diff --git a/CHANGELOG.md b/CHANGELOG.md
index 654a6c7..cbed246 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -23,3 +23,17 @@ excluded, and the old behavior (analyze everything) was rarely desired.
 ```yaml
 respect_gitignore: false
 ```
+
+### Internal
+
+#### Replaced `serde_yaml` with `yaml_serde`
+
+`serde_yaml` was discontinued in March 2024, and its `unsafe-libyaml` backend has
+been unreleased since. pks now depends on
+[`yaml_serde`](https://github.com/yaml/yaml-serde), the YAML organization's
+maintained fork, which is backed by `libyaml-rs` from the same org.
+
+`yaml_serde` is an API-compatible fork whose only substantive changes are `no_std`
+support and lint cleanups, so this is behavior-preserving: the bytes pks writes to
+`package.yml` and `package_todo.yml` are unchanged, as are its YAML parse error
+messages. No action is required.
diff --git a/Cargo.toml b/Cargo.toml
index a13261e..bbe2441 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,7 +39,7 @@ path-clean = "1.0.1"                                                   # Pathnam
 rayon = "1.7.0"                                                        # for parallel iteration
 regex = "1.7.3"
 serde = { version = "~1", features = ["derive"] }                      # de(serialization)
-serde_yaml = "0.9.19"                                                  # de(serialization)
+yaml_serde = "0.10.6"                                                  # de(serialization)
 serde_json = "1.0.96"                                                  # de(serialization)
 serde_magnus = "0.7.0"                                                 # permits a ruby gem to interface with this library
 tracing = "0.1.37"                                                     # logging
diff --git a/src/packs/pack.rs b/src/packs/pack.rs
index a207a43..d3a9199 100644
--- a/src/packs/pack.rs
+++ b/src/packs/pack.rs
@@ -10,7 +10,7 @@ use anyhow::Context;
 use core::hash::Hash;
 use regex::Regex;
 use serde::{Deserialize, Deserializer, Serialize, Serializer};
-use serde_yaml::Value;
+use yaml_serde::Value;
 
 use super::{
     checker::ViolationIdentifier, file_utils::expand_glob, ignored, PackageTodo,
@@ -240,7 +240,7 @@ impl Pack {
                 .context("Failed to open the package_todo.yml file")?;
             file.read_to_string(&mut package_todo_contents)
                 .context("Could not read the package_todo.yml file")?;
-            serde_yaml::from_str(&package_todo_contents).with_context(|| {
+            yaml_serde::from_str(&package_todo_contents).with_context(|| {
                 format!(
                     "Failed to deserialize the package_todo.yml file at {}. Try deleting the file and running the `update` command to regenerate it.",
                     absolute_path_to_package_todo.display()
@@ -264,7 +264,7 @@ impl Pack {
         package_yml_contents: &str,
         package_todo: PackageTodo,
     ) -> anyhow::Result<Pack> {
-        let pack_result = serde_yaml::from_str(package_yml_contents);
+        let pack_result = yaml_serde::from_str(package_yml_contents);
         let pack = match pack_result {
             Ok(pack) => pack,
             Err(e) => {
@@ -406,7 +406,7 @@ fn is_default_public_folder(value: &Option<PathBuf>) -> bool {
 }
 
 pub fn serialize_pack(pack: &Pack) -> anyhow::Result<String> {
-    let serialized_pack = serde_yaml::to_string(&pack).unwrap();
+    let serialized_pack = yaml_serde::to_string(&pack).unwrap();
     if serialized_pack == "{}\n" {
         Ok("".to_owned())
     } else {
@@ -414,7 +414,7 @@ pub fn serialize_pack(pack: &Pack) -> anyhow::Result<String> {
     }
 }
 
-// serde_yaml doesn't add quotes around all constants, which isn't a problem
+// yaml_serde doesn't add quotes around all constants, which isn't a problem
 //unless the constant starts with ::
 fn add_back_necessary_quotes(
     serialized_pack: String,
@@ -489,7 +489,7 @@ mod tests {
     use pretty_assertions::assert_eq;
 
     fn reserialize_pack(pack_yml: &str) -> anyhow::Result<String> {
-        let deserialized_pack = serde_yaml::from_str::<Pack>(pack_yml).unwrap();
+        let deserialized_pack = yaml_serde::from_str::<Pack>(pack_yml).unwrap();
         serialize_pack(&deserialized_pack)
     }
 
