diff --git a/.config/hakari.toml b/.config/hakari.toml
new file mode 100644
index 0000000000..9562f92300
--- /dev/null
+++ b/.config/hakari.toml
@@ -0,0 +1,29 @@
+# This file contains settings for `cargo hakari`.
+# See https://docs.rs/cargo-hakari/latest/cargo_hakari/config for a full list of options.
+
+hakari-package = "omicron-workspace-hack"
+
+# Format for `workspace-hack = ...` lines in other Cargo.tomls. Requires cargo-hakari 0.9.8 or above.
+dep-format-version = "4"
+
+# Setting workspace.resolver = "2" in the root Cargo.toml is HIGHLY recommended.
+# Hakari works much better with the new feature resolver.
+# For more about the new feature resolver, see:
+# https://blog.rust-lang.org/2021/03/25/Rust-1.51.0.html#cargos-new-feature-resolver
+resolver = "2"
+
+# Add triples corresponding to platforms commonly used by developers here.
+# https://doc.rust-lang.org/rustc/platform-support.html
+platforms = [
+    "x86_64-unknown-linux-gnu",
+    "x86_64-apple-darwin",
+    "aarch64-apple-darwin",
+    "x86_64-unknown-illumos",
+    # "x86_64-pc-windows-msvc",
+]
+
+[traversal-excludes]
+workspace-members = ["xtask"]
+
+# Write out exact versions rather than a semver range. (Defaults to false.)
+# exact-versions = true
diff --git a/.github/buildomat/jobs/build-and-test-helios.sh b/.github/buildomat/jobs/build-and-test-helios.sh
index c1a9bee581..f9722a2b92 100755
--- a/.github/buildomat/jobs/build-and-test-helios.sh
+++ b/.github/buildomat/jobs/build-and-test-helios.sh
@@ -3,7 +3,7 @@
 #: name = "build-and-test (helios)"
 #: variety = "basic"
 #: target = "helios-2.0"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = [
 #:	"/var/tmp/omicron_tmp/*",
 #:	"!/var/tmp/omicron_tmp/crdb-base*",
diff --git a/.github/buildomat/jobs/build-and-test-linux.sh b/.github/buildomat/jobs/build-and-test-linux.sh
index 50bdb22e56..f33d1a8cfa 100755
--- a/.github/buildomat/jobs/build-and-test-linux.sh
+++ b/.github/buildomat/jobs/build-and-test-linux.sh
@@ -3,7 +3,7 @@
 #: name = "build-and-test (ubuntu-20.04)"
 #: variety = "basic"
 #: target = "ubuntu-20.04"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = [
 #:	"/var/tmp/omicron_tmp/*",
 #:	"!/var/tmp/omicron_tmp/crdb-base*",
diff --git a/.github/buildomat/jobs/ci-tools.sh b/.github/buildomat/jobs/ci-tools.sh
index b5d1d26f1a..702561a951 100755
--- a/.github/buildomat/jobs/ci-tools.sh
+++ b/.github/buildomat/jobs/ci-tools.sh
@@ -3,7 +3,7 @@
 #: name = "helios / CI tools"
 #: variety = "basic"
 #: target = "helios-2.0"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = [
 #:	"=/work/end-to-end-tests/*.gz",
 #:	"=/work/caboose-util.gz",
diff --git a/.github/buildomat/jobs/clippy.sh b/.github/buildomat/jobs/clippy.sh
index 184b4ccbe6..dba1021919 100755
--- a/.github/buildomat/jobs/clippy.sh
+++ b/.github/buildomat/jobs/clippy.sh
@@ -3,7 +3,7 @@
 #: name = "clippy (helios)"
 #: variety = "basic"
 #: target = "helios-2.0"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = []
 
 # Run clippy on illumos (not just other systems) because a bunch of our code
diff --git a/.github/buildomat/jobs/host-image.sh b/.github/buildomat/jobs/host-image.sh
index 0e2191ebc8..ba0b4e1ac3 100755
--- a/.github/buildomat/jobs/host-image.sh
+++ b/.github/buildomat/jobs/host-image.sh
@@ -3,7 +3,7 @@
 #: name = "helios / build OS image"
 #: variety = "basic"
 #: target = "helios-2.0"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = [
 #:	"=/work/helios/image/output/os.tar.gz",
 #: ]
diff --git a/.github/buildomat/jobs/package.sh b/.github/buildomat/jobs/package.sh
index eedb3b1723..fe5d6a9b7f 100755
--- a/.github/buildomat/jobs/package.sh
+++ b/.github/buildomat/jobs/package.sh
@@ -3,7 +3,7 @@
 #: name = "helios / package"
 #: variety = "basic"
 #: target = "helios-2.0"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = [
 #:	"=/work/version.txt",
 #:	"=/work/package.tar.gz",
diff --git a/.github/buildomat/jobs/trampoline-image.sh b/.github/buildomat/jobs/trampoline-image.sh
index 794ebd96c1..6014d7dca0 100755
--- a/.github/buildomat/jobs/trampoline-image.sh
+++ b/.github/buildomat/jobs/trampoline-image.sh
@@ -3,7 +3,7 @@
 #: name = "helios / build trampoline OS image"
 #: variety = "basic"
 #: target = "helios-2.0"
-#: rust_toolchain = "1.72.0"
+#: rust_toolchain = "1.72.1"
 #: output_rules = [
 #:	"=/work/helios/image/output/os.tar.gz",
 #: ]
diff --git a/.github/workflows/hakari.yml b/.github/workflows/hakari.yml
new file mode 100644
index 0000000000..d79196d318
--- /dev/null
+++ b/.github/workflows/hakari.yml
@@ -0,0 +1,37 @@
+# This workflow file serves as an example for cargo-hakari CI integration.
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+
+name: cargo hakari
+
+jobs:
+  workspace-hack-check:
+    name: Check workspace-hack
+    runs-on: ubuntu-latest
+    env:
+      RUSTFLAGS: -D warnings
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable
+      - name: Install cargo-hakari
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-hakari
+      - name: Check workspace-hack Cargo.toml is up-to-date
+        uses: actions-rs/cargo@v1
+        with:
+          command: hakari
+          args: generate --diff
+      - name: Check all crates depend on workspace-hack
+        uses: actions-rs/cargo@v1
+        with:
+          command: hakari
+          args: manage-deps --dry-run
diff --git a/Cargo.lock b/Cargo.lock
index f457d10ddf..138080640e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -184,6 +184,7 @@ dependencies = [
 name = "api_identity"
 version = "0.1.0"
 dependencies = [
+ "omicron-workspace-hack",
  "proc-macro2",
  "quote",
  "syn 2.0.32",
@@ -370,6 +371,7 @@ name = "authz-macros"
 version = "0.1.0"
 dependencies = [
  "heck 0.4.1",
+ "omicron-workspace-hack",
  "proc-macro2",
  "quote",
  "serde",
@@ -658,6 +660,7 @@ dependencies = [
  "omicron-common 0.1.0",
  "omicron-rpaths",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "pq-sys",
  "proptest",
  "rand 0.8.5",
@@ -684,6 +687,7 @@ dependencies = [
  "chrono",
  "ipnetwork",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "progenitor",
  "regress",
  "reqwest",
@@ -789,6 +793,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "hubtools",
+ "omicron-workspace-hack",
 ]
 
