diff --git a/.github/workflows/build_and_test.yml b/.github/workflows/build_and_test.yml
index e4730f00..d010a577 100644
--- a/.github/workflows/build_and_test.yml
+++ b/.github/workflows/build_and_test.yml
@@ -120,18 +120,26 @@ jobs:
       uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
       with:
         path: local-tools
-        key: ${{ runner.os }}-local-tools-${{ matrix.version }}-${{ hashFiles('acknowledgments/cargo-about-version') }}
+        key: ${{ runner.os }}-local-tools-${{ matrix.version }}-${{ hashFiles('acknowledgments/cargo-about-version', '.taplo-cli-version') }}
 
     - name: Build cargo-about if needed
       run: cargo +stable install --version $(cat acknowledgments/cargo-about-version) --locked cargo-about --root local-tools
       if: matrix.version == 'nightly'
 
+    - name: Build taplo-cli if needed
+      run: cargo +stable install --version $(cat .taplo-cli-version) --locked taplo-cli --root local-tools
+      if: matrix.version == 'nightly'
+
     # This should be done before anything else
     # because it also checks that the lockfile is up to date.
     - name: Check for duplicate dependencies
       run: ./bin/verify_duplicate_crates
       if: matrix.version == 'nightly'
 
+    - name: Cargo.toml formatting check
+      run: PATH="$PATH:$PWD/local-tools/bin" taplo format -c .taplo.toml --check
+      if: matrix.version == 'nightly'
+
     - name: Rustfmt check
       run: cargo fmt --all -- --check
       if: matrix.version == 'nightly'
diff --git a/.taplo-cli-version b/.taplo-cli-version
new file mode 100644
index 00000000..ac39a106
--- /dev/null
+++ b/.taplo-cli-version
@@ -0,0 +1 @@
+0.9.0
diff --git a/.taplo.toml b/.taplo.toml
new file mode 100644
index 00000000..ef61e594
--- /dev/null
+++ b/.taplo.toml
@@ -0,0 +1,13 @@
+include = ["Cargo.toml", "rust/**/*.toml"]
+
+[formatting]
+reorder_keys = false
+indent_string = '    '
+
+[[rule]]
+include = ["**/Cargo.toml"]
+keys = ["dependencies"]
+
+[rule.formatting]
+reorder_keys = true
+inline_table_expand = false
diff --git a/justfile b/justfile
index efe77ba6..f44b160a 100644
--- a/justfile
+++ b/justfile
@@ -16,6 +16,7 @@ generate-bridge:
 # Auto-format code in Java, Rust, Swift, and TypeScript
 format-all:
     cargo fmt
+    taplo fmt
     (cd swift && swiftformat --swiftversion 5 .)
     (cd node && yarn format)
     (cd java && ./gradlew spotlessApply)
diff --git a/rust/attest/Cargo.toml b/rust/attest/Cargo.toml
index 437bab02..1da26e5f 100644
--- a/rust/attest/Cargo.toml
+++ b/rust/attest/Cargo.toml
@@ -20,9 +20,9 @@ chacha20poly1305 = "0.10.1"
 chrono = { version = "0.4", features = ["serde"] }
 ciborium = "0.2"
 displaydoc = "0.2"
-hmac = "0.12"
 hex = { version = "0.4", features = ["serde"] }
 hex-literal = "0.4.1"
+hmac = "0.12"
 lazy_static = "1.4.0"
 libc = "0.2"
 log = "0.4"
diff --git a/rust/attest/fuzz/Cargo.toml b/rust/attest/fuzz/Cargo.toml
index af5e2185..7ff3ef79 100644
--- a/rust/attest/fuzz/Cargo.toml
+++ b/rust/attest/fuzz/Cargo.toml
@@ -10,10 +10,9 @@ edition = "2021"
 cargo-fuzz = true
 
 [dependencies]
-libfuzzer-sys = "0.4"
+attest = { path = "../" }
 
-[dependencies.attest]
-path = ".."
+libfuzzer-sys = "0.4"
 
