diff --git a/nettle.cabal b/nettle.cabal
--- a/nettle.cabal
+++ b/nettle.cabal
@@ -1,6 +1,6 @@
 Cabal-Version:       2.0
 Name:                nettle
-Version:             0.4
+Version:             0.4.1
 Synopsis:            safe nettle binding
 Description:
   safe binding for the nettle (<http://www.lysator.liu.se/~nisse/nettle/nettle.html>) library.
@@ -30,7 +30,7 @@
   hs-source-dirs:    src
   Build-Depends:     base >= 4.9 && < 5
                    , bytestring >= 0.10.8 && < 0.13
-                   , crypton >= 1.1.0 && < 1.2
+                   , crypton >= 1.1.0 && < 2.1
                    , ram >= 0.20.1 && < 0.23
                    , tagged >= 0.8.5 && < 0.9
   Exposed-modules:   Crypto.Nettle.ChaChaPoly1305
@@ -66,7 +66,7 @@
   Main-Is:           Ciphers.hs
   Build-depends:     base >= 4.9 && < 5
                    , bytestring >= 0.10.8 && < 0.13
-                   , crypton >= 1.1.0 && < 1.2
+                   , crypton >= 1.1.0 && < 2.1
                    , ram >= 0.20.1 && < 0.23
                    , HUnit >= 1.6.0 && < 1.7
                    , QuickCheck >= 2 && < 3
diff --git a/src/Crypto/Nettle/Ciphers/Internal.hs b/src/Crypto/Nettle/Ciphers/Internal.hs
--- a/src/Crypto/Nettle/Ciphers/Internal.hs
+++ b/src/Crypto/Nettle/Ciphers/Internal.hs
@@ -124,12 +124,13 @@
 nettle_streamSetNonce :: NettleStreamCipher c => c -> B.ByteString -> Maybe c
 nettle_streamSetNonce c nonce = case nsc_setNonce `witness` c of
 	Nothing -> Nothing
-	Just setnonce -> let ctx' = copyScrubbedBytes (nc_ctx c) in
-		unsafeDupablePerformIO $
-		BA.withByteArray ctx' $ \ctxptr ->
-		withByteStringPtr nonce $ \noncelen nonceptr ->
-		setnonce ctxptr noncelen nonceptr >>
-		return (Just $ nc_Ctx ctx')
+	Just setnonce ->
+		unsafeDupablePerformIO $ do
+                        ctx' <- copyScrubbedBytesIO (nc_ctx c)
+                        BA.withByteArray ctx' $ \ctxptr ->
+                                withByteStringPtr nonce $ \noncelen nonceptr ->
+                                setnonce ctxptr noncelen nonceptr >>
+                                return (Just $ nc_Ctx ctx')
 
 nettle_blockedStreamCombine :: (NettleBlockedStreamCipher c, BA.ByteArray bin, BA.ByteArray bout) => c -> bin -> (bout, c)
 nettle_blockedStreamCombine c indata = if BA.length indata == 0 then (BA.convert indata, c) else
@@ -154,12 +155,13 @@
 nettle_blockedStreamSetNonce :: NettleBlockedStreamCipher c => c -> B.ByteString -> Maybe c
 nettle_blockedStreamSetNonce c nonce = case nbsc_setNonce `witness` c of
 	Nothing -> Nothing
-	Just setnonce -> let ctx' = copyScrubbedBytes (nc_ctx c) in
-		unsafeDupablePerformIO $
-		BA.withByteArray ctx' $ \ctxptr ->
-		withByteStringPtr nonce $ \noncelen nonceptr ->
-		setnonce ctxptr noncelen nonceptr >>
-		return (Just $ nc_Ctx ctx')
+	Just setnonce ->
+		unsafeDupablePerformIO $ do
+                        ctx' <- copyScrubbedBytesIO (nc_ctx c)
+                        BA.withByteArray ctx' $ \ctxptr ->
+                                withByteStringPtr nonce $ \noncelen nonceptr ->
+                                setnonce ctxptr noncelen nonceptr >>
+                                return (Just $ nc_Ctx ctx')
 
 
 nettle_gcm_aeadInit              :: (NettleBlockCipher c, NettleAeadModeImpl c NettleGCM, BA.ByteArrayAccess iv) => c -> iv -> CryptoFailable (CCT.AEAD c)
@@ -305,10 +307,11 @@
 	    BA.ByteArray bout)
 	=> NettleCryptFunc
 	-> BA.ScrubbedBytes -> bin -> (bout, BA.ScrubbedBytes)
-stream_crypt crypt ctx indata = let ctx' = copyScrubbedBytes ctx in
-	unsafeDupablePerformIO $
-	BA.withByteArray ctx' $ \ctxptr ->
-	BA.withByteArray indata $ \indataptr -> do
-	outdata <- BA.create (BA.length indata) $ \outptr ->
-		crypt ctxptr (fromIntegral $ BA.length indata) outptr indataptr
-	return (outdata, ctx')
+stream_crypt crypt ctx indata =
+	unsafeDupablePerformIO $ do
+                ctx' <- copyScrubbedBytesIO ctx
+                BA.withByteArray ctx' $ \ctxptr ->
+                        BA.withByteArray indata $ \indataptr -> do
+                                outdata <- BA.create (BA.length indata) $ \outptr ->
+                                        crypt ctxptr (fromIntegral $ BA.length indata) outptr indataptr
+                                return (outdata, ctx')
diff --git a/src/Nettle/Utils.hs b/src/Nettle/Utils.hs
--- a/src/Nettle/Utils.hs
+++ b/src/Nettle/Utils.hs
@@ -24,6 +24,7 @@
 	, unsafeDupablePerformIO
 	, withByteStringPtr
 	, copyScrubbedBytes
+	, copyScrubbedBytesIO
 	, copyAndConvertToScrubbedBytes
 	, createScrubbedBytes
 	, concatToScrubbedBytes
@@ -61,6 +62,13 @@
 -}
 copyScrubbedBytes :: BA.ScrubbedBytes -> BA.ScrubbedBytes
 copyScrubbedBytes ba = BA.copyAndFreeze ba (\_ -> return ())
+
+{-|
+Copy a 'BA.ScrubbedBytes' IO-ly.
+-}
+copyScrubbedBytesIO :: BA.ScrubbedBytes -> IO BA.ScrubbedBytes
+copyScrubbedBytesIO ba = BA.create (BA.length ba) $ \dptr ->
+        BA.withByteArray ba $ \sptr -> copyBytes dptr sptr (BA.length ba)
 
 {-|
 Make a copy of a 'BA.ByteArrayAccess' that gets scrubbed.