-                    check_cfg_args(cfg[4:pos])
-                    if pos + 1 != len(cfg):
-                        assert cfg[pos + 1] == ","
-                        check_cfg_args(cfg[pos + 2:].strip())
-                    return
-            pos += 1
-        assert False
-        assert(cfg.endswith(")"))
-        check_cfg_args(cfg[4:len(cfg)-1])
-    else:
-        parts = [part.strip() for part in cfg.split(",", 1)]
-        if len(parts) > 1:
-            for part in parts:
-                check_cfg_args(part)
-        elif cfg.startswith("feature") or cfg.startswith("target_os") or cfg.startswith("target_pointer_width"):
-            arg = cfg
-            if cfg.startswith("feature"):
-                arg = arg[7:].strip()
-            elif cfg.startswith("target_os"):
-                arg = arg[9:].strip()
-            else:
-                arg = arg[20:].strip()
-            assert arg.startswith("=")
-            arg = arg[1:].strip()
-            assert arg.startswith("\"")
-            assert arg.endswith("\"")
-            arg = arg[1:len(arg)-1]
-            assert not "\"" in arg
-            if cfg.startswith("feature"):
-                check_feature(arg)
-            elif cfg.startswith("target_os"):
-                check_target_os(arg)
-            else:
-                assert arg == "32" or arg == "64"
-        else:
-            check_cfg_tag(cfg.strip())
-
-cfg_regex = re.compile("#\[cfg\((.*)\)\]")
-for path in glob.glob(sys.path[0] + "/../**/*.rs", recursive = True):
-    with open(path, "r") as file:
-        while True:
-            line = file.readline()
-            if not line:
-                break
-            if "#[cfg(" in line:
-                if not line.strip().startswith("//"):
-                    cfg_part = cfg_regex.match(line.strip()).group(1)
-                    check_cfg_args(cfg_part)
diff --git a/lightning-background-processor/Cargo.toml b/lightning-background-processor/Cargo.toml
index e563e2acd9b..df4b2c8278e 100644
--- a/lightning-background-processor/Cargo.toml
+++ b/lightning-background-processor/Cargo.toml
@@ -30,3 +30,6 @@ tokio = { version = "1.35", features = [ "macros", "rt", "rt-multi-thread", "syn
 lightning = { version = "0.0.123-beta", path = "../lightning", features = ["_test_utils"] }
 lightning-invoice = { version = "0.31.0-beta", path = "../lightning-invoice" }
 lightning-persister = { version = "0.0.123-beta", path = "../lightning-persister" }
+
+[lints]
+workspace = true
diff --git a/lightning-block-sync/Cargo.toml b/lightning-block-sync/Cargo.toml
index b232a6ae4ab..2e827000017 100644
--- a/lightning-block-sync/Cargo.toml
+++ b/lightning-block-sync/Cargo.toml
@@ -28,3 +28,6 @@ chunked_transfer = { version = "1.4", optional = true }
 [dev-dependencies]
 lightning = { version = "0.0.123-beta", path = "../lightning", features = ["_test_utils"] }
 tokio = { version = "1.35", features = [ "macros", "rt" ] }
+
+[lints]
+workspace = true
diff --git a/lightning-custom-message/Cargo.toml b/lightning-custom-message/Cargo.toml
index ce358159596..f74ead81c97 100644
--- a/lightning-custom-message/Cargo.toml
+++ b/lightning-custom-message/Cargo.toml
@@ -16,3 +16,6 @@ rustdoc-args = ["--cfg", "docsrs"]
 [dependencies]
 bitcoin = "0.31.2"
 lightning = { version = "0.0.123-beta", path = "../lightning" }
+
+[lints]
+workspace = true
diff --git a/lightning-invoice/Cargo.toml b/lightning-invoice/Cargo.toml
index 22f8616a2f9..cd449d8d1a7 100644
--- a/lightning-invoice/Cargo.toml
+++ b/lightning-invoice/Cargo.toml
@@ -18,6 +18,7 @@ rustdoc-args = ["--cfg", "docsrs"]
 default = ["std"]
 no-std = ["lightning/no-std"]
 std = ["bitcoin/std", "lightning/std", "bech32/std"]
+strict = []
 
