diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,9 @@
+keysafe (0.20180326) unstable; urgency=medium
+
+  * Updated to argon2-1.3.
+
+ -- Joey Hess <id@joeyh.name>  Mon, 26 Mar 2018 08:12:00 -0400
+
 keysafe (0.20170811) unstable; urgency=medium
 
   * Updated to http-client 0.5.3, servant 0.11, and stackage lts-9.0.
diff --git a/ExpensiveHash.hs b/ExpensiveHash.hs
--- a/ExpensiveHash.hs
+++ b/ExpensiveHash.hs
@@ -11,6 +11,7 @@
 import Cost
 import Serialization ()
 import qualified Data.Text as T
+import Data.Text.Short (toText)
 import qualified Data.ByteString as B
 import qualified Crypto.Argon2 as Argon2
 import Raaz.Core.Encode
@@ -31,12 +32,10 @@
 
 expensiveHash :: Encodable t => ExpensiveHashTunable -> Salt t -> B.ByteString -> ExpensiveHash
 expensiveHash (UseArgon2 cost opts) (Salt s) b = ExpensiveHash cost $
-	-- Using hashEncoded here and not hash,
-	-- because of this bug:
-	-- https://github.com/ocharles/argon2/issues/3
-	Argon2.hashEncoded opts b argonsalt
+	either hashfailed toText $ Argon2.hashEncoded opts b argonsalt
   where
 	-- argon salt cannot be shorter than 8 bytes, so pad with spaces.
 	argonsalt = 
 		let sb = toByteString s
 		in sb <> B.replicate (8 - B.length sb ) 32
+	hashfailed e = error ("hash generation failed: " ++ show e)
diff --git a/Tunables.hs b/Tunables.hs
--- a/Tunables.hs
+++ b/Tunables.hs
@@ -112,6 +112,8 @@
 			let Divisibility n = d
 			in fromIntegral n
 		, Argon2.hashVariant = Argon2.Argon2i
+		, Argon2.hashVersion = Argon2.Argon2Version13
+		, Argon2.hashLength = 64
 		}
 	d = Divisibility 4 -- argon2 uses 4 threads
 
@@ -156,6 +158,8 @@
 			, Argon2.hashMemory = 1000
 			, Argon2.hashParallelism = 4
 			, Argon2.hashVariant = Argon2.Argon2i
+			, Argon2.hashVersion = Argon2.Argon2Version13
+			, Argon2.hashLength = 64
 			}
   where
 	nits = 20 + addits
diff --git a/keysafe.cabal b/keysafe.cabal
--- a/keysafe.cabal
+++ b/keysafe.cabal
@@ -1,5 +1,5 @@
 Name: keysafe
-Version: 0.20170811
+Version: 0.20180326
 Cabal-Version: >= 1.8
 Maintainer: Joey Hess <joey@kitenet.net>
 Author: Joey Hess
@@ -36,11 +36,12 @@
     -- changes to these could break backup/restore, so when loosening
     -- the version ranges, it's important to run keysafe --test
       secret-sharing == 1.0.*
-    , argon2 == 1.2.*
+    , argon2 == 1.3.*
     , raaz == 0.1.1
     , base (>= 4.5 && < 5.0)
     , bytestring == 0.10.*
     , text == 1.2.*
+    , text-short == 0.1.*
     -- Changes to these dependencies should not impact the data that
     -- keysafe backs up and restores.
     , deepseq == 1.4.*