 [[package]]
@@ -1245,6 +1250,7 @@ dependencies = [
  "dropshot",
  "hex",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "ring",
  "slog",
  "tokio",
@@ -1726,6 +1732,7 @@ name = "db-macros"
 version = "0.1.0"
 dependencies = [
  "heck 0.4.1",
+ "omicron-workspace-hack",
  "proc-macro2",
  "quote",
  "rustfmt-wrapper",
@@ -1741,6 +1748,7 @@ dependencies = [
  "anyhow",
  "either",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "omicron-zone-package",
  "progenitor",
  "progenitor-client",
@@ -2009,6 +2017,7 @@ dependencies = [
  "expectorate",
  "http",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "openapi-lint",
  "openapiv3",
  "pretty-hex 0.3.0",
@@ -2039,6 +2048,7 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "http",
+ "omicron-workspace-hack",
  "progenitor",
  "reqwest",
  "schemars",
@@ -2095,6 +2105,7 @@ dependencies = [
  "futures",
  "http",
  "ipnetwork",
+ "omicron-workspace-hack",
  "omicron-zone-package",
  "progenitor",
  "progenitor-client",
@@ -2280,6 +2291,7 @@ dependencies = [
  "http",
  "omicron-sled-agent",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "oxide-client",
  "rand 0.8.5",
  "reqwest",
@@ -2720,6 +2732,7 @@ dependencies = [
  "hex",
  "libc",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "reqwest",
  "serde",
  "serde_json",
@@ -2738,6 +2751,7 @@ version = "0.1.0"
 dependencies = [
  "base64 0.21.4",
  "chrono",
+ "omicron-workspace-hack",
  "progenitor",
  "rand 0.8.5",
  "reqwest",
@@ -2802,6 +2816,7 @@ dependencies = [
  "gateway-messages",
  "omicron-gateway",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "slog",
  "sp-sim",
  "tokio",
@@ -3379,6 +3394,7 @@ dependencies = [
  "macaddr",
  "mockall",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "opte-ioctl",
  "oxide-vpc",
  "regress",
@@ -3488,6 +3504,7 @@ dependencies = [
  "libc",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "once_cell",
  "partial-io",
  "progenitor-client",
@@ -3517,6 +3534,7 @@ name = "installinator-artifact-client"
 version = "0.1.0"
 dependencies = [
  "installinator-common",
+ "omicron-workspace-hack",
  "progenitor",
  "regress",
  "reqwest",
@@ -3542,6 +3560,7 @@ dependencies = [
  "installinator-common",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "openapi-lint",
  "openapiv3",
  "schemars",
@@ -3561,6 +3580,7 @@ dependencies = [
  "camino",
  "illumos-utils",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "schemars",
  "serde",
  "serde_json",
@@ -3593,6 +3613,7 @@ dependencies = [
  "hyper",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "progenitor",
  "reqwest",
  "serde",
@@ -3635,6 +3656,7 @@ dependencies = [
  "dropshot",
  "internal-dns 0.1.0",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "slog",
  "tokio",
  "trust-dns-resolver",
@@ -3658,6 +3680,7 @@ dependencies = [
  "ciborium",
  "libc",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "proptest",
  "serde",
  "test-strategy",
@@ -3762,6 +3785,7 @@ dependencies = [
  "async-trait",
  "hkdf",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "secrecy",
  "sha3",
  "slog",
@@ -4252,6 +4276,7 @@ dependencies = [
  "ipnetwork",
  "omicron-common 0.1.0",
  "omicron-passwords 0.1.0",
+ "omicron-workspace-hack",
  "progenitor",
  "regress",
  "reqwest",
@@ -4301,6 +4326,7 @@ dependencies = [
  "omicron-common 0.1.0",
  "omicron-passwords 0.1.0",
  "omicron-rpaths",
+ "omicron-workspace-hack",
  "parse-display",
  "pq-sys",
  "rand 0.8.5",
@@ -4356,6 +4382,7 @@ dependencies = [
  "omicron-rpaths",
  "omicron-sled-agent",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "once_cell",
  "openapiv3",
  "openssl",
@@ -4401,6 +4428,7 @@ dependencies = [
  "ipnetwork",
  "lazy_static",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "rand 0.8.5",
  "serde_json",
 ]
@@ -4414,6 +4442,7 @@ dependencies = [
  "internal-dns 0.1.0",
  "nexus-types",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "slog",
  "uuid",
 ]
@@ -4442,6 +4471,7 @@ dependencies = [
  "omicron-passwords 0.1.0",
  "omicron-sled-agent",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "oximeter 0.1.0",
  "oximeter-client",
  "oximeter-collector",
@@ -4461,6 +4491,7 @@ dependencies = [
 name = "nexus-test-utils-macros"
 version = "0.1.0"
 dependencies = [
+ "omicron-workspace-hack",
  "proc-macro2",
  "quote",
  "syn 2.0.32",
@@ -4479,6 +4510,7 @@ dependencies = [
  "newtype_derive",
  "omicron-common 0.1.0",
  "omicron-passwords 0.1.0",
+ "omicron-workspace-hack",
  "openssl",
  "openssl-probe",
  "openssl-sys",
@@ -4785,6 +4817,7 @@ dependencies = [
  "foreign-types 0.3.2",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "openssl",
  "openssl-sys",
  "rcgen",
@@ -4812,6 +4845,7 @@ dependencies = [
  "lazy_static",
  "libc",
  "macaddr",
+ "omicron-workspace-hack",
  "parse-display",
  "progenitor",
  "proptest",
@@ -4885,6 +4919,7 @@ dependencies = [
  "clap 4.4.3",
  "crossbeam",
  "omicron-package",
+ "omicron-workspace-hack",
  "serde",
  "serde_derive",
  "thiserror",
@@ -4910,6 +4945,7 @@ dependencies = [
  "omicron-rpaths",
  "omicron-sled-agent",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "openssl",
  "oxide-client",
  "pq-sys",
@@ -4943,6 +4979,7 @@ dependencies = [
  "ipcc-key-value",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "once_cell",
  "openapi-lint",
  "openapiv3",
@@ -5020,6 +5057,7 @@ dependencies = [
  "omicron-rpaths",
  "omicron-sled-agent",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "once_cell",
  "openapi-lint",
  "openapiv3",
@@ -5099,6 +5137,7 @@ dependencies = [
  "omicron-nexus",
  "omicron-rpaths",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "pq-sys",
  "regex",
  "serde",
@@ -5125,6 +5164,7 @@ dependencies = [
  "illumos-utils",
  "indicatif",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "omicron-zone-package",
  "petgraph",
  "rayon",
@@ -5154,6 +5194,7 @@ version = "0.1.0"
 dependencies = [
  "argon2",
  "criterion",
+ "omicron-workspace-hack",
  "rand 0.8.5",
  "rust-argon2",
  "schemars",
@@ -5178,6 +5219,9 @@ dependencies = [
 [[package]]
 name = "omicron-rpaths"
 version = "0.1.0"
+dependencies = [
+ "omicron-workspace-hack",
+]
 
 [[package]]
 name = "omicron-sled-agent"
@@ -5223,6 +5267,7 @@ dependencies = [
  "nexus-client 0.1.0",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "once_cell",
  "openapi-lint",
  "openapiv3",
@@ -5278,6 +5323,7 @@ dependencies = [
  "http",
  "libc",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "pem",
  "rcgen",
  "regex",
@@ -5292,6 +5338,110 @@ dependencies = [
  "usdt",
 ]
 
