diff --git a/hOpenPGP.cabal b/hOpenPGP.cabal
--- a/hOpenPGP.cabal
+++ b/hOpenPGP.cabal
@@ -1,6 +1,6 @@
 Cabal-version:       3.4
 Name:                hOpenPGP
-Version:             3.0.2
+Version:             3.0.2.1
 Synopsis:            native Haskell implementation of OpenPGP (RFC9580)
 Description:         native Haskell implementation of OpenPGP (RFC9580), with some backwards compatibility
 Homepage:            https://salsa.debian.org/clint/hOpenPGP
@@ -332,4 +332,4 @@
 source-repository this
   type:     git
   location: https://salsa.debian.org/clint/hOpenPGP.git
-  tag:      v3.0.2
+  tag:      v3.0.2.1
diff --git a/tests/Tests/Encryption.hs b/tests/Tests/Encryption.hs
--- a/tests/Tests/Encryption.hs
+++ b/tests/Tests/Encryption.hs
@@ -98,6 +98,7 @@
 import qualified Crypto.PubKey.ECC.ECDSA as ECDSA
 import qualified Crypto.PubKey.ECC.Generate as ECCGen
 import qualified Crypto.PubKey.ECC.Types as ECCT
+import Crypto.PubKey.ECC.Prim (pointBaseMul)
 import qualified Crypto.PubKey.RSA.PKCS15 as P15
 import qualified Crypto.PubKey.RSA as RSA
 import Data.Binary.Get
@@ -236,6 +237,18 @@
   , ("strict policy AES256 iterated-salted S2K SEIPDv1", "encryption-sym-aes256.gpg", "symmetric-password.txt", "test\n")
   ]
 
+mkSyntheticNISTP256 :: B.ByteString -> (ECDSA.PublicKey, ECDSA.PrivateKey)
+mkSyntheticNISTP256 bs =
+  let curve = ECCT.getCurveByName ECCT.SEC_p256r1
+      d = os2ip (B.pack [1 .. 32])
+      q = pointBaseMul curve d
+      pub = ECDSA.PublicKey curve q
+      priv = ECDSA.PrivateKey curve d
+  in (pub, priv)
+
+syntheticNISTP256Low = mkSyntheticNISTP256 $ B.pack [1 .. 32]
+syntheticNISTP256High = mkSyntheticNISTP256 $ B.pack [101 .. 132]
+
 encryptionAndCompressionTests :: TestTree
 encryptionAndCompressionTests =
   testGroup
@@ -1575,8 +1588,8 @@
 
 testBuildPKESKv3PayloadForRecipientECDHInterop :: Assertion
 testBuildPKESKv3PayloadForRecipientECDHInterop = do
-  (recipientPub, recipientPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  let recipient =
+  let (recipientPub, recipientPriv) = syntheticNISTP256Low
+      recipient =
         PKPayload
           V4
           (ThirtyTwoBitTimeStamp 0)
@@ -1631,8 +1644,8 @@
 -- old double-MPI encoding that caused interoperability failures.
 testPKESKv3ECDHWireFormat :: Assertion
 testPKESKv3ECDHWireFormat = do
-  (recipientPub, _) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  let recipient =
+  let (recipientPub, _) = syntheticNISTP256Low
+      recipient =
         PKPayload
           V4
           (ThirtyTwoBitTimeStamp 0)
@@ -2947,8 +2960,8 @@
 
 testBuildPKESKPayloadRejectsECDHSHA1 :: Assertion
 testBuildPKESKPayloadRejectsECDHSHA1 = do
-  (recipientPub, _) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  let recipient =
+  let (recipientPub, _) = syntheticNISTP256Low
+      recipient =
         PKPayload
           V4
           (ThirtyTwoBitTimeStamp 0)
@@ -3445,9 +3458,9 @@
 
 testConduitDecryptSEIPDv2WithPKESKECDHUnwrap :: Assertion
 testConduitDecryptSEIPDv2WithPKESKECDHUnwrap = do
-  (recipientPub, recipientPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  (ephPub, ephPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  let recipientPKP =
+  let (recipientPub, recipientPriv) = syntheticNISTP256Low
+      (ephPub, ephPriv) = syntheticNISTP256High
+      recipientPKP =
         PKPayload
           V4
           (ThirtyTwoBitTimeStamp 0)
@@ -3513,9 +3526,9 @@
 
 testConduitDecryptSEIPDv2RejectsECDHWrongEphemeralPointLength :: Assertion
 testConduitDecryptSEIPDv2RejectsECDHWrongEphemeralPointLength = do
-  (recipientPub, recipientPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  (ephPub, ephPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  let recipientPKP =
+  let (recipientPub, recipientPriv) = syntheticNISTP256Low
+      (ephPub, ephPriv) = syntheticNISTP256High
+      recipientPKP =
         PKPayload
           V4
           (ThirtyTwoBitTimeStamp 0)
@@ -4290,7 +4303,7 @@
              (EightOctetKeyId "\x12\x34\x56\x78\x90\xab\xcd\xef")
              X25519
              (MPI (os2ip ephPublicRaw) :| [MPI (os2ip eskWithAlgo)])))
-      skeskS2K = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 21
+      skeskS2K = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 15
       skeskPassphrase = "correct horse battery staple"
       wrongPassphrase = "wrong passphrase"
       salt = Salt (B.pack [0x00 .. 0x1f])
@@ -4349,7 +4362,7 @@
 
 testConduitDecryptSEIPDv2FallsBackToEarlierArgon2SKESK :: Assertion
 testConduitDecryptSEIPDv2FallsBackToEarlierArgon2SKESK = do
-  let skeskS2K = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 21
+  let skeskS2K = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 15
       passphrase = "password"
       sessionKeyBytes = B.replicate 32 0x7b
       sessionKey = SessionKey sessionKeyBytes
@@ -4407,9 +4420,9 @@
 
 testConduitDecryptSEIPDv2RejectsECDHNonTable30Params :: Assertion
 testConduitDecryptSEIPDv2RejectsECDHNonTable30Params = do
-  (recipientPub, recipientPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  (ephPub, ephPriv) <- ECCGen.generate (ECCT.getCurveByName ECCT.SEC_p256r1)
-  let recipientPKP =
+  let (recipientPub, recipientPriv) = syntheticNISTP256Low
+      (ephPub, ephPriv) = syntheticNISTP256High
+      recipientPKP =
         PKPayload
           V4
           (ThirtyTwoBitTimeStamp 0)
@@ -4924,7 +4937,7 @@
   mapM_ assertRoundTrip [AES128, AES192, AES256]
   where
     passphrase = "password"
-    s2k = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 21
+    s2k = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 15
     assertRoundTrip sa = do
       keyLen <-
         case keySize sa of
@@ -4962,7 +4975,7 @@
 testSKESK4Argon2EncryptedSessionKeyRejectsTrailingChecksum = do
   let sa = AES128
       passphrase = "password"
-      s2k = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 21
+      s2k = Argon2 (Salt16 (B.pack [0x00 .. 0x0f])) 1 4 15
       sessionKey = B.pack (take 16 (cycle [0xaa, 0xbb, 0xcc, 0xdd]))
   keyLen <-
     case keySize sa of