 # Prevent this from interfering with workspaces
 [workspace]
diff --git a/rust/bridge/ffi/Cargo.toml b/rust/bridge/ffi/Cargo.toml
index 3b23bcca..e413fe19 100644
--- a/rust/bridge/ffi/Cargo.toml
+++ b/rust/bridge/ffi/Cargo.toml
@@ -21,21 +21,22 @@ signal-media = ["libsignal-bridge/signal-media"]
 testing-fns = ["libsignal-bridge/testing-fns"]
 
 [dependencies]
-libsignal-protocol = { path = "../../protocol" }
-libsignal-net = { path = "../../net" }
-device-transfer = { path = "../../device-transfer" }
 attest = { path = "../../attest" }
-signal-crypto = { path = "../../crypto" }
-zkgroup = { path = "../../zkgroup" }
-usernames = { path = "../../usernames" }
-signal-pin = { path = "../../pin" }
-signal-media = { path = "../../media" }
+device-transfer = { path = "../../device-transfer" }
 libsignal-bridge = { path = "../shared", features = ["ffi"] }
+libsignal-net = { path = "../../net" }
+libsignal-protocol = { path = "../../protocol" }
+signal-crypto = { path = "../../crypto" }
+signal-media = { path = "../../media" }
+signal-pin = { path = "../../pin" }
+usernames = { path = "../../usernames" }
+zkgroup = { path = "../../zkgroup" }
+
 async-trait = "0.1.41"
 futures-util = "0.3"
-rand = "0.8"
 log = { version = "0.4", features = ["release_max_level_info"] }
 log-panics = { version = "2.1.0", features = ["with-backtrace"] }
+rand = "0.8"
 
 [target.aarch64-apple-ios.dependencies]
 cpufeatures = "0.2.1" # Make sure iOS gets optimized crypto.
diff --git a/rust/bridge/ffi/cbindgen.toml b/rust/bridge/ffi/cbindgen.toml
index 130cf2f9..78e30bf9 100644
--- a/rust/bridge/ffi/cbindgen.toml
+++ b/rust/bridge/ffi/cbindgen.toml
@@ -22,9 +22,22 @@ usize_is_size_t = true
 prefix_with_name = true
 
 [export]
-include = ["SignalErrorCode", "FfiDirection", "FfiCiphertextMessageType", "FfiContentHint", "RandomnessBytes"]
+include = [
+    "SignalErrorCode",
+    "FfiDirection",
+    "FfiCiphertextMessageType",
+    "FfiContentHint",
+    "RandomnessBytes",
+]
 exclude = ["TAG_SIZE", "NONCE_SIZE"]
-item_types = ["enums", "functions", "opaque", "structs", "typedefs", "constants"]
+item_types = [
+    "enums",
+    "functions",
+    "opaque",
+    "structs",
+    "typedefs",
+    "constants",
+]
 # FIXME: this doesn't work well with constants in SCREAMING_SNAKE_CASE
 prefix = "Signal"
 renaming_overrides_prefixing = true
@@ -65,9 +78,23 @@ args = "horizontal"
 
 [parse]
 parse_deps = true
-include = ["libsignal-core", "libsignal-protocol", "signal-crypto", "signal-pin", "zkgroup", "signal-media", "mediasan-common", "mp4san", "webpsan"]
+include = [
+    "libsignal-core",
+    "libsignal-protocol",
+    "signal-crypto",
+    "signal-pin",
+    "zkgroup",
+    "signal-media",
+    "mediasan-common",
+    "mp4san",
+    "webpsan",
+]
 extra_bindings = ["libsignal-bridge", "zkgroup"]
 
 [parse.expand]
 crates = ["libsignal-ffi", "libsignal-bridge"]
-features = ["libsignal-bridge/ffi", "libsignal-bridge/signal-media", "libsignal-bridge/testing-fns"]
+features = [
+    "libsignal-bridge/ffi",
+    "libsignal-bridge/signal-media",
+    "libsignal-bridge/testing-fns",
+]
diff --git a/rust/bridge/jni/Cargo.toml b/rust/bridge/jni/Cargo.toml
index b7aac276..20d4ad7f 100644
--- a/rust/bridge/jni/Cargo.toml
+++ b/rust/bridge/jni/Cargo.toml
@@ -15,15 +15,16 @@ name = "signal_jni"
 crate-type = ["cdylib"]
 
