diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # Changelog for pantry
 
+## v0.11.0
+
+* Update `defaultHackageSecurityConfig` for changes in Hackage's `root.json`
+  file of the keys of the Hackage root key holders.
+
 ## v0.10.1
 
 * Expose new `parseRawPackageLocationImmutables`.
@@ -53,7 +58,8 @@
 * Remove module `Pantry.Internal.StaticBytes` and depend on `static-bytes`
   package.
 * Remove module `Pantry.Internal`, previously exposed only for testing.
-* Update Hackage bootstrap root key set.
+* Update `defaultHackageSecurityConfig` for changes in Hackage's `root.json`
+  file of the keys of the Hackage root key holders.
 
 ## v0.8.3
 
diff --git a/int/Pantry/Types.hs b/int/Pantry/Types.hs
--- a/int/Pantry/Types.hs
+++ b/int/Pantry/Types.hs
@@ -782,10 +782,10 @@
         "0a5c7ea47cd1b15f01f5f51a33adda7e655bc0f0b0615baa8e271f4c3351e21d"
       , -- Norman Ramsey (ZI8di3a9Un0s2RBrt5GwVRvfOXVuywADfXGPZfkiDb0=)
         "51f0161b906011b52c6613376b1ae937670da69322113a246a09f807c62f6921"
-      , -- Mathieu Boespflug (ydN1nGGQ79K1Q0nN+ul+Ln8MxikTB95w0YdGd3v3kmg=)
-        "be75553f3c7ba1dbe298da81f1d1b05c9d39dd8ed2616c9bddf1525ca8c03e48"
       , -- Joachim Breitner (5iUgwqZCWrCJktqMx0bBMIuoIyT4A1RYGozzchRN9rA=)
         "d26e46f3b631aae1433b89379a6c68bd417eb5d1c408f0643dcc07757fece522"
+      , -- Tikhon Jelvis (06nM6r1kOYt49YE5e1+j8VKiiYUFjFQ6HrOpPZu+fDE=)
+        "c7de58fc6a224b92b5b513f26fbb8b370f2d97c7cfe0075a951314a55734be93"
       ]
   , hscKeyThreshold = 3
   , hscIgnoreExpiry = True
diff --git a/pantry.cabal b/pantry.cabal
--- a/pantry.cabal
+++ b/pantry.cabal
@@ -1,355 +1,355 @@
 cabal-version: 2.0
-
--- This file has been generated from package.yaml by hpack version 0.38.1.
---
--- see: https://github.com/sol/hpack
-
-name:           pantry
-version:        0.10.1
-synopsis:       Content addressable Haskell package management
-description:    Please see the README on GitHub at <https://github.com/commercialhaskell/pantry#readme>
-category:       Development
-homepage:       https://github.com/commercialhaskell/pantry#readme
-bug-reports:    https://github.com/commercialhaskell/pantry/issues
-author:         Michael Snoyman
-maintainer:     michael@snoyman.com
-copyright:      2018-2022 FP Complete
-license:        BSD3
-license-file:   LICENSE
-build-type:     Simple
-extra-source-files:
-    CONTRIBUTING.md
-    README.md
-    ChangeLog.md
-    attic/hpack-0.1.2.3.tar.gz
-    attic/package-0.1.2.3.tar.gz
-    attic/symlink-to-dir.tar.gz
-
-source-repository head
-  type: git
-  location: https://github.com/commercialhaskell/pantry
-
-flag test-pretty-exceptions
-  description: Build an executable to test pretty exceptions
-  manual: False
-  default: False
-
-library
-  exposed-modules:
-      Pantry
-      Pantry.SQLite
-      Pantry.Internal.Stackage
-  other-modules:
-      Hackage.Security.Client.Repository.HttpLib.HttpClient
-      Pantry.Archive
-      Pantry.HTTP
-      Pantry.Hackage
-      Pantry.Repo
-      Pantry.Storage
-      Pantry.Casa
-      Pantry.Tree
-  reexported-modules:
-      Pantry.SHA256
-  hs-source-dirs:
-      src/
-  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
-  build-depends:
-      Cabal >=3 && <3.15
-    , aeson
-    , aeson-warning-parser >=0.1.1
-    , ansi-terminal
-    , base >=4.13 && <5
-    , bytestring
-    , casa-client >=0.0.2
-    , casa-types
-    , companion
-    , conduit
-    , conduit-extra
-    , containers
-    , crypton
-    , crypton-conduit
-    , digest
-    , filelock
-    , generic-deriving
-    , hackage-security
-    , hpack >=0.35.3
-    , http-client
-    , http-client-tls >=0.3.6.2
-    , http-conduit
-    , http-download >=0.2.1.0
-    , http-types
-    , internal
-    , memory
-    , mtl
-    , network-uri
-    , path
-    , path-io
-    , persistent
-    , persistent-sqlite >=2.9.3
-    , persistent-template
