diff --git a/.github/labels.yaml b/.github/labels.yaml
index dd61941..e2a06a1 100644
--- a/.github/labels.yaml
+++ b/.github/labels.yaml
@@ -1,4 +1,7 @@
 ---
+- name: "A-audit"
+  color: "f7e101"
+  description: "Area: Audit configurable toolchain."
 - name: "A-build"
   color: "f7e101"
   description: "Area: CI build infrastructure."
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e570d37..c89c9ef 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,6 +10,22 @@ name: CI
   schedule:
     - cron: "0 0 * * TUE"
 jobs:
+  test-setup-audit-toolchain:
+    name: Test setup audit toolchain action
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+        with:
+          path: setup-rust-action
+
+      - name: Setup stable audit toolchain
+        uses: ./setup-rust-action/audit
+
+      - name: Check that active toolchain is stable
+        run: |
+          [[ "$(rustup show active-toolchain)" == stable-* ]]
+
   test-setup-build-and-test-toolchain:
     name: Test setup build and test toolchain action
     runs-on: ubuntu-latest
diff --git a/audit/action.yaml b/audit/action.yaml
new file mode 100644
index 0000000..d509b4e
--- /dev/null
+++ b/audit/action.yaml
@@ -0,0 +1,37 @@
+---
+name: "Audit Toolchain"
+description: "Setup a stable Rust toolchain with no bells and whistles so cargo-deny works"
+
+inputs:
+  toolchain:
+    description: "Rustup toolchain"
+    required: true
+    default: "stable"
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install ${{ inputs.toolchain }} toolchain
+      shell: bash
+      run: rustup toolchain install "${{ inputs.toolchain }}" --profile minimal
+
+    - name: Update ${{ inputs.toolchain }} toolchain
+      shell: bash
+      run: rustup update "${{ inputs.toolchain }}"
+
+    - name: Set default toolchain to ${{ inputs.toolchain }}
+      shell: bash
+      # https://rust-lang.github.io/rustup/overrides.html
+      run: echo 'RUSTUP_TOOLCHAIN=${{ inputs.toolchain }}' >> "$GITHUB_ENV"
+
+    - name: Show rustup version
+      shell: bash
+      run: rustup -Vv
+
+    - name: Show ${{ inputs.toolchain }} rustc version
+      shell: bash
+      run: rustc +${{ inputs.toolchain }} -Vv
+
+    - name: Show ${{ inputs.toolchain }} cargo version
+      shell: bash
+      run: cargo +${{ inputs.toolchain }} version --verbose