diff --git a/hoauth2.cabal b/hoauth2.cabal
--- a/hoauth2.cabal
+++ b/hoauth2.cabal
@@ -2,7 +2,7 @@
 name:               hoauth2
 
 -- http://wiki.haskell.org/Package_versioning_policy
-version:            2.11.0
+version:            2.12.0
 synopsis:           Haskell OAuth2 authentication client
 description:
   This is Haskell binding of OAuth2 Authorization framework and Bearer Token Usage framework.
@@ -66,7 +66,7 @@
   build-depends:
     , aeson                 >=2.0    && <2.3
     , base                  >=4.11   && <5
-    , base64                ^>=0.4
+    , base64                >=1.0    && <1.1
     , binary                >=0.8    && <0.11
     , bytestring            >=0.9    && <0.13
     , containers            >=0.6    && <0.8
diff --git a/src/Network/OAuth2/Experiment/Pkce.hs b/src/Network/OAuth2/Experiment/Pkce.hs
--- a/src/Network/OAuth2/Experiment/Pkce.hs
+++ b/src/Network/OAuth2/Experiment/Pkce.hs
@@ -9,6 +9,7 @@
 import Control.Monad.IO.Class
 import Crypto.Hash qualified as H
 import Crypto.Random qualified as Crypto
+import Data.Base64.Types qualified as B64
 import Data.ByteArray qualified as ByteArray
 import Data.ByteString qualified as BS
 import Data.ByteString.Base64.URL qualified as B64
@@ -42,7 +43,7 @@
       }
 
 encodeCodeVerifier :: BS.ByteString -> Text
-encodeCodeVerifier = B64.encodeBase64Unpadded . BS.pack . ByteArray.unpack . hashSHA256
+encodeCodeVerifier = B64.extractBase64 . B64.encodeBase64Unpadded . BS.pack . ByteArray.unpack . hashSHA256
 
 genCodeVerifier :: MonadIO m => m BS.ByteString
 genCodeVerifier = liftIO $ getBytesInternal BS.empty