 [dependencies]
 bech32 = { version = "0.9.1", default-features = false }
@@ -31,3 +32,6 @@ lightning = { version = "0.0.123-beta", path = "../lightning", default-features
 hex = { package = "hex-conservative", version = "0.1.1", default-features = false }
 serde_json = { version = "1"}
 hashbrown = { version = "0.13", default-features = false }
+
+[lints]
+workspace = true
diff --git a/lightning-net-tokio/Cargo.toml b/lightning-net-tokio/Cargo.toml
index c340fc85640..c5655371145 100644
--- a/lightning-net-tokio/Cargo.toml
+++ b/lightning-net-tokio/Cargo.toml
@@ -22,3 +22,6 @@ tokio = { version = "1.35", features = [ "rt", "sync", "net", "time" ] }
 [dev-dependencies]
 tokio = { version = "1.35", features = [ "macros", "rt", "rt-multi-thread", "sync", "net", "time" ] }
 lightning = { version = "0.0.123-beta", path = "../lightning", features = ["_test_utils"] }
+
+[lints]
+workspace = true
diff --git a/lightning-persister/Cargo.toml b/lightning-persister/Cargo.toml
index 49f63614e83..5f1e2774064 100644
--- a/lightning-persister/Cargo.toml
+++ b/lightning-persister/Cargo.toml
@@ -26,3 +26,6 @@ criterion = { version = "0.4", optional = true, default-features = false }
 [dev-dependencies]
 lightning = { version = "0.0.123-beta", path = "../lightning", features = ["_test_utils"] }
 bitcoin = { version = "0.31.2", default-features = false }
+
+[lints]
+workspace = true
diff --git a/lightning-rapid-gossip-sync/Cargo.toml b/lightning-rapid-gossip-sync/Cargo.toml
index ad25e2f3084..7ca67a38ec8 100644
--- a/lightning-rapid-gossip-sync/Cargo.toml
+++ b/lightning-rapid-gossip-sync/Cargo.toml
@@ -23,3 +23,6 @@ criterion = { version = "0.4", optional = true, default-features = false }
 
 [dev-dependencies]
 lightning = { version = "0.0.123-beta", path = "../lightning", features = ["_test_utils"] }
+
+[lints]
+workspace = true
diff --git a/lightning-transaction-sync/Cargo.toml b/lightning-transaction-sync/Cargo.toml
index 23ead252a81..ab796749954 100644
--- a/lightning-transaction-sync/Cargo.toml
+++ b/lightning-transaction-sync/Cargo.toml
@@ -39,3 +39,6 @@ electrsd = { version = "0.27.3", default-features = false, features = ["legacy",
 
 [target.'cfg(all(not(target_os = "windows"), no_download))'.dev-dependencies]
 electrsd = { version = "0.27.3", default-features = false, features = ["legacy"] }
+
+[lints]
+workspace = true
diff --git a/lightning/Cargo.toml b/lightning/Cargo.toml
index 8f238f5b557..cf4a5329476 100644
--- a/lightning/Cargo.toml
+++ b/lightning/Cargo.toml
@@ -65,3 +65,6 @@ criterion = { version = "0.4", optional = true, default-features = false }
 
 [target.'cfg(taproot)'.dependencies]
 musig2 = { git = "https://github.com/arik-so/rust-musig2", rev = "739533fc" }
+
+[lints]
+workspace = true
diff --git a/possiblyrandom/Cargo.toml b/possiblyrandom/Cargo.toml
index 5d8a35ccdf5..4508f690129 100644
--- a/possiblyrandom/Cargo.toml
+++ b/possiblyrandom/Cargo.toml
@@ -19,3 +19,6 @@ getrandom = { version = "0.2", optional = true, default-features = false }
 # Enable getrandom if we are on a platform that (likely) supports it
 [target.'cfg(not(any(target_os = "unknown", target_os = "none")))'.dependencies]
 getrandom = { version = "0.2", default-features = false }
+
+[lints]
+workspace = true