diff --git a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go
index 3ee3d54..5492bc3 100644
--- a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go
+++ b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code.go
@@ -14,6 +14,7 @@ import (
 
 	"github.com/devr-tools/codeguard/internal/codeguard/checks/support"
 	"github.com/devr-tools/codeguard/internal/codeguard/core"
+	"github.com/devr-tools/codeguard/internal/codeguard/trust"
 )
 
 const (
@@ -75,6 +76,9 @@ func rustToolchainDeadCodeFindings(ctx context.Context, env support.Context, tar
 		return nil
 	}
 	level := toolchainDeadCodeLevel(cfg)
+	if err := trust.GuardConfigCommand("quality_rules.dead_code", "cargo check"); err != nil {
+		return []core.Finding{rustToolchainDeadCodeDiagnostic(env, level, err.Error())}
+	}
 	issues, err := rustToolchainDeadCodeIssues(ctx, env, target, cfg)
 	findings := make([]core.Finding, 0, len(issues)+1)
 	for _, issue := range issues {
diff --git a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go
index 539121e..738bd6e 100644
--- a/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go
+++ b/internal/codeguard/checks/quality/quality_rust_toolchain_dead_code_test.go
@@ -1,6 +1,7 @@
 package quality
 
 import (
+	"context"
 	"os"
 	"path/filepath"
 	"strings"
@@ -8,8 +9,35 @@ import (
 
 	"github.com/devr-tools/codeguard/internal/codeguard/checks/support"
 	"github.com/devr-tools/codeguard/internal/codeguard/core"
+	"github.com/devr-tools/codeguard/internal/codeguard/trust"
 )
 
+func TestRustToolchainDeadCodeRequiresConfigCommandTrust(t *testing.T) {
+	originalPolicy := trust.Current()
+	t.Cleanup(func() { trust.Set(originalPolicy) })
+	trust.Set(trust.Policy{})
+
+	enabled := true
+	env := support.Context{
+		Config: core.Config{Checks: core.CheckConfig{QualityRules: core.QualityRulesConfig{
+			DeadCode: core.QualityDeadCodeConfig{Enabled: &enabled, Mode: "toolchain"},
+		}}},
+		NewFinding: func(input support.FindingInput) core.Finding {
+			return core.Finding{RuleID: input.RuleID, Level: input.Level, Message: input.Message}
+		},
+	}
+	target := core.TargetConfig{Name: "crate", Path: t.TempDir(), Language: "rust"}
+
+	findings := rustToolchainDeadCodeFindings(context.Background(), env, target)
+
+	if len(findings) != 1 {
+		t.Fatalf("findings = %+v, want one trust diagnostic", findings)
+	}
+	if !strings.Contains(findings[0].Message, "refusing to run config-supplied command") {
+		t.Fatalf("message = %q, want config command trust error", findings[0].Message)
+	}
+}
+
 func TestParseCargoDeadCodeDiagnostics(t *testing.T) {
 	output := `{"reason":"compiler-message","message":{"level":"error","message":"function ` + "`unused_helper`" + ` is never used","code":{"code":"dead_code"},"spans":[{"file_name":"src/lib.rs","line_start":3,"column_start":4,"is_primary":true}]}}` + "\n" +
 		`{"reason":"compiler-message","message":{"level":"warning","message":"unreachable statement","code":{"code":"unreachable_code"},"spans":[{"file_name":"src/lib.rs","line_start":8,"column_start":5,"is_primary":true}]}}` + "\n" +