 [dependencies]
+libsignal-bridge = { path = "../shared", features = ["jni", "signal-media"] }
 libsignal-protocol = { path = "../../protocol" }
 signal-crypto = { path = "../../crypto" }
-libsignal-bridge = { path = "../shared", features = ["jni", "signal-media"] }
+
 async-trait = "0.1.41"
 cfg-if = "1.0.0"
 jni = "0.21.0"
-rand = "0.8"
 log = { version = "0.4", features = ["release_max_level_info"] }
 log-panics = { version = "2.1.0", features = ["with-backtrace"] }
+rand = "0.8"
 
 [features]
 testing-fns = ["libsignal-bridge/testing-fns"]
diff --git a/rust/bridge/jni/cbindgen.toml b/rust/bridge/jni/cbindgen.toml
index e4e2d84a..fc06806f 100644
--- a/rust/bridge/jni/cbindgen.toml
+++ b/rust/bridge/jni/cbindgen.toml
@@ -25,4 +25,8 @@ extra_bindings = ["libsignal-bridge"]
 
 [parse.expand]
 crates = ["libsignal-jni", "libsignal-bridge"]
-features = ["libsignal-bridge/jni", "libsignal-bridge/signal-media", "libsignal-bridge/testing-fns"]
+features = [
+    "libsignal-bridge/jni",
+    "libsignal-bridge/signal-media",
+    "libsignal-bridge/testing-fns",
+]
diff --git a/rust/bridge/node/Cargo.toml b/rust/bridge/node/Cargo.toml
index 006268ba..56f742e8 100644
--- a/rust/bridge/node/Cargo.toml
+++ b/rust/bridge/node/Cargo.toml
@@ -15,18 +15,19 @@ name = "signal_node"
 crate-type = ["cdylib"]
 
 [dependencies]
-libsignal-protocol = { path = "../../protocol" }
 libsignal-bridge = { path = "../shared", features = ["node", "signal-media"] }
+libsignal-protocol = { path = "../../protocol" }
 signal-neon-futures = { path = "futures" }
-neon = { version = "1.0.0", default-features = false, features = ["napi-6"] }
-rand = "0.8"
-log = { version = "0.4", features = ["release_max_level_info"] }
-log-panics = { version = "2.0.0", features = ["with-backtrace"] }
+
 async-trait = "0.1.41"
 futures = { version = "0.3", default-features = false, features = ["executor"] }
+log = { version = "0.4", features = ["release_max_level_info"] }
+log-panics = { version = "2.0.0", features = ["with-backtrace"] }
 minidump = { version = "0.20.0", default-features = false }
-minidump-unwind = { version = "0.20.0", default-features = false }
 minidump-processor = { version = "0.20.0", default-features = false }
+minidump-unwind = { version = "0.20.0", default-features = false }
+neon = { version = "1.0.0", default-features = false, features = ["napi-6"] }
+rand = "0.8"
 
 [build-dependencies]
 # cmake 0.1.49 breaks no-toolchain Windows cross-compilation using Visual Studio
@@ -34,4 +35,4 @@ minidump-processor = { version = "0.20.0", default-features = false }
 cmake = ">= 0.1, < 0.1.49"
 
 [features]
-testing-fns = ["libsignal-bridge/testing-fns"]
\ No newline at end of file
+testing-fns = ["libsignal-bridge/testing-fns"]
diff --git a/rust/bridge/node/futures/Cargo.toml b/rust/bridge/node/futures/Cargo.toml
index 951470d4..ab7c3f9a 100644
--- a/rust/bridge/node/futures/Cargo.toml
+++ b/rust/bridge/node/futures/Cargo.toml
@@ -21,8 +21,8 @@ path = "benches/node.rs"
 harness = false
 
 [dependencies]
-neon = { version = "1.0.0", default-features = false, features = ["napi-4"] }
 futures-util = "0.3.7"
+neon = { version = "1.0.0", default-features = false, features = ["napi-4"] }
 
 [dev-dependencies]
 signal-neon-futures-tests = { path = "tests-node-module" }
diff --git a/rust/bridge/node/futures/tests-node-module/Cargo.toml b/rust/bridge/node/futures/tests-node-module/Cargo.toml
index dcec3a20..ebe58e73 100644
--- a/rust/bridge/node/futures/tests-node-module/Cargo.toml
+++ b/rust/bridge/node/futures/tests-node-module/Cargo.toml
@@ -17,8 +17,9 @@ crate-type = ["cdylib"]
 