+[[package]]
+name = "omicron-workspace-hack"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "bit-set",
+ "bit-vec",
+ "bitflags 1.3.2",
+ "bitflags 2.4.0",
+ "bitvec",
+ "bstr 0.2.17",
+ "bstr 1.6.0",
+ "bytes",
+ "cc",
+ "chrono",
+ "cipher",
+ "clap 4.4.3",
+ "clap_builder",
+ "console",
+ "const-oid",
+ "crossbeam-epoch",
+ "crossbeam-utils",
+ "crypto-common",
+ "diesel",
+ "digest",
+ "either",
+ "flate2",
+ "futures",
+ "futures-channel",
+ "futures-core",
+ "futures-io",
+ "futures-sink",
+ "futures-task",
+ "futures-util",
+ "gateway-messages",
+ "generic-array",
+ "getrandom 0.2.10",
+ "hashbrown 0.13.2",
+ "hashbrown 0.14.0",
+ "hex",
+ "hyper",
+ "hyper-rustls",
+ "indexmap 2.0.0",
+ "inout",
+ "ipnetwork",
+ "itertools 0.10.5",
+ "lalrpop-util",
+ "lazy_static",
+ "libc",
+ "log",
+ "managed",
+ "memchr",
+ "mio",
+ "num-bigint",
+ "num-integer",
+ "num-iter",
+ "num-traits",
+ "once_cell",
+ "openapiv3",
+ "petgraph",
+ "postgres-types",
+ "ppv-lite86",
+ "predicates 3.0.3",
+ "rand 0.8.5",
+ "rand_chacha 0.3.1",
+ "regex",
+ "regex-automata 0.3.8",
+ "regex-syntax 0.7.5",
+ "reqwest",
+ "ring",
+ "rustix 0.38.9",
+ "schemars",
+ "semver 1.0.18",
+ "serde",
+ "sha2",
+ "signature 2.1.0",
+ "similar",
+ "slog",
+ "spin 0.9.8",
+ "string_cache",
+ "subtle",
+ "syn 1.0.109",
+ "syn 2.0.32",
+ "textwrap 0.16.0",
+ "time",
+ "time-macros",
+ "tokio",
+ "tokio-postgres",
+ "tokio-stream",
+ "toml 0.7.8",
+ "toml_datetime",
+ "toml_edit 0.19.15",
+ "tracing",
+ "trust-dns-proto",
+ "unicode-bidi",
+ "unicode-normalization",
+ "unicode-xid",
+ "usdt",
+ "uuid",
+ "yasna",
+ "zeroize",
+ "zip",
+]
+
 [[package]]
 name = "omicron-zone-package"
 version = "0.8.3"
@@ -5498,6 +5648,7 @@ dependencies = [
  "futures",
  "http",
  "hyper",
+ "omicron-workspace-hack",
  "progenitor",
  "rand 0.8.5",
  "regress",
@@ -5532,6 +5683,7 @@ dependencies = [
  "chrono",
  "num",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "oximeter-macro-impl 0.1.0",
  "rstest",
  "schemars",
@@ -5563,6 +5715,7 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "progenitor",
  "reqwest",
  "serde",
@@ -5582,6 +5735,7 @@ dependencies = [
  "nexus-client 0.1.0",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "openapi-lint",
  "openapiv3",
  "oximeter 0.1.0",
@@ -5610,6 +5764,7 @@ dependencies = [
  "dropshot",
  "itertools 0.11.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "oximeter 0.1.0",
  "regex",
  "reqwest",
@@ -5634,6 +5789,7 @@ dependencies = [
  "dropshot",
  "futures",
  "http",
+ "omicron-workspace-hack",
  "oximeter 0.1.0",
  "tokio",
  "uuid",
@@ -5643,6 +5799,7 @@ dependencies = [
 name = "oximeter-macro-impl"
 version = "0.1.0"
 dependencies = [
+ "omicron-workspace-hack",
  "proc-macro2",
  "quote",
  "syn 2.0.32",
@@ -5666,6 +5823,7 @@ dependencies = [
  "dropshot",
  "nexus-client 0.1.0",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "oximeter 0.1.0",
  "reqwest",
  "schemars",
@@ -7920,6 +8078,7 @@ dependencies = [
  "chrono",
  "ipnetwork",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "progenitor",
  "regress",
  "reqwest",
@@ -7945,6 +8104,7 @@ dependencies = [
  "nexus-client 0.1.0",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "rand 0.8.5",
  "schemars",
  "serde",
@@ -8171,6 +8331,7 @@ dependencies = [
  "hex",
  "omicron-common 0.1.0",
  "omicron-gateway",
+ "omicron-workspace-hack",
  "serde",
  "slog",
  "slog-dtrace",
@@ -9168,6 +9329,7 @@ dependencies = [
  "humantime",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "predicates 3.0.3",
  "slog",
  "slog-async",
@@ -9196,6 +9358,7 @@ dependencies = [
  "itertools 0.11.0",
  "omicron-common 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "rand 0.8.5",
  "ring",
  "serde",
@@ -9422,6 +9585,7 @@ dependencies = [
  "indicatif",
  "linear-map",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "owo-colors",
  "petgraph",
  "schemars",
@@ -9799,6 +9963,7 @@ dependencies = [
  "itertools 0.11.0",
  "omicron-common 0.1.0",
  "omicron-passwords 0.1.0",
+ "omicron-workspace-hack",
  "once_cell",
  "owo-colors",
  "proptest",
@@ -9834,6 +9999,7 @@ dependencies = [
  "anyhow",
  "gateway-client",
  "omicron-common 0.1.0",
+ "omicron-workspace-hack",
  "schemars",
  "serde",
  "serde_json",
@@ -9851,6 +10017,7 @@ dependencies = [
  "ciborium",
  "clap 4.4.3",
  "crossterm 0.27.0",
+ "omicron-workspace-hack",
  "ratatui",
  "reedline",
  "serde",
@@ -9901,6 +10068,7 @@ dependencies = [
  "omicron-common 0.1.0",
  "omicron-passwords 0.1.0",
  "omicron-test-utils",
+ "omicron-workspace-hack",
  "openapi-lint",
  "openapiv3",
  "rand 0.8.5",
@@ -9937,6 +10105,7 @@ dependencies = [
  "chrono",
  "installinator-common",
  "ipnetwork",
+ "omicron-workspace-hack",
  "progenitor",
  "regress",
  "reqwest",
diff --git a/Cargo.toml b/Cargo.toml
index 9498157b28..d660397d9e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -64,6 +64,7 @@ members = [
     "wicket",
     "wicketd-client",
     "wicketd",
+    "workspace-hack",
 ]
 
 default-members = [
diff --git a/README.adoc b/README.adoc
index 988c1276fd..93d1fa4fb8 100644
--- a/README.adoc
+++ b/README.adoc
@@ -152,30 +152,17 @@ Many of these components themselves are made up of other packages (e.g., `nexus-
 
 Use Cargo's `-p PACKAGE` to check/build/test only the package you're working on.  Since people are usually only working on one or two components at a time, you can usually iterate faster this way.
 
-=== Why is Cargo rebuilding stuff all the time?
+=== Workspace management
 
-People are often surprised to find Cargo rebuilding stuff that it seems like it's just built, even when the relevant source files haven't changed.
+Omicron uses `cargo-hakari` to ensure that all workspace dependencies enable the same set of features. This dramatically improves compilation time when switching between different subsets of packages (e.g. `-p wicket` or `-p nexus-db-model`), because the sets of enabled features remain consistent.
 
-* Say you're iterating on code, running `cargo build -p nexus-db-model` to build just that package.  Great, it works.  Let's run tests: `cargo nextest run -p nexus-db-model`.  Now it's rebuilding some _dependency_ of `nexus-db-model` again?!
-* Say you've just run `cargo nextest run -p nexus-db-model`.  Now you go run `cargo nextest run -p omicron-nexus`, which uses `nexus-db-model`.  You see Cargo building `nexus-db-model` again?!
+`cargo hakari` status is checked in CI; if the CI check fails, then update the configuration locally with
 
-This usually has to do with the way Cargo selects package https://doc.rust-lang.org/cargo/reference/features.html[features].  These are essentially tags that are used at build time to include specific code or dependencies.  For example, the https://docs.rs/serde/latest/serde/[serde] crate defines a feature called https://docs.rs/crate/serde/latest/features["derive"] that controls whether the `Serialize`/`Deserialize` derive macros will be included.  Let's look at how this affects builds.
-
-TIP: You can use `cargo tree` to inspect a package's dependencies, including features.  This is useful for debugging feature-related build issues.
-
-==== Feature selection differs when building tests
-
-When you run `cargo build -p nexus-db-model`, Cargo looks at all the packages in the depencency tree of `nexus-db-model` and figures out what features it needs for each one.  Let's take the `uuid` package as an example.  Cargo takes https://doc.rust-lang.org/cargo/reference/features.html#feature-unification[union of the features required by any of the packages that depend on `uuid` in the whole dependency tree of `nexus-db-model`].  Let's say that's just the "v4" feature.  Simple enough.
-
-When you then run `cargo nextest run -p nexus-db-model`, it does the same thing.  Only this time, it's looking at the `dev-dependencies` tree.  `nexus-db-model` 's dev-dependencies might include some other package that depends on `uuid` and requires the "v5" feature.  Now, Cargo has to rebuild `uuid` -- and anything else that depends on it.
-
-This is why when using Cargo's check/build/clippy commands, we suggest using `--all-targets`.  When you use `cargo build --all-targets`, it builds the tests as well.  It's usually not much more time and avoids extra rebuilds when switching back and forth between the default targets and the targets with tests included.
-
-==== Feature selection differs when building different packages
-
-People run into a similar problem when switching packages within Omicron.  Once you've got `cargo nextest run -p nexus-db-model` working, you may run `cargo nextest run -p omicron-nexus`, which uses `nexus-db-model`.  And you may be surprised to see Cargo rebuilding some common dependency like `uuid`.  It's the same as above: we're building a different package now.  It has a different (larger) dependency tree.  That may result in some crate deep in the dependency tree needing some new feature, causing it and all of its dependents to be rebuilt.
-
-NOTE: https://github.com/rust-lang/cargo/issues/4463[There is interest in changing the way feature selection works in workspaces like Omicron for exactly this reason.]  It's been suggested to have an option for Cargo to always look at the features required for all packages in the workspace, rather than just the one you've selected.  This could eliminate this particular problem.  In the meantime, we mitigate this with heavy use of https://doc.rust-lang.org/cargo/reference/workspaces.html#the-dependencies-table[workspace dependencies], which helps make sure that different packages _within_ Omicron depend on the same set of features for a given dependency.
+```
+cargo install cargo-hakari --locked # only needed on the first run
+cargo hakari generate
+cargo hakari manage-deps
+```
 
 === Why am I getting compile errors after I thought I'd already built everything?
 
