diff --git a/deny.toml b/deny.toml
index 70082fc5..4536cd3f 100644
--- a/deny.toml
+++ b/deny.toml
@@ -36,10 +36,13 @@ deny = [
 skip = [
     { name = "arrayvec" },            # old version via tiny-skiaz
     { name = "base64" },              # small crate, old version from usvg
+    { name = "glow" },                # TODO(@wumpf): Old version use for glow backend right now, newer for wgpu. Updating this trickles out to updating winit.
+    { name = "glutin_wgl_sys" },      # TODO(@wumpf): Old version use for glow backend right now, newer for wgpu. Updating this trickles out to updating winit.
     { name = "libloading" },          # wgpu-hal itself depends on 0.8 while some of its dependencies, like ash and d3d12, depend on 0.7
     { name = "memoffset" },           # tiny dependency
     { name = "nix" },                 # old version via winit
     { name = "redox_syscall" },       # old version via winit
+    { name = "spin" },                # old version via ring through rusttls and other libraries, newer for wgpu.
     { name = "time" },                # old version pulled in by unmaintianed crate 'chrono'
     { name = "tiny-skia" },           # winit uses a different version from egui_extras (TODO(emilk): update egui_extras!)
     { name = "ttf-parser" },          # different versions pulled in by ab_glyph and usvg
@@ -47,9 +50,6 @@ skip = [
     { name = "windows_x86_64_msvc" }, # old version via glutin
     { name = "windows-sys" },         # old version via glutin
     { name = "windows" },             # old version via accesskit
-    { name = "spin" },                # old version via ring through rusttls and other libraries, newer for wgpu.
-    { name = "glow" },                # TODO(@wumpf): Old version use for glow backend right now, newer for wgpu. Updating this trickles out to updating winit.
-    { name = "glutin_wgl_sys" },      # TODO(@wumpf): As above
 ]
 skip-tree = [
     { name = "criterion" },     # dev-dependency