 [dependencies]
 signal-neon-futures = { path = ".." }
-neon = { version = "1.0.0", default-features = false, features = ["napi-1"] }
+
 futures-util = "0.3.7"
+neon = { version = "1.0.0", default-features = false, features = ["napi-1"] }
 
 [features]
 # Enable default-panic-hook to get backtraces of panics.
diff --git a/rust/bridge/shared/Cargo.toml b/rust/bridge/shared/Cargo.toml
index b9a34753..8c8567d7 100644
--- a/rust/bridge/shared/Cargo.toml
+++ b/rust/bridge/shared/Cargo.toml
@@ -11,18 +11,19 @@ edition = "2021"
 license = "AGPL-3.0-only"
 
 [dependencies]
-libsignal-protocol = { path = "../../protocol" }
+attest = { path = "../../attest" }
+device-transfer = { path = "../../device-transfer" }
+libsignal-bridge-macros = { path = "macros" }
+libsignal-message-backup = { path = "../../message-backup" }
 libsignal-net = { path = "../../net" }
+libsignal-protocol = { path = "../../protocol" }
 libsignal-svr3 = { path = "../../svr3" }
 signal-crypto = { path = "../../crypto" }
-device-transfer = { path = "../../device-transfer" }
-attest = { path = "../../attest" }
-zkgroup = { path = "../../zkgroup" }
-usernames = { path = "../../usernames" }
-signal-pin = { path = "../../pin" }
-libsignal-message-backup = { path = "../../message-backup" }
 signal-media = { path = "../../media", optional = true }
-libsignal-bridge-macros = { path = "macros" }
+signal-pin = { path = "../../pin" }
+usernames = { path = "../../usernames" }
+zkgroup = { path = "../../zkgroup" }
+
 aes-gcm-siv = "0.11.1"
 async-trait = "0.1.41"
 base64 = "0.21"
@@ -59,8 +60,8 @@ subtle = { version = "2.5", features = ["core_hint_black_box"] }
 
 bytemuck = { version = "1.13.0", optional = true }
 jni = { version = "0.21", package = "jni", optional = true }
-neon = { version = "1.0.0", optional = true, default-features = false, features = ["napi-6"] }
 linkme = { version = "0.3.9", optional = true }
+neon = { version = "1.0.0", optional = true, default-features = false, features = ["napi-6"] }
 signal-neon-futures = { path = "../node/futures", optional = true }
 strum = { version = "0.26", features = ["derive"] }
 
diff --git a/rust/crypto/Cargo.toml b/rust/crypto/Cargo.toml
index 6a8eba68..a50cb117 100644
--- a/rust/crypto/Cargo.toml
+++ b/rust/crypto/Cargo.toml
@@ -14,13 +14,13 @@ license = "AGPL-3.0-only"
 aes = { version = "0.8.3", features = ["zeroize"] }
 cbc = { version = "0.1.2", features = ["std", "zeroize"] }
 ctr = { version = "0.9.2", features = ["zeroize"] }
-subtle = "2.3"
+displaydoc = "0.2"
 ghash = { version = "0.5.0", features = ["zeroize"] }
 hmac = { version = "0.12", features = ["reset"] }
 sha1 = "0.10"
 sha2 = "0.10"
+subtle = "2.3"
 thiserror = "1.0.38"
-displaydoc = "0.2"
 
 [dev-dependencies]
 criterion = "0.5"
diff --git a/rust/message-backup/Cargo.toml b/rust/message-backup/Cargo.toml
index 0053925d..2665f0ed 100644
--- a/rust/message-backup/Cargo.toml
+++ b/rust/message-backup/Cargo.toml
@@ -42,15 +42,15 @@ hkdf = "0.12"
 hmac = "0.12"
 log = "0.4"
 mediasan-common = "0.5.0"
+num_enum = "0.6.1"
 protobuf = "3.3.0"
 protobuf-json-mapping = { version = "3.3.0", optional = true }
 serde_json = { version = "1.0", optional = true }
 sha2 = "0.10"
+strum = { version = "0.26", features = ["derive"] }
 subtle = "2.5.0"
 thiserror = "1.0.50"
 uuid = "1.1.2"
-num_enum = "0.6.1"
-strum = { version = "0.26", features = ["derive"] }
 