diff --git a/api_identity/Cargo.toml b/api_identity/Cargo.toml
index 761e5e3017..9faf2a1878 100644
--- a/api_identity/Cargo.toml
+++ b/api_identity/Cargo.toml
@@ -14,3 +14,4 @@ proc-macro = true
 proc-macro2.workspace = true
 quote.workspace = true
 syn.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/bootstore/Cargo.toml b/bootstore/Cargo.toml
index d916bf80c7..eefe05c8d6 100644
--- a/bootstore/Cargo.toml
+++ b/bootstore/Cargo.toml
@@ -36,6 +36,7 @@ zeroize.workspace = true
 # utils`. Unfortunately, it doesn't appear possible to put the `pq-sys` dep
 # only in `[dev-dependencies]`.
 pq-sys = "*"
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 assert_matches.workspace = true
diff --git a/bootstrap-agent-client/Cargo.toml b/bootstrap-agent-client/Cargo.toml
index f7d3ad2db6..17989a5c5f 100644
--- a/bootstrap-agent-client/Cargo.toml
+++ b/bootstrap-agent-client/Cargo.toml
@@ -17,3 +17,4 @@ serde.workspace = true
 sled-hardware.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/caboose-util/Cargo.toml b/caboose-util/Cargo.toml
index 195bbfd5d7..253d54643d 100644
--- a/caboose-util/Cargo.toml
+++ b/caboose-util/Cargo.toml
@@ -7,3 +7,4 @@ license = "MPL-2.0"
 [dependencies]
 anyhow.workspace = true
 hubtools.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/certificates/Cargo.toml b/certificates/Cargo.toml
index 29c4a8bc2e..d20d257e4c 100644
--- a/certificates/Cargo.toml
+++ b/certificates/Cargo.toml
@@ -12,6 +12,7 @@ openssl-sys.workspace = true
 thiserror.workspace = true
 
 omicron-common.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 omicron-test-utils.workspace = true
diff --git a/common/Cargo.toml b/common/Cargo.toml
index 492b6ca860..bda88d0d43 100644
--- a/common/Cargo.toml
+++ b/common/Cargo.toml
@@ -40,6 +40,7 @@ toml.workspace = true
 uuid.workspace = true
 parse-display.workspace = true
 progenitor.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 camino-tempfile.workspace = true
diff --git a/crdb-seed/Cargo.toml b/crdb-seed/Cargo.toml
index 01af7cb1d7..fa71fe7e8a 100644
--- a/crdb-seed/Cargo.toml
+++ b/crdb-seed/Cargo.toml
@@ -13,3 +13,4 @@ omicron-test-utils.workspace = true
 ring.workspace = true
 slog.workspace = true
 tokio.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/ddm-admin-client/Cargo.toml b/ddm-admin-client/Cargo.toml
index 6e9ee930a0..3814446b3e 100644
--- a/ddm-admin-client/Cargo.toml
+++ b/ddm-admin-client/Cargo.toml
@@ -15,6 +15,7 @@ tokio.workspace = true
 
 omicron-common.workspace = true
 sled-hardware.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [build-dependencies]
 anyhow.workspace = true
diff --git a/deploy/Cargo.toml b/deploy/Cargo.toml
index 1b8e6a92d8..17bacd6354 100644
--- a/deploy/Cargo.toml
+++ b/deploy/Cargo.toml
@@ -14,6 +14,7 @@ serde.workspace = true
 serde_derive.workspace = true
 thiserror.workspace = true
 toml.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [[bin]]
 name = "thing-flinger"
diff --git a/dev-tools/omdb/Cargo.toml b/dev-tools/omdb/Cargo.toml
index c9ebbe35ad..5b2adde1b2 100644
--- a/dev-tools/omdb/Cargo.toml
+++ b/dev-tools/omdb/Cargo.toml
@@ -32,6 +32,7 @@ tabled.workspace = true
 textwrap.workspace = true
 tokio = { workspace = true, features = [ "full" ] }
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/dev-tools/omicron-dev/Cargo.toml b/dev-tools/omicron-dev/Cargo.toml
index 2061489cbb..95da4d42ef 100644
--- a/dev-tools/omicron-dev/Cargo.toml
+++ b/dev-tools/omicron-dev/Cargo.toml
@@ -28,6 +28,7 @@ signal-hook-tokio.workspace = true
 tokio = { workspace = true, features = [ "full" ] }
 tokio-postgres.workspace = true
 toml.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 camino-tempfile.workspace = true
diff --git a/dev-tools/xtask/src/main.rs b/dev-tools/xtask/src/main.rs
index a64c87a570..3e52d742f5 100644
--- a/dev-tools/xtask/src/main.rs
+++ b/dev-tools/xtask/src/main.rs
@@ -78,6 +78,8 @@ fn cmd_clippy() -> Result<()> {
     Ok(())
 }
 
+const WORKSPACE_HACK_PACKAGE_NAME: &str = "omicron-workspace-hack";
+
 fn cmd_check_workspace_deps() -> Result<()> {
     // Ignore issues with "pq-sys".  See the omicron-rpaths package for details.
     const EXCLUDED: &[&'static str] = &["pq-sys"];
@@ -97,6 +99,12 @@ fn cmd_check_workspace_deps() -> Result<()> {
 
     // Iterate the workspace packages and fill out the maps above.
     for pkg_info in workspace.workspace_packages() {
+        if pkg_info.name == WORKSPACE_HACK_PACKAGE_NAME {
+            // Skip over workspace-hack because hakari doesn't yet support
+            // workspace deps: https://github.com/guppy-rs/guppy/issues/7
+            continue;
+        }
+
         let manifest_path = &pkg_info.manifest_path;
         let manifest = read_cargo_toml(manifest_path)?;
         for tree in [
@@ -125,6 +133,12 @@ fn cmd_check_workspace_deps() -> Result<()> {
                     }
                 }
 
+                if name == WORKSPACE_HACK_PACKAGE_NAME {
+                    // Skip over workspace-hack because hakari doesn't yet support
+                    // workspace deps: https://github.com/guppy-rs/guppy/issues/7
+                    continue;
+                }
+
                 non_workspace_dependencies
                     .entry(name.to_owned())
                     .or_insert_with(Vec::new)
diff --git a/dns-server/Cargo.toml b/dns-server/Cargo.toml
index 243876a5a2..d7606dcff5 100644
--- a/dns-server/Cargo.toml
+++ b/dns-server/Cargo.toml
@@ -30,6 +30,7 @@ trust-dns-proto.workspace = true
 trust-dns-resolver.workspace = true
 trust-dns-server.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/dns-service-client/Cargo.toml b/dns-service-client/Cargo.toml
index 7f5cf63d6a..e351d90da2 100644
--- a/dns-service-client/Cargo.toml
+++ b/dns-service-client/Cargo.toml
@@ -14,3 +14,4 @@ serde.workspace = true
 serde_json.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/dpd-client/Cargo.toml b/dpd-client/Cargo.toml
index fdbdcd07af..26807f7d79 100644
--- a/dpd-client/Cargo.toml
+++ b/dpd-client/Cargo.toml
@@ -17,6 +17,7 @@ ipnetwork.workspace = true
 http.workspace = true
 schemars.workspace = true
 rand.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [build-dependencies]
 anyhow.workspace = true
diff --git a/end-to-end-tests/Cargo.toml b/end-to-end-tests/Cargo.toml
index a0e099b756..5ff0f9b377 100644
--- a/end-to-end-tests/Cargo.toml
+++ b/end-to-end-tests/Cargo.toml
@@ -24,3 +24,4 @@ tokio = { workspace = true, features = ["macros", "rt-multi-thread"] }
 toml.workspace = true
 trust-dns-resolver.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/gateway-cli/Cargo.toml b/gateway-cli/Cargo.toml
index d5083d1999..0d179750ea 100644
--- a/gateway-cli/Cargo.toml
+++ b/gateway-cli/Cargo.toml
@@ -24,3 +24,4 @@ uuid.workspace = true
 
 gateway-client.workspace = true
 gateway-messages.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/gateway-client/Cargo.toml b/gateway-client/Cargo.toml
index 81d1630a1d..96a1eb221f 100644
--- a/gateway-client/Cargo.toml
+++ b/gateway-client/Cargo.toml
@@ -15,3 +15,4 @@ serde_json.workspace = true
 schemars.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/gateway-test-utils/Cargo.toml b/gateway-test-utils/Cargo.toml
index 8f6e14d68a..9d80e63f05 100644
--- a/gateway-test-utils/Cargo.toml
+++ b/gateway-test-utils/Cargo.toml
@@ -14,3 +14,4 @@ slog.workspace = true
 sp-sim.workspace = true
 tokio.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/gateway/Cargo.toml b/gateway/Cargo.toml
index 307baa3f27..f5abce88e9 100644
--- a/gateway/Cargo.toml
+++ b/gateway/Cargo.toml
@@ -34,6 +34,7 @@ tokio-tungstenite.workspace = true
 tokio-util.workspace = true
 toml.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/illumos-utils/Cargo.toml b/illumos-utils/Cargo.toml
index 3c0c2e7fc9..e292097bc5 100644
--- a/illumos-utils/Cargo.toml
+++ b/illumos-utils/Cargo.toml
@@ -29,6 +29,7 @@ zone.workspace = true
 
