diff --git a/buildpacks/ruby/src/layers/bundle_download_layer.rs b/buildpacks/ruby/src/layers/bundle_download_layer.rs
index 59ad73db..bd93513f 100644
--- a/buildpacks/ruby/src/layers/bundle_download_layer.rs
+++ b/buildpacks/ruby/src/layers/bundle_download_layer.rs
@@ -72,6 +72,7 @@ impl MetadataDiff for Metadata {
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct MetadataV1 {
     pub(crate) version: ResolvedBundlerVersion,
 }
diff --git a/buildpacks/ruby/src/layers/bundle_install_layer.rs b/buildpacks/ruby/src/layers/bundle_install_layer.rs
index 989482ba..bd31189c 100644
--- a/buildpacks/ruby/src/layers/bundle_install_layer.rs
+++ b/buildpacks/ruby/src/layers/bundle_install_layer.rs
@@ -162,6 +162,7 @@ impl MetadataDiff for Metadata {
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone, Eq, PartialEq)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct MetadataV1 {
     pub(crate) stack: String,
     pub(crate) ruby_version: ResolvedRubyVersion,
@@ -170,6 +171,7 @@ pub(crate) struct MetadataV1 {
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone, Eq, PartialEq)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct MetadataV2 {
     pub(crate) distro_name: String,
     pub(crate) distro_version: String,
@@ -321,6 +323,7 @@ fn display_name(cmd: &mut Command, env: &Env) -> String {
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone, Eq, PartialEq, Default)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct BundleDigest {
     env: String,
     gemfile: String,
diff --git a/buildpacks/ruby/src/layers/metrics_agent_install.rs b/buildpacks/ruby/src/layers/metrics_agent_install.rs
index 2543f843..2c289194 100644
--- a/buildpacks/ruby/src/layers/metrics_agent_install.rs
+++ b/buildpacks/ruby/src/layers/metrics_agent_install.rs
@@ -30,6 +30,7 @@ const DOWNLOAD_URL: &str =
 const DOWNLOAD_SHA: &str = "f9bf9f33c949e15ffed77046ca38f8dae9307b6a0181c6af29a25dec46eb2dac";
 
 #[derive(Deserialize, Serialize, Debug, Clone, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct Metadata {
     download_url: String,
 }
diff --git a/buildpacks/ruby/src/layers/ruby_install_layer.rs b/buildpacks/ruby/src/layers/ruby_install_layer.rs
index e0444a67..477eeeb7 100644
--- a/buildpacks/ruby/src/layers/ruby_install_layer.rs
+++ b/buildpacks/ruby/src/layers/ruby_install_layer.rs
@@ -74,12 +74,14 @@ fn install_ruby(metadata: &Metadata, layer_path: &Path) -> Result<(), RubyBuildp
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct MetadataV1 {
     pub(crate) stack: String,
     pub(crate) version: ResolvedRubyVersion,
 }
 
 #[derive(Deserialize, Serialize, Debug, Clone, Eq, PartialEq)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct MetadataV2 {
     pub(crate) distro_name: String,
     pub(crate) distro_version: String,
diff --git a/buildpacks/ruby/src/layers/shared.rs b/buildpacks/ruby/src/layers/shared.rs
index cbb2af4f..58854211 100644
--- a/buildpacks/ruby/src/layers/shared.rs
+++ b/buildpacks/ruby/src/layers/shared.rs
@@ -207,6 +207,7 @@ mod tests {
 
     /// Struct for asserting the behavior of `cached_layer_write_metadata`
     #[derive(Debug, serde::Serialize, serde::Deserialize, Clone)]
+    #[serde(deny_unknown_fields)]
     struct TestMetadata {
         value: String,
     }
diff --git a/buildpacks/ruby/src/main.rs b/buildpacks/ruby/src/main.rs
index 62e42c29..5ad3560a 100644
--- a/buildpacks/ruby/src/main.rs
+++ b/buildpacks/ruby/src/main.rs
@@ -285,6 +285,7 @@ impl From<RubyBuildpackError> for libcnb::Error<RubyBuildpackError> {
 buildpack_main!(RubyBuildpack);
 
