diff --git a/Cargo.lock b/Cargo.lock
index 517f9382e..b4217db4c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1111,7 +1111,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "961b955a666e25ee5a1091d219128d6e6401e3dab84efb1a2bf6b4035d797b39"
 dependencies = [
  "crmf",
- "der",
+ "der 0.7.10",
  "spki",
  "x509-cert",
 ]
@@ -1123,7 +1123,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7b77c319abfd5219629c45c34c89ba945ed3c5e49fcde9d16b6c3885f118a730"
 dependencies = [
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "spki",
  "x509-cert",
 ]
@@ -1284,7 +1284,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "36fe21b96d5b87f5de4b5b7202ec41c00110ac817ce6728fe75fb2fe5962ed92"
 dependencies = [
  "cms",
- "der",
+ "der 0.7.10",
  "spki",
  "x509-cert",
 ]
@@ -1427,6 +1427,12 @@ dependencies = [
  "zeroize",
 ]
 
+[[package]]
+name = "der"
+version = "0.8.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a69dedd701da44b0536442edf09c81a64b0ab97a7a4a5e3d1971f00027cbc63d"
+
 [[package]]
 name = "der-parser"
 version = "10.0.0"
@@ -2695,7 +2701,7 @@ dependencies = [
 name = "nono"
 version = "0.69.0"
 dependencies = [
- "der",
+ "der 0.8.1",
  "getrandom 0.4.3",
  "globset",
  "ignore",
@@ -4095,7 +4101,7 @@ dependencies = [
  "aws-lc-rs",
  "base64",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
  "pem",
  "rand_core 0.9.5",
@@ -4117,7 +4123,7 @@ dependencies = [
  "aws-lc-rs",
  "base64",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "digest 0.10.7",
  "pem",
  "rand_core 0.9.5",
@@ -4300,7 +4306,7 @@ dependencies = [
  "cmpv2",
  "cms",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "hex",
  "jiff",
  "rand 0.9.5",
@@ -4326,7 +4332,7 @@ dependencies = [
  "cmpv2",
  "cms",
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "hex",
  "jiff",
  "rand 0.9.5",
@@ -4507,7 +4513,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der",
+ "der 0.7.10",
 ]
 
 [[package]]
@@ -5741,7 +5747,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1301e935010a701ae5f8655edc0ad17c44bad3ac5ce8c39185f75453b720ae94"
 dependencies = [
  "const-oid 0.9.6",
- "der",
+ "der 0.7.10",
  "sha1",
  "signature",
  "spki",
@@ -5774,7 +5780,7 @@ checksum = "f5ceece934a21607055b7ac5c25adb56a2ff559804b10705dc674d1d838c15e1"
 dependencies = [
  "cmpv2",
  "cms",
- "der",
+ "der 0.7.10",
 ]
 
 [[package]]
diff --git a/crates/nono/Cargo.toml b/crates/nono/Cargo.toml
index e486e53b8..76925f334 100644
--- a/crates/nono/Cargo.toml
+++ b/crates/nono/Cargo.toml
@@ -53,7 +53,7 @@ keyring = { version = "3", optional = true, default-features = false }
 sigstore-verify = { version = "0.9.0", default-features = false }
 sigstore-trust-root = "=0.11.0"
 x509-cert = { version = "0.2", default-features = false }
-der = { version = "0.7", default-features = false }
+der = { version = "0.8", default-features = false }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 landlock.workspace = true