 # only enabled via the `testing` feature
 mockall = { workspace = true, optional = true }
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [target.'cfg(target_os = "illumos")'.dependencies]
 opte-ioctl.workspace = true
diff --git a/installinator-artifact-client/Cargo.toml b/installinator-artifact-client/Cargo.toml
index ddbc106ee8..18447b8e83 100644
--- a/installinator-artifact-client/Cargo.toml
+++ b/installinator-artifact-client/Cargo.toml
@@ -15,3 +15,4 @@ serde_json.workspace = true
 slog.workspace = true
 update-engine.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/installinator-artifactd/Cargo.toml b/installinator-artifactd/Cargo.toml
index 3ce6112165..9318b725db 100644
--- a/installinator-artifactd/Cargo.toml
+++ b/installinator-artifactd/Cargo.toml
@@ -20,6 +20,7 @@ uuid.workspace = true
 
 installinator-common.workspace = true
 omicron-common.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/installinator-common/Cargo.toml b/installinator-common/Cargo.toml
index ff664f28a3..0f1bf86901 100644
--- a/installinator-common/Cargo.toml
+++ b/installinator-common/Cargo.toml
@@ -15,3 +15,4 @@ serde_json.workspace = true
 serde_with.workspace = true
 thiserror.workspace = true
 update-engine.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/installinator/Cargo.toml b/installinator/Cargo.toml
index c0e7625e6e..3b2f04c38f 100644
--- a/installinator/Cargo.toml
+++ b/installinator/Cargo.toml
@@ -42,6 +42,7 @@ toml.workspace = true
 tufaceous-lib.workspace = true
 update-engine.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 omicron-test-utils.workspace = true
diff --git a/internal-dns-cli/Cargo.toml b/internal-dns-cli/Cargo.toml
index d922544722..fb5780d22a 100644
--- a/internal-dns-cli/Cargo.toml
+++ b/internal-dns-cli/Cargo.toml
@@ -13,3 +13,4 @@ omicron-common.workspace = true
 slog.workspace = true
 tokio.workspace = true
 trust-dns-resolver.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/internal-dns/Cargo.toml b/internal-dns/Cargo.toml
index 5ead1cc8a4..d680ab3ce1 100644
--- a/internal-dns/Cargo.toml
+++ b/internal-dns/Cargo.toml
@@ -17,6 +17,7 @@ thiserror.workspace = true
 trust-dns-proto.workspace = true
 trust-dns-resolver.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 assert_matches.workspace = true
diff --git a/ipcc-key-value/Cargo.toml b/ipcc-key-value/Cargo.toml
index a3f17cea52..128fde9a01 100644
--- a/ipcc-key-value/Cargo.toml
+++ b/ipcc-key-value/Cargo.toml
@@ -11,6 +11,7 @@ omicron-common.workspace = true
 serde.workspace = true
 thiserror.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 omicron-common = { workspace = true, features = ["testing"] }
diff --git a/key-manager/Cargo.toml b/key-manager/Cargo.toml
index 7954a977a3..69ae3b25bd 100644
--- a/key-manager/Cargo.toml
+++ b/key-manager/Cargo.toml
@@ -14,4 +14,5 @@ slog.workspace = true
 thiserror.workspace = true
 tokio.workspace = true
 zeroize.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
diff --git a/nexus-client/Cargo.toml b/nexus-client/Cargo.toml
index 589562c930..d59c013992 100644
--- a/nexus-client/Cargo.toml
+++ b/nexus-client/Cargo.toml
@@ -18,3 +18,4 @@ serde.workspace = true
 serde_json.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/nexus/Cargo.toml b/nexus/Cargo.toml
index 1a09f07f6c..91872e2c32 100644
--- a/nexus/Cargo.toml
+++ b/nexus/Cargo.toml
@@ -90,6 +90,7 @@ oximeter.workspace = true
 oximeter-instruments = { workspace = true, features = ["http-instruments"] }
 oximeter-producer.workspace = true
 rustls = { workspace = true }
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 async-bb8-diesel.workspace = true
diff --git a/nexus/authz-macros/Cargo.toml b/nexus/authz-macros/Cargo.toml
index 40303b2e34..3d55afa477 100644
--- a/nexus/authz-macros/Cargo.toml
+++ b/nexus/authz-macros/Cargo.toml
@@ -14,3 +14,4 @@ quote.workspace = true
 serde.workspace = true
 serde_tokenstream.workspace = true
 syn.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/nexus/db-macros/Cargo.toml b/nexus/db-macros/Cargo.toml
index 3fb228f26c..ce206bb56e 100644
--- a/nexus/db-macros/Cargo.toml
+++ b/nexus/db-macros/Cargo.toml
@@ -15,6 +15,7 @@ quote.workspace = true
 serde.workspace = true
 serde_tokenstream.workspace = true
 syn = { workspace = true, features = ["extra-traits"] }
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 rustfmt-wrapper.workspace = true
diff --git a/nexus/db-model/Cargo.toml b/nexus/db-model/Cargo.toml
index dc83670725..aedbb9168b 100644
--- a/nexus/db-model/Cargo.toml
+++ b/nexus/db-model/Cargo.toml
@@ -36,6 +36,7 @@ nexus-defaults.workspace = true
 nexus-types.workspace = true
 omicron-passwords.workspace = true
 sled-agent-client.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/nexus/db-queries/Cargo.toml b/nexus/db-queries/Cargo.toml
index a8256cb60a..af01c1732b 100644
--- a/nexus/db-queries/Cargo.toml
+++ b/nexus/db-queries/Cargo.toml
@@ -63,6 +63,7 @@ nexus-types.workspace = true
 omicron-common.workspace = true
 omicron-passwords.workspace = true
 oximeter.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 assert_matches.workspace = true
diff --git a/nexus/defaults/Cargo.toml b/nexus/defaults/Cargo.toml
index 910ae2afd6..09a95fa839 100644
--- a/nexus/defaults/Cargo.toml
+++ b/nexus/defaults/Cargo.toml
@@ -11,3 +11,4 @@ rand.workspace = true
 serde_json.workspace = true
 
 omicron-common.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/nexus/test-interface/Cargo.toml b/nexus/test-interface/Cargo.toml
index 44c894411b..e0743e84bc 100644
--- a/nexus/test-interface/Cargo.toml
+++ b/nexus/test-interface/Cargo.toml
@@ -12,3 +12,4 @@ nexus-types.workspace = true
 omicron-common.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/nexus/test-utils-macros/Cargo.toml b/nexus/test-utils-macros/Cargo.toml
index 4f9d3eca32..1bfa25017a 100644
--- a/nexus/test-utils-macros/Cargo.toml
+++ b/nexus/test-utils-macros/Cargo.toml
@@ -11,3 +11,4 @@ proc-macro = true
 proc-macro2.workspace = true
 quote.workspace = true
 syn = { workspace = true, features = [ "fold", "parsing" ] }
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/nexus/test-utils/Cargo.toml b/nexus/test-utils/Cargo.toml
index bad225516a..a2e7600e93 100644
--- a/nexus/test-utils/Cargo.toml
+++ b/nexus/test-utils/Cargo.toml
@@ -38,3 +38,4 @@ tempfile.workspace = true
 trust-dns-proto.workspace = true
 trust-dns-resolver.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/nexus/types/Cargo.toml b/nexus/types/Cargo.toml
index c0f175cf31..f7ffafec52 100644
--- a/nexus/types/Cargo.toml
+++ b/nexus/types/Cargo.toml
@@ -25,3 +25,4 @@ api_identity.workspace = true
 dns-service-client.workspace = true
 omicron-common.workspace = true
 omicron-passwords.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/oxide-client/Cargo.toml b/oxide-client/Cargo.toml
index 0602066e6d..df34ab9721 100644
--- a/oxide-client/Cargo.toml
+++ b/oxide-client/Cargo.toml
@@ -21,3 +21,4 @@ thiserror.workspace = true
 tokio = { workspace = true, features = [ "net" ] }
 trust-dns-resolver.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/oximeter-client/Cargo.toml b/oximeter-client/Cargo.toml
index e4e68464d7..297dfb6c92 100644
--- a/oximeter-client/Cargo.toml
+++ b/oximeter-client/Cargo.toml
@@ -12,3 +12,4 @@ reqwest = { workspace = true, features = ["json", "rustls-tls", "stream"] }
 serde.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/oximeter/collector/Cargo.toml b/oximeter/collector/Cargo.toml
index 1137651aa0..c8c4030dba 100644
--- a/oximeter/collector/Cargo.toml
+++ b/oximeter/collector/Cargo.toml
@@ -22,6 +22,7 @@ thiserror.workspace = true
 tokio.workspace = true
 toml.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/oximeter/db/Cargo.toml b/oximeter/db/Cargo.toml
index 9ff4ac5c06..77bce09db9 100644
--- a/oximeter/db/Cargo.toml
+++ b/oximeter/db/Cargo.toml
@@ -25,6 +25,7 @@ thiserror.workspace = true
 tokio = { workspace = true, features = [ "rt-multi-thread", "macros" ] }
 usdt.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 itertools.workspace = true
diff --git a/oximeter/instruments/Cargo.toml b/oximeter/instruments/Cargo.toml
index 98f8f3b5b2..4adff0463a 100644
--- a/oximeter/instruments/Cargo.toml
+++ b/oximeter/instruments/Cargo.toml
@@ -12,6 +12,7 @@ oximeter.workspace = true
 tokio.workspace = true
 http = { workspace = true, optional = true }
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [features]
 default = ["http-instruments"]
diff --git a/oximeter/oximeter-macro-impl/Cargo.toml b/oximeter/oximeter-macro-impl/Cargo.toml
index c38d85ed2d..ff116e1c9d 100644
--- a/oximeter/oximeter-macro-impl/Cargo.toml
+++ b/oximeter/oximeter-macro-impl/Cargo.toml
@@ -12,3 +12,4 @@ proc-macro = true
 proc-macro2.workspace = true
 quote.workspace = true
 syn = { workspace = true, features = [ "full", "extra-traits" ] }
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/oximeter/oximeter/Cargo.toml b/oximeter/oximeter/Cargo.toml
index f0549548a6..b2aa15f85e 100644
--- a/oximeter/oximeter/Cargo.toml
+++ b/oximeter/oximeter/Cargo.toml
@@ -15,6 +15,7 @@ schemars = { workspace = true, features = [ "uuid1", "bytes", "chrono" ] }
 serde.workspace = true
 thiserror.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
 
