diff --git a/deny.toml b/deny.toml
index 11159f4..627aadc 100644
--- a/deny.toml
+++ b/deny.toml
@@ -49,7 +49,14 @@ ignore = [
 # `cargo deny check licenses` (spec §6.1) — this list passes the full
 # str0m/opus/axum transitive graph clean.
 allow = [
-    "GPL-3.0-or-later",
+    # SPDX expression "GPL-3.0-or-later" is valid SPDX but cargo-deny 0.18.x
+    # (the latest that installs on rust 1.85) can't parse the `-or-later`
+    # suffix. CI uses `cargo-deny-action@v1` (newer) which parses it; we use
+    # the bare `"GPL-3.0"` form so local `cargo deny check` works on the
+    # pinned toolchain. ADR-0004's "GPL-3.0-or-later" stance is unchanged;
+    # this is a parser workaround. When the workspace MSRV lifts past 1.88
+    # (where cargo-deny 0.19.x installs), revert this to `"GPL-3.0-or-later"`.
+    "GPL-3.0",
     "MIT",
     "Apache-2.0",
     "BSD-3-Clause",