diff --git a/.github/workflows/composer-dependency-analyser.yml b/.github/workflows/composer-dependency-analyser.yml
new file mode 100644
index 0000000..3fed6a3
--- /dev/null
+++ b/.github/workflows/composer-dependency-analyser.yml
@@ -0,0 +1,27 @@
+name: composer dependency analyser
+
+on:
+  pull_request:
+    paths: &paths
+      - 'src/**'
+      - 'tests/**'
+      - '.github/workflows/composer-dependency-analyser.yml'
+      - 'composer.json'
+      - 'composer-dependency-analyser.php'
+  push:
+    branches: ['master']
+    paths: *paths
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  composer-dependency-analyser:
+    uses: yiisoft/actions/.github/workflows/composer-dependency-analyser.yml@master
+    with:
+      php: >-
+        ['8.1', '8.2', '8.3', '8.4', '8.5']
diff --git a/composer-dependency-analyser.php b/composer-dependency-analyser.php
new file mode 100644
index 0000000..5b4c026
--- /dev/null
+++ b/composer-dependency-analyser.php
@@ -0,0 +1,11 @@
+<?php
+
+declare(strict_types=1);
+
+use ShipMonk\ComposerDependencyAnalyser\Config\Configuration;
+
+return (new Configuration())
+    ->disableComposerAutoloadPathScan()
+    ->setFileExtensions(['php'])
+    ->addPathToScan(__DIR__ . '/src', isDev: false)
+    ->addPathToScan(__DIR__ . '/tests', isDev: true);
diff --git a/composer.json b/composer.json
index 85028d3..58b60ef 100644
--- a/composer.json
+++ b/composer.json
@@ -34,6 +34,7 @@
         "phpunit/phpunit": "^10.5.47",
         "rector/rector": "^2.5",
         "roave/infection-static-analysis-plugin": "^1.35",
+        "shipmonk/composer-dependency-analyser": "^1.8",
         "vimeo/psalm": "^5.26.1 || ^6.12",
         "yiisoft/code-style": "^1.1"
     },
@@ -49,6 +50,7 @@
     },
     "scripts": {
         "cs-fix": "php-cs-fixer fix",
+        "dependency-analyser": "composer-dependency-analyser",
         "phan": "phan --progress-bar -o analysis.txt",
         "rector": "rector",
         "test": "phpunit --testdox --no-interaction"
diff --git a/docs/internals.md b/docs/internals.md
index b37b5b8..9a72f59 100644
--- a/docs/internals.md
+++ b/docs/internals.md
@@ -24,3 +24,12 @@ The code is statically analyzed with [Psalm](https://psalm.dev/). To run static
 ```shell
 ./vendor/bin/psalm
 ```
+
+## Dependencies
+
+Use [Composer Dependency Analyser](https://github.com/shipmonk-rnd/composer-dependency-analyser) to detect unknown,
+shadow, and unused [Composer](https://getcomposer.org) dependencies:
+
+```shell
+./vendor/bin/composer-dependency-analyser
+```