 [dev-dependencies]
 approx.workspace = true
diff --git a/oximeter/producer/Cargo.toml b/oximeter/producer/Cargo.toml
index e511294e52..f171f57e8a 100644
--- a/oximeter/producer/Cargo.toml
+++ b/oximeter/producer/Cargo.toml
@@ -19,3 +19,4 @@ slog-dtrace.workspace = true
 tokio.workspace = true
 thiserror.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../../workspace-hack" }
diff --git a/package/Cargo.toml b/package/Cargo.toml
index 7c786b77ef..9fc4610020 100644
--- a/package/Cargo.toml
+++ b/package/Cargo.toml
@@ -34,6 +34,7 @@ tokio = { workspace = true, features = [ "full" ] }
 toml.workspace = true
 topological-sort.workspace = true
 walkdir.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/passwords/Cargo.toml b/passwords/Cargo.toml
index 1731716101..cbd569ef4c 100644
--- a/passwords/Cargo.toml
+++ b/passwords/Cargo.toml
@@ -11,6 +11,7 @@ thiserror.workspace = true
 schemars.workspace = true
 serde.workspace = true
 serde_with.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 argon2alt = { package = "rust-argon2", version = "1.0" }
diff --git a/rpaths/Cargo.toml b/rpaths/Cargo.toml
index 829b4ffe28..7671be4968 100644
--- a/rpaths/Cargo.toml
+++ b/rpaths/Cargo.toml
@@ -5,3 +5,4 @@ edition = "2021"
 license = "MPL-2.0"
 
 [dependencies]
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
index 77379db470..eacfef491b 100644
--- a/rust-toolchain.toml
+++ b/rust-toolchain.toml
@@ -4,5 +4,5 @@
 #
 # We choose a specific toolchain (rather than "stable") for repeatability.  The
 # intent is to keep this up-to-date with recently-released stable Rust.
-channel = "1.72.0"
+channel = "1.72.1"
 profile = "default"
diff --git a/sled-agent-client/Cargo.toml b/sled-agent-client/Cargo.toml
index f6c58fbf2b..01c1032a51 100644
--- a/sled-agent-client/Cargo.toml
+++ b/sled-agent-client/Cargo.toml
@@ -15,3 +15,4 @@ reqwest = { workspace = true, features = [ "json", "rustls-tls", "stream" ] }
 serde.workspace = true
 slog.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/sled-agent/Cargo.toml b/sled-agent/Cargo.toml
index f172136726..b131698395 100644
--- a/sled-agent/Cargo.toml
+++ b/sled-agent/Cargo.toml
@@ -76,6 +76,7 @@ uuid.workspace = true
 zeroize.workspace = true
 zone.workspace = true
 static_assertions.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [target.'cfg(target_os = "illumos")'.dependencies]
 opte-ioctl.workspace = true
diff --git a/sled-hardware/Cargo.toml b/sled-hardware/Cargo.toml
index c6bc09f41e..880f93441c 100644
--- a/sled-hardware/Cargo.toml
+++ b/sled-hardware/Cargo.toml
@@ -24,6 +24,7 @@ thiserror.workspace = true
 tofino.workspace = true
 tokio.workspace = true
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [target.'cfg(target_os = "illumos")'.dependencies]
 illumos-devinfo = { git = "https://github.com/oxidecomputer/illumos-devinfo", branch = "main" }
diff --git a/sp-sim/Cargo.toml b/sp-sim/Cargo.toml
index 5a73f46d9e..2a1ae19468 100644
--- a/sp-sim/Cargo.toml
+++ b/sp-sim/Cargo.toml
@@ -21,6 +21,7 @@ sprockets-rot.workspace = true
 thiserror.workspace = true
 tokio = { workspace = true, features = [ "full" ] }
 toml.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [[bin]]
 name = "sp-sim"
diff --git a/test-utils/Cargo.toml b/test-utils/Cargo.toml
index 09ff12a806..a0227a4de2 100644
--- a/test-utils/Cargo.toml
+++ b/test-utils/Cargo.toml
@@ -25,6 +25,7 @@ usdt.workspace = true
 rcgen.workspace = true
 regex.workspace = true
 reqwest.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 expectorate.workspace = true
diff --git a/tufaceous-lib/Cargo.toml b/tufaceous-lib/Cargo.toml
index e4799a69a4..8b5c4fa7ca 100644
--- a/tufaceous-lib/Cargo.toml
+++ b/tufaceous-lib/Cargo.toml
@@ -32,6 +32,7 @@ toml.workspace = true
 tough.workspace = true
 url = "2.4.1"
 zip.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 omicron-test-utils.workspace = true
diff --git a/tufaceous/Cargo.toml b/tufaceous/Cargo.toml
index 09772daef4..f3e3b815d2 100644
--- a/tufaceous/Cargo.toml
+++ b/tufaceous/Cargo.toml
@@ -18,6 +18,7 @@ slog-async.workspace = true
 slog-envlogger.workspace = true
 slog-term.workspace = true
 tufaceous-lib.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 assert_cmd.workspace = true
diff --git a/update-engine/Cargo.toml b/update-engine/Cargo.toml
index 4c2841cf0f..25ade83f34 100644
--- a/update-engine/Cargo.toml
+++ b/update-engine/Cargo.toml
@@ -21,6 +21,7 @@ schemars = { workspace = true, features = ["uuid1"] }
 slog.workspace = true
 tokio = { workspace = true, features = ["macros", "sync", "time", "rt-multi-thread"] }
 uuid.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 buf-list.workspace = true
diff --git a/wicket-common/Cargo.toml b/wicket-common/Cargo.toml
index 735f4a758e..229561cd38 100644
--- a/wicket-common/Cargo.toml
+++ b/wicket-common/Cargo.toml
@@ -13,3 +13,4 @@ serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 update-engine.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/wicket-dbg/Cargo.toml b/wicket-dbg/Cargo.toml
index 1aa8e10171..bc22424c69 100644
--- a/wicket-dbg/Cargo.toml
+++ b/wicket-dbg/Cargo.toml
@@ -22,6 +22,7 @@ wicket.workspace = true
 
 # used only by wicket-dbg binary
 reedline = "0.23.0"
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [[bin]]
 name = "wicket-dbg"
diff --git a/wicket/Cargo.toml b/wicket/Cargo.toml
index d2004e0a68..58605c8037 100644
--- a/wicket/Cargo.toml
+++ b/wicket/Cargo.toml
@@ -46,6 +46,7 @@ omicron-passwords.workspace = true
 update-engine.workspace = true
 wicket-common.workspace = true
 wicketd-client.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [dev-dependencies]
 assert_cmd.workspace = true
diff --git a/wicketd-client/Cargo.toml b/wicketd-client/Cargo.toml
index 69a7f8fae4..2d959f1f8d 100644
--- a/wicketd-client/Cargo.toml
+++ b/wicketd-client/Cargo.toml
@@ -18,3 +18,4 @@ slog.workspace = true
 update-engine.workspace = true
 uuid.workspace = true
 wicket-common.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
diff --git a/wicketd/Cargo.toml b/wicketd/Cargo.toml
index 4894e370ba..6df5e0e4e5 100644
--- a/wicketd/Cargo.toml
+++ b/wicketd/Cargo.toml
@@ -54,6 +54,7 @@ sled-hardware.workspace = true
 tufaceous-lib.workspace = true
 update-engine.workspace = true
 wicket-common.workspace = true
+omicron-workspace-hack = { version = "0.1", path = "../workspace-hack" }
 