 #[derive(serde::Deserialize, serde::Serialize, Debug, Clone, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 struct BundleWithout(String);
 
 impl BundleWithout {
diff --git a/commons/src/cache/app_cache.rs b/commons/src/cache/app_cache.rs
index 773cb9c9..395aa138 100644
--- a/commons/src/cache/app_cache.rs
+++ b/commons/src/cache/app_cache.rs
@@ -251,6 +251,7 @@ pub enum PathState {
 ///  allows for emails, that might live a long time, to reference a specific SHA of an
 ///  asset.
 #[derive(Deserialize, Serialize, Debug, Clone, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 pub(crate) struct Metadata {
     pub(crate) app_dir_path: PathBuf,
 }
diff --git a/commons/src/gemfile_lock.rs b/commons/src/gemfile_lock.rs
index e3990753..455222de 100644
--- a/commons/src/gemfile_lock.rs
+++ b/commons/src/gemfile_lock.rs
@@ -81,6 +81,7 @@ impl GemfileLock {
 }
 
 #[derive(Serialize, Deserialize, Debug, PartialEq, Eq, Clone)]
+#[serde(deny_unknown_fields)]
 pub struct ResolvedRubyVersion(pub String);
 
 impl Display for ResolvedRubyVersion {
@@ -90,6 +91,7 @@ impl Display for ResolvedRubyVersion {
 }
 
 #[derive(Serialize, Deserialize, Debug, PartialEq, Eq, Clone)]
+#[serde(deny_unknown_fields)]
 pub struct ResolvedBundlerVersion(pub String);
 
 impl Display for ResolvedBundlerVersion {
diff --git a/commons/src/metadata_digest.rs b/commons/src/metadata_digest.rs
index 1ef09719..04f1e016 100644
--- a/commons/src/metadata_digest.rs
+++ b/commons/src/metadata_digest.rs
@@ -20,6 +20,7 @@ const PLATFORM_ENV_VAR: &str = "user configured environment variables";
 /// use commons::metadata_digest::MetadataDigest;
 ///
 /// #[derive(Deserialize, Serialize, Debug, Clone, Eq, PartialEq)]
+/// #[serde(deny_unknown_fields)]
 /// pub(crate) struct BundleInstallLayerMetadata {
 ///     ruby_version: String,
 ///     force_bundle_install_key: String,
@@ -82,6 +83,7 @@ const PLATFORM_ENV_VAR: &str = "user configured environment variables";
 /// # }
 /// #
 /// # #[derive(Deserialize, Serialize, Debug, Clone, Eq, PartialEq)]
+/// # #[serde(deny_unknown_fields)]
 /// # struct FakeLayerMetadata {
 /// #     digest: MetadataDigest,
 /// # }
@@ -148,6 +150,7 @@ const PLATFORM_ENV_VAR: &str = "user configured environment variables";
 /// add logic to your buildpack to re-run that command similar to the "escape valve" discussed
 /// above, but triggered by buildpack author instead of the end user.
 #[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, Default)]
+#[serde(deny_unknown_fields)]
 pub struct MetadataDigest {
     platform_env: Option<PlatformEnvDigest>,
     files: Option<PathsDigest>, // Must be last for serde to be happy https://github.com/toml-rs/toml-rs/issues/142
@@ -235,9 +238,11 @@ impl MetadataDigest {
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, Hash, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 struct ShaString(String);
 
 #[derive(Serialize, Deserialize, Clone, Debug, Hash, PartialEq, Eq)]
+#[serde(deny_unknown_fields)]
 struct PlatformEnvDigest(ShaString);
 impl PlatformEnvDigest {
     fn new(platform: &impl Platform) -> Self {
@@ -248,6 +253,7 @@ impl PlatformEnvDigest {
 }
 
 #[derive(Serialize, Deserialize, Clone, Debug, PartialEq, Eq, Default)]
+#[serde(deny_unknown_fields)]
 struct PathsDigest(HashMap<PathBuf, ShaString>);
 
 /// Main struct for detecting changes between two iterations