diff --git a/Cargo.toml b/Cargo.toml
index 48a87c2..21ccbbc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -10,6 +10,9 @@ repository = "https://github.com/widberg/bff"
 edition = "2024"
 rust-version = "1.88.0"
 
+[workspace.lints.rust]
+unsafe_code = "deny"
+
 [workspace.lints.clippy]
 allow_attributes = "warn"
 assigning_clones = "warn"
diff --git a/bff/src/names/scope.rs b/bff/src/names/scope.rs
index f20c574..36f03a7 100644
--- a/bff/src/names/scope.rs
+++ b/bff/src/names/scope.rs
@@ -1,3 +1,9 @@
+#![expect(
+    unsafe_code,
+    reason = "ambient NameContext requires storing lifetime-erased borrows in a thread-local; \
+              guarded by runtime borrow-state + LIFO Drop discipline. See module tests."
+)]
+
 use std::cell::{Cell, RefCell};
 use std::ptr::NonNull;