 [[bin]]
 name = "wicketd"
diff --git a/wicketd/src/http_entrypoints.rs b/wicketd/src/http_entrypoints.rs
index db21d72777..72c3341334 100644
--- a/wicketd/src/http_entrypoints.rs
+++ b/wicketd/src/http_entrypoints.rs
@@ -869,7 +869,7 @@ async fn post_start_update(
         ));
     }
 
-    // Can we update the target SPs? We refuse to update if:
+    // Can we update the target SPs? We refuse to update if, for any target SP:
     //
     // 1. We haven't pulled its state in our inventory (most likely cause: the
     //    cubby is empty; less likely cause: the SP is misbehaving, which will
diff --git a/wicketd/src/update_tracker.rs b/wicketd/src/update_tracker.rs
index 6e36a935f5..1bbda00158 100644
--- a/wicketd/src/update_tracker.rs
+++ b/wicketd/src/update_tracker.rs
@@ -219,11 +219,6 @@ impl UpdateTracker {
 
         let mut errors = Vec::new();
 
-        let plan = update_data.artifact_store.current_plan();
-        if plan.is_none() {
-            errors.push(StartUpdateError::TufRepositoryUnavailable);
-        }
-
         // Check that we're not already updating any of these SPs.
         let update_in_progress: Vec<_> = sps
             .iter()
@@ -244,12 +239,19 @@ impl UpdateTracker {
             errors.push(StartUpdateError::UpdateInProgress(update_in_progress));
         }
 
+        let plan = update_data.artifact_store.current_plan();
+        if plan.is_none() {
+            // (1), referred to below.
+            errors.push(StartUpdateError::TufRepositoryUnavailable);
+        }
+
         // If there are any errors, return now.
         if !errors.is_empty() {
             return Err(errors);
         }
 
-        let plan = plan.expect("we'd have returned an error if plan was None");
+        let plan =
+            plan.expect("we'd have returned an error at (1) if plan was None");
 
