diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6109c236..9c7840c6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -61,6 +61,24 @@ jobs:
         env:
           RUSTDOCFLAGS: ${{ matrix.rust_channel == 'nightly' && '-Dwarnings --cfg=docsrs' || '-Dwarnings' }}
 
+  check-external-types:
+    name: Validate external types appearing in public API
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout sources
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Install rust toolchain
+        uses: dtolnay/rust-toolchain@master
+        with:
+          toolchain: nightly-2023-10-10
+          # ^ sync with https://github.com/awslabs/cargo-check-external-types/blob/main/rust-toolchain.toml
+      - run: cargo install --locked cargo-check-external-types
+      - name: run cargo-check-external-types for rcgen/
+        working-directory: rcgen/
+        run: cargo check-external-types --all-features
+
   build-windows:
     runs-on: windows-latest
     env:
diff --git a/rcgen/Cargo.toml b/rcgen/Cargo.toml
index eb4e6538..b3f9dba6 100644
--- a/rcgen/Cargo.toml
+++ b/rcgen/Cargo.toml
@@ -35,6 +35,12 @@ default = ["pem"]
 [package.metadata.docs.rs]
 features = ["x509-parser"]
 
+[package.metadata.cargo_check_external_types]
+allowed_external_types = [
+    "time::offset_date_time::OffsetDateTime",
+    "zeroize::Zeroize"
+]
+
 [dev-dependencies]
 openssl = "0.10"
 x509-parser = { version = "0.15", features = ["verify"] }