-    , primitive
-    , resourcet
-    , rio
-    , rio-orphans
-    , rio-prettyprint >=0.1.7.0
-    , static-bytes >=0.1.1
-    , tar-conduit >=0.4.1
-    , text
-    , text-metrics
-    , time
-    , transformers
-    , unix-compat
-    , unliftio
-    , unordered-containers
-    , vector
-    , yaml
-    , zip-archive
-  default-language: Haskell2010
-  if impl(ghc >= 9.4.5) && os(windows)
-    build-depends:
-        network >=3.1.2.9
-  if os(windows)
-    other-modules:
-        System.IsWindows
-    hs-source-dirs:
-        src/windows/
-  else
-    other-modules:
-        System.IsWindows
-    hs-source-dirs:
-        src/unix/
-
-library internal
-  exposed-modules:
-      Pantry.HPack
-      Pantry.Internal
-      Pantry.SHA256
-      Pantry.Types
-  other-modules:
-      Paths_pantry
-  autogen-modules:
-      Paths_pantry
-  hs-source-dirs:
-      int/
-  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
-  build-depends:
-      Cabal >=3 && <3.15
-    , aeson
-    , aeson-warning-parser >=0.1.1
-    , ansi-terminal
-    , base >=4.13 && <5
-    , bytestring
-    , casa-client >=0.0.2
-    , casa-types
-    , companion
-    , conduit
-    , conduit-extra
-    , containers
-    , crypton
-    , crypton-conduit
-    , digest
-    , filelock
-    , generic-deriving
-    , hackage-security
-    , hpack >=0.35.3
-    , http-client
-    , http-client-tls >=0.3.6.2
-    , http-conduit
-    , http-download >=0.2.1.0
-    , http-types
-    , memory
-    , mtl
-    , network-uri
-    , path
-    , path-io
-    , persistent
-    , persistent-sqlite >=2.9.3
-    , persistent-template
-    , primitive
-    , resourcet
-    , rio
-    , rio-orphans
-    , rio-prettyprint >=0.1.7.0
-    , static-bytes >=0.1.1
-    , tar-conduit >=0.4.1
-    , text
-    , text-metrics
-    , time
-    , transformers
-    , unix-compat
-    , unliftio
-    , unordered-containers
-    , vector
-    , yaml
-    , zip-archive
-  default-language: Haskell2010
-  if impl(ghc >= 9.4.5) && os(windows)
-    build-depends:
-        network >=3.1.2.9
-
-executable test-pretty-exceptions
-  main-is: Main.hs
-  other-modules:
-      Paths_pantry
-  autogen-modules:
-      Paths_pantry
-  hs-source-dirs:
-      app/test-pretty-exceptions
-  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
-  build-depends:
-      Cabal >=3 && <3.15
-    , aeson
-    , aeson-warning-parser >=0.1.1
-    , ansi-terminal
-    , base >=4.13 && <5
-    , bytestring
-    , casa-client >=0.0.2
-    , casa-types
-    , companion
-    , conduit
-    , conduit-extra
-    , containers
-    , crypton
-    , crypton-conduit
-    , digest
-    , filelock
-    , generic-deriving
-    , hackage-security
-    , hpack >=0.35.3
-    , http-client
-    , http-client-tls >=0.3.6.2
-    , http-conduit
-    , http-download >=0.2.1.0
-    , http-types
-    , memory
-    , mtl
-    , network-uri
-    , optparse-applicative
-    , pantry
-    , path
-    , path-io
-    , persistent
-    , persistent-sqlite >=2.9.3
-    , persistent-template
-    , primitive
-    , resourcet
-    , rio
-    , rio-orphans
-    , rio-prettyprint >=0.1.7.0
-    , static-bytes >=0.1.1
-    , tar-conduit >=0.4.1
-    , text
-    , text-metrics
-    , time
-    , transformers
-    , unix-compat
-    , unliftio
-    , unordered-containers
-    , vector
-    , yaml
-    , zip-archive
-  default-language: Haskell2010
-  if impl(ghc >= 9.4.5) && os(windows)
-    build-depends:
-        network >=3.1.2.9
-  if !flag(test-pretty-exceptions)
-    buildable: False
-  if os(windows)
-    other-modules:
-        PathAbsExamples
-        System.Terminal
-    hs-source-dirs:
-        app/test-pretty-exceptions/windows/
-    build-depends:
-        Win32
-      , process
-  else
-    other-modules:
-        PathAbsExamples
-        System.Terminal
-    hs-source-dirs:
-        app/test-pretty-exceptions/unix/
