diff --git a/.clippy.toml b/.clippy.toml
index 61fdd2ffb..d44863072 100644
--- a/.clippy.toml
+++ b/.clippy.toml
@@ -1 +1,17 @@
 msrv = "1.95.0"
+
+# Types that must never be held across an `.await` point
+# (enforced by clippy::await_holding_invalid_type, see Cargo.toml).
+await-holding-invalid-types = [
+    { path = "std::sync::MutexGuard", reason = "std mutex guard blocks the async worker; drop before .await or use tokio::sync::Mutex" },
+    { path = "std::sync::RwLockReadGuard", reason = "std rwlock guard blocks the async worker; drop before .await" },
+    { path = "std::sync::RwLockWriteGuard", reason = "std rwlock guard blocks the async worker; drop before .await" },
+    { path = "std::cell::Ref", reason = "RefCell borrow across .await panics on re-entrant borrow" },
+    { path = "std::cell::RefMut", reason = "RefCell borrow across .await panics on re-entrant borrow" },
+]
+
+# clippy::large_futures (warn, so fatal under -D warnings). The default 16 KiB
+# flags every build-orchestrator pipeline future (17-25 KiB of composed
+# state); 32 KiB still catches real mistakes such as a 64 KiB stack buffer
+# held across `.await`.
+future-size-threshold = 32768
diff --git a/Cargo.toml b/Cargo.toml
index 247451989..194148244 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -224,3 +224,9 @@ debug = false
 [workspace.lints.clippy]
 cognitive_complexity = "warn"
 too_many_lines = "warn"
+# Async hazards: a sync guard held across `.await` can deadlock the runtime
+# or block a worker thread. Type list lives in .clippy.toml.
+await_holding_lock = "deny"
+await_holding_refcell_ref = "deny"
+await_holding_invalid_type = "deny"
+large_futures = "warn"
diff --git a/crates/fbuild-packages-fetch/src/platformio_repository.rs b/crates/fbuild-packages-fetch/src/platformio_repository.rs
index 3182d05e3..f94bb3031 100644
--- a/crates/fbuild-packages-fetch/src/platformio_repository.rs
+++ b/crates/fbuild-packages-fetch/src/platformio_repository.rs
@@ -162,7 +162,9 @@ pub async fn resolve_archive_source(
         .await
         .map_err(|error| RepositoryError::Archive(error.to_string()))?;
     let mut hasher = Sha256::new();
-    let mut buffer = [0_u8; 64 * 1024];
+    // Heap, not stack: the buffer is held across `.await`, so an array would
+    // make this future 64 KiB (clippy::large_futures).
+    let mut buffer = vec![0_u8; 64 * 1024];
     loop {
         let read = file
             .read(&mut buffer)