diff --git a/CHANGELOG.md b/CHANGELOG.md
index 4581655..edb0003 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,8 @@ See [keep a changelog] for information about writing changes to this log.
 
 ## [Unreleased]
 
+- [PR-73](https://github.com/itk-dev/event-database-api/pull/73)
+  Require all directly used packages in `composer.json`, checked by PHPStan (`pb30/phpstan-composer-analysis`)
 - [PR-72](https://github.com/itk-dev/event-database-api/pull/72)
   Update Elasticsearch to 8.19.23 and remove the unused RabbitMQ service
 - [PR-71](https://github.com/itk-dev/event-database-api/pull/71)
diff --git a/composer.json b/composer.json
index 26f7f92..ade9b18 100644
--- a/composer.json
+++ b/composer.json
@@ -12,19 +12,29 @@
         "nelmio/cors-bundle": "^2.4",
         "phpdocumentor/reflection-docblock": "^5.6",
         "phpstan/phpdoc-parser": "^2.2",
+        "psr/container": "^2.0",
         "symfony/asset": "~7.4.0",
         "symfony/console": "~7.4.0",
+        "symfony/dependency-injection": "~7.4.0",
         "symfony/dotenv": "~7.4.0",
         "symfony/expression-language": "~7.4.0",
         "symfony/flex": "^2",
         "symfony/framework-bundle": "~7.4.0",
         "symfony/http-client": "~7.4.0",
+        "symfony/http-client-contracts": "^3.7",
+        "symfony/http-foundation": "~7.4.0",
+        "symfony/http-kernel": "~7.4.0",
         "symfony/property-access": "~7.4.0",
         "symfony/property-info": "~7.4.0",
+        "symfony/routing": "~7.4.0",
         "symfony/runtime": "~7.4.0",
         "symfony/security-bundle": "~7.4.0",
+        "symfony/security-core": "~7.4.0",
+        "symfony/security-http": "~7.4.0",
         "symfony/serializer": "~7.4.0",
+        "symfony/string": "~7.4.0",
         "symfony/twig-bundle": "~7.4.0",
+        "symfony/type-info": "~7.4.0",
         "symfony/validator": "~7.4.0",
         "symfony/yaml": "~7.4.0"
     },
@@ -32,6 +42,7 @@
         "ergebnis/composer-normalize": "^2.47",
         "friendsofphp/php-cs-fixer": "^3.86",
         "justinrainbow/json-schema": "^6.10",
+        "pb30/phpstan-composer-analysis": "^1.1",
         "phpstan/extension-installer": "^1.4",
         "phpstan/phpstan": "^2.1",
         "phpstan/phpstan-strict-rules": "^2.0",
diff --git a/composer.lock b/composer.lock
index 382719a..1883156 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
         "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
         "This file is @generated automatically"
     ],
-    "content-hash": "1c8b255e46f2edded27db7812fe8114e",
+    "content-hash": "153b29e08b44baf747ef0df3ef75331a",
     "packages": [
         {
             "name": "api-platform/core",
@@ -7802,6 +7802,56 @@
             },
             "time": "2026-07-04T14:30:18+00:00"
         },
+        {
+            "name": "pb30/phpstan-composer-analysis",
+            "version": "v1.1.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/pb30/phpstan-composer-analysis.git",
+                "reference": "845c20681e6309db74e9bf29629791510d34221b"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/pb30/phpstan-composer-analysis/zipball/845c20681e6309db74e9bf29629791510d34221b",
+                "reference": "845c20681e6309db74e9bf29629791510d34221b",
+                "shasum": ""
+            },
+            "require": {
+                "php": "~8.1|~8.2|~8.3|~8.4|~8.5",
+                "phpstan/phpstan": "^2.1.6",
+                "shipmonk/composer-dependency-analyser": "1.8.4"
+            },
+            "require-dev": {
+                "laravel/pint": "^1.20"
+            },
+            "type": "phpstan-extension",
+            "extra": {
+                "phpstan": {
+                    "includes": [
+                        "extension.neon"
+                    ]
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "ComposerAnalyzer\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "keywords": [
+                "dev",
+                "static analysis"
+            ],