@@ -678,7 +678,7 @@ enforcement_globs_ignore:
         "#
         .trim_start();
 
-        let pack: Result<Pack, _> = serde_yaml::from_str(pack_yml);
+        let pack: Result<Pack, _> = yaml_serde::from_str(pack_yml);
         let pack = pack.unwrap();
         assert_eq!(
             pack.clone().enforcement_globs_ignore.unwrap(),
@@ -709,7 +709,7 @@ enforcement_globs_ignore:
         );
 
         let reserialized = reserialize_pack(pack_yml)?;
-        let re_pack: Result<Pack, _> = serde_yaml::from_str(&reserialized);
+        let re_pack: Result<Pack, _> = yaml_serde::from_str(&reserialized);
         let re_pack = re_pack.unwrap();
         assert_eq!(pack, re_pack);
 
diff --git a/src/packs/package_todo.rs b/src/packs/package_todo.rs
index d966a26..954a1e9 100644
--- a/src/packs/package_todo.rs
+++ b/src/packs/package_todo.rs
@@ -55,7 +55,7 @@ where
             // a String key with double quotes.
             // When I tried this:
             // let quoted_constant_name = format!("\"{}\"", constant_name);
-            // serde_yaml would escape the quotes, so I would get this:
+            // yaml_serde would escape the quotes, so I would get this:
             // '\"::Bar\"'
             // (uncomment the above and run tests to reproduce)
             quoted_sorted_violations_by_constant
@@ -176,7 +176,7 @@ fn serialize_package_todo(
     package_todo: &PackageTodo,
     packs_first_mode: bool,
 ) -> String {
-    let package_todo_yml = serde_yaml::to_string(&package_todo).unwrap();
+    let package_todo_yml = yaml_serde::to_string(&package_todo).unwrap();
 
     // HACK: This is the other part of the hack above (search `HACK:` for more)
     let package_todo_yml = package_todo_yml.replace("'#", "\"");
@@ -351,7 +351,7 @@ mod tests {
 
         let expected = example_package_todo(String::from("packs/bar"));
 
-        let actual: PackageTodo = serde_yaml::from_str(&contents).unwrap();
+        let actual: PackageTodo = yaml_serde::from_str(&contents).unwrap();
         assert_eq!(expected, actual);
     }
 
diff --git a/src/packs/raw_configuration.rs b/src/packs/raw_configuration.rs
index 3f94f66..1841a0b 100644
--- a/src/packs/raw_configuration.rs
+++ b/src/packs/raw_configuration.rs
@@ -128,7 +128,7 @@ fn get_from_file_that_exists(
         ))
     })?;
 
-    let configuration = serde_yaml::from_str(&contents).map_err(|e| {
+    let configuration = yaml_serde::from_str(&contents).map_err(|e| {
         anyhow::Error::new(e).context(format!(
             "Could not parse packwerk.yml at: {}",
             absolute_path_to_packwerk_yml.display(),
@@ -145,7 +145,7 @@ impl Default for RawConfiguration {
         // Deserialize an empty string to get the default RawConfiguration
         // We used to use #[derive(Default)] on the RawConfiguration.
         // However, that doesn't use the defaults fed to serde
-        serde_yaml::from_str("").unwrap()
+        yaml_serde::from_str("").unwrap()
     }
 }
 
@@ -230,7 +230,7 @@ mod tests {
     fn test_deserialize_package_paths_as_string() {
         let raw_configuration_string = String::from("package_paths: '**/*'");
         let raw_configuration =
-            serde_yaml::from_str::<RawConfiguration>(&raw_configuration_string)
+            yaml_serde::from_str::<RawConfiguration>(&raw_configuration_string)
                 .expect("Could not deserialize package_paths as string");
 
         assert_eq!(raw_configuration.package_paths, vec!["**/*"]);