diff --git a/Codec/Encryption/OpenPGP/BlockCipher.hs b/Codec/Encryption/OpenPGP/BlockCipher.hs
--- a/Codec/Encryption/OpenPGP/BlockCipher.hs
+++ b/Codec/Encryption/OpenPGP/BlockCipher.hs
@@ -2,6 +2,7 @@
 -- Copyright © 2013-2026  Clint Adams
 -- This software is released under the terms of the Expat license.
 -- (See the LICENSE file).
+{-# LANGUAGE CPP #-}
 {-# LANGUAGE RankNTypes #-}
 
 module Codec.Encryption.OpenPGP.BlockCipher
@@ -18,14 +19,20 @@
 import qualified Crypto.Nettle.Ciphers as CNC
 import qualified Data.ByteString as B
 
-import Codec.Encryption.OpenPGP.Internal.CryptoCipherTypes
-    ( HOWrappedOldCCT (..)
-    )
 import Codec.Encryption.OpenPGP.Internal.Crypton
     ( HOWrappedCCT (..)
     )
+#if !MIN_VERSION_nettle(0,4,0)
+import Codec.Encryption.OpenPGP.Internal.CryptoCipherTypes
+    ( HOWrappedOldCCT (..)
+    )
+#endif
 import Codec.Encryption.OpenPGP.Internal.HOBlockCipher
 import Codec.Encryption.OpenPGP.Types
+
+#if MIN_VERSION_nettle(0,4,0)
+type HOWrappedOldCCT a = HOWrappedCCT a
+#endif
 
 type HOCipher a =
     forall cipher
diff --git a/Codec/Encryption/OpenPGP/Internal/Crypton.hs b/Codec/Encryption/OpenPGP/Internal/Crypton.hs
--- a/Codec/Encryption/OpenPGP/Internal/Crypton.hs
+++ b/Codec/Encryption/OpenPGP/Internal/Crypton.hs
@@ -39,6 +39,20 @@
         hammerIV iv >>= \i -> return (CCT.cfbEncrypt c i bs)
     cfbDecrypt (HWCCT c) iv bs =
         hammerIV iv >>= \i -> return (CCT.cfbDecrypt c i bs)
+    paddedCfbDecrypt (HWCCT cipher) iv ciphertext =
+        hammerIV iv >>= \i ->
+            return
+                (B.take (B.length ciphertext) (CCT.cfbDecrypt cipher i padded))
+      where
+        padded =
+            ciphertext
+                `B.append` B.pack
+                    ( replicate
+                        ( CCT.blockSize cipher
+                            - (B.length ciphertext `mod` CCT.blockSize cipher)
+                        )
+                        0
+                    )
     aeadInit mode (HWCCT c) iv =
         fmap
             (\(CCT.AEAD impl st) -> CCT.AEAD impl st)
diff --git a/hOpenPGP.cabal b/hOpenPGP.cabal
--- a/hOpenPGP.cabal
+++ b/hOpenPGP.cabal
@@ -1,6 +1,6 @@
 Cabal-version:       3.4
 Name:                hOpenPGP
-Version:             3.7.3
+Version:             3.7.4
 Synopsis:            native Haskell implementation of OpenPGP (RFC9580)
 Description:         native Haskell implementation of OpenPGP (RFC9580), with some backwards compatibility
 Homepage:            https://salsa.debian.org/clint/hOpenPGP
@@ -194,14 +194,12 @@
                , conduit               >= 1.3.0
                , conduit-extra         >= 1.1
                , containers            >= 0.6.0.1
-               , crypto-cipher-types
                , errors
                , hashable              >= 1.3.4   && <1.6
                , incremental-parser    >= 0.5.1
                , ixset-typed
                , lens                  >= 3.0
                , monad-loops           >= 0.4
-               , nettle                >= 0.3     && < 0.4
                , network-uri           >= 2.6
                , prettyprinter         >= 1.7.0
                , resourcet             >= 0.4
@@ -214,9 +212,9 @@
                , unordered-containers
                , zlib
   if flag(use-memory)
-    build-depends: crypton < 1.1.0, memory
+    build-depends: crypton < 1.1.0, memory, crypto-cipher-types, nettle >= 0.3 && < 0.4
   else
-    build-depends: crypton >= 1.1.0, ram
+    build-depends: crypton >= 1.1.0, ram, nettle >= 0.4 && < 0.5
 
 common publicmods
   other-modules:       Codec.Encryption.OpenPGP.Types
@@ -251,7 +249,6 @@
 
 common internalmods
   other-modules:       Codec.Encryption.OpenPGP.Internal
-                     , Codec.Encryption.OpenPGP.Internal.CryptoCipherTypes
                      , Codec.Encryption.OpenPGP.Internal.CryptoECDH
                      , Codec.Encryption.OpenPGP.Internal.Crypton
                      , Codec.Encryption.OpenPGP.Internal.HOBlockCipher
@@ -268,6 +265,8 @@
                      , Codec.Encryption.OpenPGP.BlockCipher
                      , Codec.Encryption.OpenPGP.SerializeForSigs
                      , Paths_hOpenPGP
+  if flag(use-memory)
+    other-modules: Codec.Encryption.OpenPGP.Internal.CryptoCipherTypes
   autogen-modules:     Paths_hOpenPGP
 
 Library
@@ -347,4 +346,4 @@
 source-repository this
   type:     git
   location: https://salsa.debian.org/clint/hOpenPGP.git
-  tag:      v3.7.3
+  tag:      v3.7.4