         // Call the setup method now.
         if let Some(mut spawn_update_driver) = spawn_update_driver {
diff --git a/workspace-hack/.gitattributes b/workspace-hack/.gitattributes
new file mode 100644
index 0000000000..3e9dba4b64
--- /dev/null
+++ b/workspace-hack/.gitattributes
@@ -0,0 +1,4 @@
+# Avoid putting conflict markers in the generated Cargo.toml file, since their presence breaks
+# Cargo.
+# Also do not check out the file as CRLF on Windows, as that's what hakari needs.
+Cargo.toml merge=binary -crlf
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
new file mode 100644
index 0000000000..d3e00b1831
--- /dev/null
+++ b/workspace-hack/Cargo.toml
@@ -0,0 +1,261 @@
+# This file is generated by `cargo hakari`.
+# To regenerate, run:
+#     cargo hakari generate
+
+[package]
+name = "omicron-workspace-hack"
+version = "0.1.0"
+description = "workspace-hack package, managed by hakari"
+# You can choose to publish this crate: see https://docs.rs/cargo-hakari/latest/cargo_hakari/publishing.
+publish = false
+
+# The parts of the file between the BEGIN HAKARI SECTION and END HAKARI SECTION comments
+# are managed by hakari.
+
+### BEGIN HAKARI SECTION
+[dependencies]
+anyhow = { version = "1", features = ["backtrace"] }
+bit-set = { version = "0.5" }
+bit-vec = { version = "0.6" }
+bitflags-dff4ba8e3ae991db = { package = "bitflags", version = "1" }
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["serde"] }
+bitvec = { version = "1" }
+bstr-6f8ce4dd05d13bba = { package = "bstr", version = "0.2" }
+bstr-dff4ba8e3ae991db = { package = "bstr", version = "1" }
+bytes = { version = "1", features = ["serde"] }
+chrono = { version = "0.4", features = ["alloc", "serde"] }
+cipher = { version = "0.4", default-features = false, features = ["block-padding", "zeroize"] }
+clap = { version = "4", features = ["derive", "env", "wrap_help"] }
+clap_builder = { version = "4", default-features = false, features = ["color", "env", "std", "suggestions", "usage", "wrap_help"] }
+console = { version = "0.15" }
+const-oid = { version = "0.9", default-features = false, features = ["db", "std"] }
+crossbeam-epoch = { version = "0.9" }
+crossbeam-utils = { version = "0.8" }
+crypto-common = { version = "0.1", default-features = false, features = ["getrandom", "std"] }
+diesel = { version = "2", features = ["chrono", "i-implement-a-third-party-backend-and-opt-into-breaking-changes", "network-address", "postgres", "r2d2", "serde_json", "uuid"] }
+digest = { version = "0.10", features = ["mac", "oid", "std"] }
+either = { version = "1" }
+flate2 = { version = "1" }
+futures = { version = "0.3" }
+futures-channel = { version = "0.3", features = ["sink"] }
+futures-core = { version = "0.3" }
+futures-io = { version = "0.3", default-features = false, features = ["std"] }
+futures-sink = { version = "0.3" }
+futures-task = { version = "0.3", default-features = false, features = ["std"] }
+futures-util = { version = "0.3", features = ["channel", "io", "sink"] }
+gateway-messages = { git = "https://github.com/oxidecomputer/management-gateway-service", rev = "1e180ae55e56bd17af35cb868ffbd18ce487351d", features = ["std"] }
+generic-array = { version = "0.14", default-features = false, features = ["more_lengths", "zeroize"] }
+getrandom = { version = "0.2", default-features = false, features = ["js", "rdrand", "std"] }
+hashbrown-582f2526e08bb6a0 = { package = "hashbrown", version = "0.14", features = ["raw"] }
+hashbrown-594e8ee84c453af0 = { package = "hashbrown", version = "0.13" }
+hex = { version = "0.4", features = ["serde"] }
+hyper = { version = "0.14", features = ["full"] }
+indexmap = { version = "2", features = ["serde"] }
+inout = { version = "0.1", default-features = false, features = ["std"] }
+ipnetwork = { version = "0.20", features = ["schemars"] }
+itertools = { version = "0.10" }
+lalrpop-util = { version = "0.19" }
+lazy_static = { version = "1", default-features = false, features = ["spin_no_std"] }
+libc = { version = "0.2", features = ["extra_traits"] }
+log = { version = "0.4", default-features = false, features = ["std"] }
+managed = { version = "0.8", default-features = false, features = ["alloc", "map"] }
+memchr = { version = "2" }
+num-bigint = { version = "0.4", features = ["rand"] }
+num-integer = { version = "0.1", features = ["i128"] }
+num-iter = { version = "0.1", default-features = false, features = ["i128"] }
+num-traits = { version = "0.2", features = ["i128", "libm"] }
+openapiv3 = { version = "1", default-features = false, features = ["skip_serializing_defaults"] }
+petgraph = { version = "0.6", features = ["serde-1"] }
+postgres-types = { version = "0.2", default-features = false, features = ["with-chrono-0_4", "with-serde_json-1", "with-uuid-1"] }
+ppv-lite86 = { version = "0.2", default-features = false, features = ["simd", "std"] }
+predicates = { version = "3" }
+rand = { version = "0.8", features = ["min_const_gen"] }
+rand_chacha = { version = "0.3" }
+regex = { version = "1" }
+regex-automata = { version = "0.3", default-features = false, features = ["dfa-onepass", "dfa-search", "hybrid", "meta", "nfa-backtrack", "perf-inline", "perf-literal", "unicode"] }
+regex-syntax = { version = "0.7" }
+reqwest = { version = "0.11", features = ["blocking", "json", "rustls-tls", "stream"] }
+ring = { version = "0.16", features = ["std"] }
+schemars = { version = "0.8", features = ["bytes", "chrono", "uuid1"] }
+semver = { version = "1", features = ["serde"] }
+serde = { version = "1", features = ["alloc", "derive", "rc"] }
+sha2 = { version = "0.10", features = ["oid"] }
+signature = { version = "2", default-features = false, features = ["digest", "rand_core", "std"] }
+similar = { version = "2", features = ["inline", "unicode"] }
+slog = { version = "2", features = ["dynamic-keys", "max_level_trace", "release_max_level_debug", "release_max_level_trace"] }
+spin = { version = "0.9" }
+string_cache = { version = "0.8" }
+subtle = { version = "2" }
+syn-dff4ba8e3ae991db = { package = "syn", version = "1", features = ["extra-traits", "fold", "full", "visit"] }
+syn-f595c2ba2a3f28df = { package = "syn", version = "2", features = ["extra-traits", "fold", "full", "visit", "visit-mut"] }
+textwrap = { version = "0.16" }
+time = { version = "0.3", features = ["formatting", "local-offset", "macros", "parsing"] }
+tokio = { version = "1", features = ["full", "test-util"] }
+tokio-postgres = { version = "0.7", features = ["with-chrono-0_4", "with-serde_json-1", "with-uuid-1"] }
+tokio-stream = { version = "0.1", features = ["net"] }
+toml = { version = "0.7" }
+toml_datetime = { version = "0.6", default-features = false, features = ["serde"] }
+toml_edit = { version = "0.19", features = ["serde"] }
+tracing = { version = "0.1", features = ["log"] }
+trust-dns-proto = { version = "0.22" }
+unicode-bidi = { version = "0.3" }
+unicode-normalization = { version = "0.1" }
+usdt = { version = "0.3" }
+uuid = { version = "1", features = ["serde", "v4"] }
+yasna = { version = "0.5", features = ["bit-vec", "num-bigint", "std", "time"] }
+zeroize = { version = "1", features = ["std", "zeroize_derive"] }
+zip = { version = "0.6", default-features = false, features = ["bzip2", "deflate"] }
+
+[build-dependencies]
+anyhow = { version = "1", features = ["backtrace"] }
+bit-set = { version = "0.5" }
+bit-vec = { version = "0.6" }
+bitflags-dff4ba8e3ae991db = { package = "bitflags", version = "1" }
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["serde"] }
+bitvec = { version = "1" }
+bstr-6f8ce4dd05d13bba = { package = "bstr", version = "0.2" }
+bstr-dff4ba8e3ae991db = { package = "bstr", version = "1" }
+bytes = { version = "1", features = ["serde"] }
+cc = { version = "1", default-features = false, features = ["parallel"] }
+chrono = { version = "0.4", features = ["alloc", "serde"] }
+cipher = { version = "0.4", default-features = false, features = ["block-padding", "zeroize"] }
+clap = { version = "4", features = ["derive", "env", "wrap_help"] }
+clap_builder = { version = "4", default-features = false, features = ["color", "env", "std", "suggestions", "usage", "wrap_help"] }
+console = { version = "0.15" }
+const-oid = { version = "0.9", default-features = false, features = ["db", "std"] }
+crossbeam-epoch = { version = "0.9" }
+crossbeam-utils = { version = "0.8" }
+crypto-common = { version = "0.1", default-features = false, features = ["getrandom", "std"] }
+diesel = { version = "2", features = ["chrono", "i-implement-a-third-party-backend-and-opt-into-breaking-changes", "network-address", "postgres", "r2d2", "serde_json", "uuid"] }
+digest = { version = "0.10", features = ["mac", "oid", "std"] }
+either = { version = "1" }
+flate2 = { version = "1" }
+futures = { version = "0.3" }
+futures-channel = { version = "0.3", features = ["sink"] }
+futures-core = { version = "0.3" }
+futures-io = { version = "0.3", default-features = false, features = ["std"] }
+futures-sink = { version = "0.3" }
+futures-task = { version = "0.3", default-features = false, features = ["std"] }
+futures-util = { version = "0.3", features = ["channel", "io", "sink"] }
+gateway-messages = { git = "https://github.com/oxidecomputer/management-gateway-service", rev = "1e180ae55e56bd17af35cb868ffbd18ce487351d", features = ["std"] }
+generic-array = { version = "0.14", default-features = false, features = ["more_lengths", "zeroize"] }
+getrandom = { version = "0.2", default-features = false, features = ["js", "rdrand", "std"] }
+hashbrown-582f2526e08bb6a0 = { package = "hashbrown", version = "0.14", features = ["raw"] }
+hashbrown-594e8ee84c453af0 = { package = "hashbrown", version = "0.13" }
+hex = { version = "0.4", features = ["serde"] }
+hyper = { version = "0.14", features = ["full"] }
+indexmap = { version = "2", features = ["serde"] }
+inout = { version = "0.1", default-features = false, features = ["std"] }
+ipnetwork = { version = "0.20", features = ["schemars"] }
+itertools = { version = "0.10" }
+lalrpop-util = { version = "0.19" }
+lazy_static = { version = "1", default-features = false, features = ["spin_no_std"] }
+libc = { version = "0.2", features = ["extra_traits"] }
+log = { version = "0.4", default-features = false, features = ["std"] }
+managed = { version = "0.8", default-features = false, features = ["alloc", "map"] }
+memchr = { version = "2" }
+num-bigint = { version = "0.4", features = ["rand"] }
+num-integer = { version = "0.1", features = ["i128"] }
+num-iter = { version = "0.1", default-features = false, features = ["i128"] }
+num-traits = { version = "0.2", features = ["i128", "libm"] }
+openapiv3 = { version = "1", default-features = false, features = ["skip_serializing_defaults"] }
+petgraph = { version = "0.6", features = ["serde-1"] }
+postgres-types = { version = "0.2", default-features = false, features = ["with-chrono-0_4", "with-serde_json-1", "with-uuid-1"] }
+ppv-lite86 = { version = "0.2", default-features = false, features = ["simd", "std"] }
+predicates = { version = "3" }
+rand = { version = "0.8", features = ["min_const_gen"] }
+rand_chacha = { version = "0.3" }
+regex = { version = "1" }
+regex-automata = { version = "0.3", default-features = false, features = ["dfa-onepass", "dfa-search", "hybrid", "meta", "nfa-backtrack", "perf-inline", "perf-literal", "unicode"] }
+regex-syntax = { version = "0.7" }
+reqwest = { version = "0.11", features = ["blocking", "json", "rustls-tls", "stream"] }
+ring = { version = "0.16", features = ["std"] }
+schemars = { version = "0.8", features = ["bytes", "chrono", "uuid1"] }
+semver = { version = "1", features = ["serde"] }
+serde = { version = "1", features = ["alloc", "derive", "rc"] }
+sha2 = { version = "0.10", features = ["oid"] }
+signature = { version = "2", default-features = false, features = ["digest", "rand_core", "std"] }
+similar = { version = "2", features = ["inline", "unicode"] }
+slog = { version = "2", features = ["dynamic-keys", "max_level_trace", "release_max_level_debug", "release_max_level_trace"] }
+spin = { version = "0.9" }
+string_cache = { version = "0.8" }
+subtle = { version = "2" }
+syn-dff4ba8e3ae991db = { package = "syn", version = "1", features = ["extra-traits", "fold", "full", "visit"] }
+syn-f595c2ba2a3f28df = { package = "syn", version = "2", features = ["extra-traits", "fold", "full", "visit", "visit-mut"] }
+textwrap = { version = "0.16" }
+time = { version = "0.3", features = ["formatting", "local-offset", "macros", "parsing"] }
+time-macros = { version = "0.2", default-features = false, features = ["formatting", "parsing"] }
+tokio = { version = "1", features = ["full", "test-util"] }
+tokio-postgres = { version = "0.7", features = ["with-chrono-0_4", "with-serde_json-1", "with-uuid-1"] }
+tokio-stream = { version = "0.1", features = ["net"] }
+toml = { version = "0.7" }
+toml_datetime = { version = "0.6", default-features = false, features = ["serde"] }
+toml_edit = { version = "0.19", features = ["serde"] }
+tracing = { version = "0.1", features = ["log"] }
+trust-dns-proto = { version = "0.22" }
+unicode-bidi = { version = "0.3" }
+unicode-normalization = { version = "0.1" }
+unicode-xid = { version = "0.2" }
+usdt = { version = "0.3" }
+uuid = { version = "1", features = ["serde", "v4"] }
+yasna = { version = "0.5", features = ["bit-vec", "num-bigint", "std", "time"] }
+zeroize = { version = "1", features = ["std", "zeroize_derive"] }
+zip = { version = "0.6", default-features = false, features = ["bzip2", "deflate"] }
+
+[target.x86_64-unknown-linux-gnu.dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.x86_64-unknown-linux-gnu.build-dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.x86_64-apple-darwin.dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.x86_64-apple-darwin.build-dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.aarch64-apple-darwin.dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.aarch64-apple-darwin.build-dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.x86_64-unknown-illumos.dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+[target.x86_64-unknown-illumos.build-dependencies]
+bitflags-f595c2ba2a3f28df = { package = "bitflags", version = "2", default-features = false, features = ["std"] }
+hyper-rustls = { version = "0.24" }
+mio = { version = "0.8", features = ["net", "os-ext"] }
+once_cell = { version = "1", features = ["unstable"] }
+rustix = { version = "0.38", features = ["fs", "termios"] }
+
+### END HAKARI SECTION
diff --git a/workspace-hack/build.rs b/workspace-hack/build.rs
new file mode 100644
index 0000000000..92518ef04c
--- /dev/null
+++ b/workspace-hack/build.rs
@@ -0,0 +1,2 @@
+// A build script is required for cargo to consider build dependencies.
+fn main() {}
diff --git a/workspace-hack/src/lib.rs b/workspace-hack/src/lib.rs
new file mode 100644
index 0000000000..22489f632b
--- /dev/null
+++ b/workspace-hack/src/lib.rs
@@ -0,0 +1 @@
+// This is a stub lib.rs.