 [dev-dependencies]
 libsignal-message-backup = { path = "./", features = ["json"] }
diff --git a/rust/net/Cargo.toml b/rust/net/Cargo.toml
index f3fcbbda..6ec46a83 100644
--- a/rust/net/Cargo.toml
+++ b/rust/net/Cargo.toml
@@ -6,8 +6,10 @@ authors = ["Signal Messenger LLC"]
 license = "AGPL-3.0-only"
 
 [dependencies]
-libsignal-svr3 = { path = "../svr3"}
 attest = { path = "../attest" }
+libsignal-core = { path = "../core" }
+libsignal-svr3 = { path = "../svr3" }
+
 async-trait = "0.1.41"
 base64 = "0.21"
 bincode = "1.0"
@@ -26,7 +28,6 @@ http-body-util = "0.1.1"
 hyper = { version = "1.2.0", features = ["http1", "http2", "client"] }
 itertools = "0.12.0"
 lazy_static = "1.4.0"
-libsignal-core = { path = "../core" }
 log = "0.4.19"
 pin-project-lite = "0.2.4"
 prost = "0.12.1"
diff --git a/rust/poksho/Cargo.toml b/rust/poksho/Cargo.toml
index 706a00c4..ff478af4 100644
--- a/rust/poksho/Cargo.toml
+++ b/rust/poksho/Cargo.toml
@@ -12,9 +12,9 @@ license = "AGPL-3.0-only"
 
 [dependencies]
 curve25519-dalek = "4.0"
+hmac = { version = "0.12", features = ["reset"] }
 sha2 = "0.10"
 subtle = "2.5"
-hmac = { version = "0.12", features = ["reset"] }
 
 [dev-dependencies]
 hex = "0.4"
@@ -25,4 +25,4 @@ rand = "0.8"
 
 [[bench]]
 name = "sho"
-harness = false
\ No newline at end of file
+harness = false
diff --git a/rust/protocol/Cargo.toml b/rust/protocol/Cargo.toml
index 5030dda0..17e25094 100644
--- a/rust/protocol/Cargo.toml
+++ b/rust/protocol/Cargo.toml
@@ -13,6 +13,7 @@ license = "AGPL-3.0-only"
 [dependencies]
 libsignal-core = { path = "../core" }
 signal-crypto = { path = "../crypto" }
+
 aes = { version = "0.8.3", features = ["zeroize"] }
 aes-gcm-siv = "0.11.1"
 arrayref = "0.3.6"
@@ -20,25 +21,25 @@ async-trait = "0.1.41"
 ctr = { version = "0.9.2", features = ["zeroize"] }
 curve25519-dalek = { version = "4.0.0", features = ["digest"] }
 derive-where = "1.2.5"
+displaydoc = "0.2"
+hex = "0.4"
 hkdf = "0.12"
 hmac = "0.12"
 indexmap = "2.1.0"
 itertools = "0.12.0"
+log = "0.4"
+num_enum = "0.6.1"
+pqcrypto-kyber = { version = "0.7.6", default-features = false, features = ["std"] }
+pqcrypto-traits = "0.3.4"
 prost = "0.12"
 rand = "0.8"
 rayon = "1.8.0"
 sha2 = "0.10"
 static_assertions = "1.1"
 subtle = "2.3"
-x25519-dalek = { version = "2.0.0", features = ["static_secrets"] }
-hex = "0.4"
-log = "0.4"
-num_enum = "0.6.1"
-uuid = "1.1.2"
-displaydoc = "0.2"
 thiserror = "1.0.30"
-pqcrypto-kyber = { version = "0.7.6", default-features = false, features = ["std"] }
-pqcrypto-traits = "0.3.4"
+uuid = "1.1.2"
+x25519-dalek = { version = "2.0.0", features = ["static_secrets"] }
 
