diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.3.2 (2026-11-13)
+
+* Dependencies:
+  - Require `ppad-secp256k1 >= 0.5.11`, whose BIP-340 signing and
+    verification hash the message without copying it (it needs
+    `ppad-sha256 >= 0.3.7`). With a 128 MiB message, peak memory for
+    `verify` falls from about 268 MB to the size of the message
+
 ## 0.3.1 (2026-11-13)
 
 * Performance:
diff --git a/README.md b/README.md
--- a/README.md
+++ b/README.md
@@ -190,10 +190,9 @@
 through `secKeyToBytes`, and a secret nonce only through the `Unsafe`
 module.
 
-Messages can be any length, as BIP-327 allows. Nonce generation and signing
-hash long messages without copying them, but `verify` (BIP-340 verification
-in `ppad-secp256k1`) copies the message once more, so cap the size of
-messages from untrusted parties.
+Messages can be any length, as BIP-327 allows. They are hashed without
+being copied, but are held in memory whole, so cap the size of messages from
+untrusted parties.
 
 The test suite runs the official [BIP-0327][bip327] test vectors, loaded
 from the upstream JSON files, with exact-output assertions; invalid-encoding
diff --git a/lib/Crypto/Curve/Secp256k1/MuSig2.hs b/lib/Crypto/Curve/Secp256k1/MuSig2.hs
--- a/lib/Crypto/Curve/Secp256k1/MuSig2.hs
+++ b/lib/Crypto/Curve/Secp256k1/MuSig2.hs
@@ -61,10 +61,8 @@
   checks its own result.
 
 * __Bound the size of untrusted messages.__ BIP-327 allows messages of any
-  length, and every function that takes one holds it in memory whole.
-  'nonceGen', 'newSession' and 'deterministicSign' hash long messages and
-  extra inputs without copying them, but 'verify' (BIP-340 verification in
-  @ppad-secp256k1@) copies the message once more. If messages come from
+  length. No function copies a long message or extra input to hash it, but
+  each one holds the whole message in memory, so if messages come from
   untrusted parties, cap their size before passing them in.
 
 * __Constant-time arithmetic on secrets.__ Secret keys and nonces are never
diff --git a/musig2.cabal b/musig2.cabal
--- a/musig2.cabal
+++ b/musig2.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               musig2
-version:            0.3.1
+version:            0.3.2
 synopsis:           MuSig2 library
 license:            MIT
 license-file:       LICENSE
@@ -55,7 +55,7 @@
     , deepseq         >=1.4     && <1.7
     , entropy         >=0.4.1.6 && <0.5
     , ppad-fixed      >=0.2.2   && <0.3
-    , ppad-secp256k1  >=0.5.10  && <0.6
+    , ppad-secp256k1  >=0.5.11  && <0.6
     , ppad-sha256     >=0.3.5   && <0.4
 
 -- The implementation modules are other-modules here (not a dependency on the