+            "support": {
+                "issues": "https://github.com/pb30/phpstan-composer-analysis/issues",
+                "source": "https://github.com/pb30/phpstan-composer-analysis/tree/v1.1.0"
+            },
+            "time": "2025-11-28T03:38:38+00:00",
+            "published-time": "2025-11-28T03:40:09+00:00"
+        },
         {
             "name": "phar-io/manifest",
             "version": "2.0.4",
@@ -10326,6 +10376,73 @@
             ],
             "time": "2026-02-06T04:52:52+00:00"
         },
+        {
+            "name": "shipmonk/composer-dependency-analyser",
+            "version": "1.8.4",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/shipmonk-rnd/composer-dependency-analyser.git",
+                "reference": "975e5873b519d5180b1017a5dfb43d80781abd45"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/shipmonk-rnd/composer-dependency-analyser/zipball/975e5873b519d5180b1017a5dfb43d80781abd45",
+                "reference": "975e5873b519d5180b1017a5dfb43d80781abd45",
+                "shasum": ""
+            },
+            "require": {
+                "ext-json": "*",
+                "ext-tokenizer": "*",
+                "php": "^7.2 || ^8.0"
+            },
+            "require-dev": {
+                "editorconfig-checker/editorconfig-checker": "^10.7.0",
+                "ergebnis/composer-normalize": "^2.19.0",
+                "ext-dom": "*",
+                "ext-libxml": "*",
+                "phpcompatibility/php-compatibility": "^9.3.5",
+                "phpstan/phpstan": "^1.12.26",
+                "phpstan/phpstan-phpunit": "^1.4.2",
+                "phpstan/phpstan-strict-rules": "^1.6.2",
+                "phpunit/phpunit": "^8.5.42 || ^9.6.23",
+                "shipmonk/name-collision-detector": "^2.1.1",
+                "slevomat/coding-standard": "^8.15.0"
+            },
+            "bin": [
+                "bin/composer-dependency-analyser"
+            ],
+            "type": "library",
+            "autoload": {
+                "psr-4": {
+                    "ShipMonk\\ComposerDependencyAnalyser\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "description": "Fast detection of composer dependency issues (dead dependencies, shadow dependencies, misplaced dependencies)",
+            "keywords": [
+                "analyser",
+                "composer",
+                "composer dependency",
+                "dead code",
+                "dead dependency",
+                "detector",
+                "dev",
+                "misplaced dependency",
+                "shadow dependency",
+                "static analysis",
+                "unused code",
+                "unused dependency"
+            ],
+            "support": {
+                "issues": "https://github.com/shipmonk-rnd/composer-dependency-analyser/issues",
+                "source": "https://github.com/shipmonk-rnd/composer-dependency-analyser/tree/1.8.4"
+            },
+            "time": "2025-11-25T14:38:16+00:00",
+            "published-time": "2025-11-25T14:59:44+00:00"
+        },
         {
             "name": "staabm/side-effects-detector",
             "version": "1.0.5",
diff --git a/phpstan.dist.neon b/phpstan.dist.neon
index 695a209..d48207b 100644
--- a/phpstan.dist.neon
+++ b/phpstan.dist.neon
@@ -17,3 +17,10 @@ parameters:
         - identifier: missingType.iterableValue
         # The ID properties are set reflectively by API Platform.
         - '#Property App\\Api\\Dto\\[^\\]+::\$id is unused#'
+    # pb30/phpstan-composer-analysis: report packages used directly but only installed transitively ("shadow
+    # dependencies") and dev packages used in production code. Unused/misplaced checks are off: bundles and
+    # extensions are used through config, not class references, so they would all be false positives.
+    composerAnalysis:
+        ignoreAllUnusedDeps: true
+        ignoreAllProdDepsInDev: true
+        disableExtensionsAnalysis: true