 # WARNING: pqcrypto-kyber 0.8 and 0.7 don't actually coexist, they both depend on the same C symbols.
 # We keep this here for if/when that gets cleared up.
diff --git a/rust/protocol/fuzz/Cargo.toml b/rust/protocol/fuzz/Cargo.toml
index 7d0c3c37..a7fa48b0 100644
--- a/rust/protocol/fuzz/Cargo.toml
+++ b/rust/protocol/fuzz/Cargo.toml
@@ -9,14 +9,14 @@ edition = "2021"
 cargo-fuzz = true
 
 [dependencies]
+libsignal-protocol = { path = ".." }
+
 env_logger = "0.10.0"
 futures-util = "0.3.7"
 libfuzzer-sys = "0.4"
 log = "0.4"
 rand = "0.8"
 
-[dependencies.libsignal-protocol]
-path = ".."
 
 # Prevent this from interfering with workspaces
 [workspace]
diff --git a/rust/svr3/Cargo.toml b/rust/svr3/Cargo.toml
index 017b6e38..ba28b4cf 100644
--- a/rust/svr3/Cargo.toml
+++ b/rust/svr3/Cargo.toml
@@ -11,13 +11,14 @@ license = "AGPL-3.0-only"
 
 [dependencies]
 attest = { path = "../attest" }
+
 base64 = "0.21.5"
 curve25519-dalek = { version = "4.0", features = ["rand_core"] }
 displaydoc = "0.2"
 hkdf = "0.12"
+http = "1.0.0"
 prost = "0.12.1"
 rand_core = { version = "0.6", features = ["getrandom"] }
-http = "1.0.0"
 sha2 = "0.10"
 strum_macros = "0.26"
 subtle = "2.5"
diff --git a/rust/usernames/Cargo.toml b/rust/usernames/Cargo.toml
index 98b79478..6d8b63f5 100644
--- a/rust/usernames/Cargo.toml
+++ b/rust/usernames/Cargo.toml
@@ -16,19 +16,20 @@ poksho = { path = "../poksho" }
 signal-crypto = { path = "../crypto" }
 
 curve25519-dalek = { version = "4.0", features = ["digest"] }
+displaydoc = "0.2"
 hkdf = "0.12"
 hmac = "0.12"
-sha2 = "0.10"
-displaydoc = "0.2"
 lazy_static = "1.4.0"
 log = "0.4"
 prost = "0.12"
 rand = "0.8"
+sha2 = "0.10"
 subtle = "2.5.0"
 thiserror = "1.0.40"
 
 [dev-dependencies]
 zkgroup = { path = "../zkgroup" }
+
 proptest = "1.0"
 criterion = "0.5"
 
diff --git a/rust/zkgroup/Cargo.toml b/rust/zkgroup/Cargo.toml
index eba9f664..585ae85a 100644
--- a/rust/zkgroup/Cargo.toml
+++ b/rust/zkgroup/Cargo.toml
@@ -17,12 +17,15 @@ poksho = { path = "../poksho" }
 signal-crypto = { path = "../crypto" }
 zkcredential = { path = "../zkcredential", features = ["rayon"] }
 
+curve25519-dalek = { git = 'https://github.com/signalapp/curve25519-dalek', tag = 'signal-curve25519-4.1.1', version = "4.1.1", features = ["serde"] }
+
 aes-gcm-siv = "0.11.1"
 bincode = "1.2.1"
 derive-where = "1.2.5"
 displaydoc = "0.2"
 hex = "0.4.0"
 hex-literal = "0.4.1"
+hkdf = "0.12"
 lazy_static = "1.4.0"
 num_enum = "0.6.1"
 partial-default = { version = "0.1.0", features = ["derive"] }
@@ -31,17 +34,11 @@ serde = { version = "1.0.106", features = ["derive"] }
 sha2 = "0.10.0"
 subtle = "2.3"
 uuid = "1.1.2"
-hkdf = "0.12"
 
 # For generation
 base64 = { version = "0.21", optional = true }
 rand = { version = "0.8", optional = true }
 
-[dependencies.curve25519-dalek]
-git = 'https://github.com/signalapp/curve25519-dalek'
-tag = 'signal-curve25519-4.1.1'
-features = ["serde"]
-version = "4.1.1"
 
 [dev-dependencies]
 rand = "0.8"