-
-test-suite spec
-  type: exitcode-stdio-1.0
-  main-is: Spec.hs
-  other-modules:
-      Pantry.ArchiveSpec
-      Pantry.BuildPlanSpec
-      Pantry.CabalSpec
-      Pantry.CasaSpec
-      Pantry.FileSpec
-      Pantry.GlobalHintsSpec
-      Pantry.HackageSpec
-      Pantry.InternalSpec
-      Pantry.TreeSpec
-      Pantry.TypesSpec
-      Paths_pantry
-  autogen-modules:
-      Paths_pantry
-  hs-source-dirs:
-      test
-  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
-  build-tool-depends:
-      hspec-discover:hspec-discover
-  build-depends:
-      Cabal >=3 && <3.15
-    , QuickCheck
-    , aeson
-    , aeson-warning-parser >=0.1.1
-    , ansi-terminal
-    , base >=4.13 && <5
-    , bytestring
-    , casa-client >=0.0.2
-    , casa-types
-    , companion
-    , conduit
-    , conduit-extra
-    , containers
-    , crypton
-    , crypton-conduit
-    , digest
-    , exceptions
-    , filelock
-    , generic-deriving
-    , hackage-security
-    , hedgehog
-    , hpack >=0.35.3
-    , hspec
-    , http-client
-    , http-client-tls >=0.3.6.2
-    , http-conduit
-    , http-download >=0.2.1.0
-    , http-types
-    , internal
-    , memory
-    , mtl
-    , network-uri
-    , pantry
-    , path
-    , path-io
-    , persistent
-    , persistent-sqlite >=2.9.3
-    , persistent-template
-    , primitive
-    , raw-strings-qq
-    , resourcet
-    , rio
-    , rio-orphans
-    , rio-prettyprint >=0.1.7.0
-    , static-bytes >=0.1.1
-    , tar-conduit >=0.4.1
-    , text
-    , text-metrics
-    , time
-    , transformers
-    , unix-compat
-    , unliftio
-    , unordered-containers
-    , vector
-    , yaml
-    , zip-archive
-  default-language: Haskell2010
-  if impl(ghc >= 9.4.5) && os(windows)
-    build-depends:
-        network >=3.1.2.9
+
+-- This file has been generated from package.yaml by hpack version 0.38.1.
+--
+-- see: https://github.com/sol/hpack
+
+name:           pantry
+version:        0.11.0
+synopsis:       Content addressable Haskell package management
+description:    Please see the README on GitHub at <https://github.com/commercialhaskell/pantry#readme>
+category:       Development
+homepage:       https://github.com/commercialhaskell/pantry#readme
+bug-reports:    https://github.com/commercialhaskell/pantry/issues
+author:         Michael Snoyman
+maintainer:     michael@snoyman.com
+copyright:      2018-2022 FP Complete
+license:        BSD3
+license-file:   LICENSE
+build-type:     Simple
+extra-source-files:
+    CONTRIBUTING.md
+    README.md
+    ChangeLog.md
+    attic/hpack-0.1.2.3.tar.gz
+    attic/package-0.1.2.3.tar.gz
+    attic/symlink-to-dir.tar.gz
+
+source-repository head
+  type: git
+  location: https://github.com/commercialhaskell/pantry
+
+flag test-pretty-exceptions
+  description: Build an executable to test pretty exceptions
+  manual: False
+  default: False
+
+library
+  exposed-modules:
+      Pantry
+      Pantry.SQLite
+      Pantry.Internal.Stackage
+  other-modules:
+      Hackage.Security.Client.Repository.HttpLib.HttpClient
+      Pantry.Archive
+      Pantry.HTTP
+      Pantry.Hackage
+      Pantry.Repo
+      Pantry.Storage
+      Pantry.Casa
+      Pantry.Tree
+  reexported-modules:
+      Pantry.SHA256
+  hs-source-dirs:
+      src/
+  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
+  build-depends:
+      Cabal >=3 && <3.15
+    , aeson
+    , aeson-warning-parser >=0.1.1
+    , ansi-terminal
+    , base >=4.13 && <5
+    , bytestring
+    , casa-client >=0.0.2
+    , casa-types
+    , companion
+    , conduit
+    , conduit-extra
+    , containers
+    , crypton
+    , crypton-conduit
+    , digest
+    , filelock
+    , generic-deriving
+    , hackage-security
+    , hpack >=0.35.3
+    , http-client
+    , http-client-tls >=0.3.6.2
+    , http-conduit
+    , http-download >=0.2.1.0
+    , http-types
+    , internal
+    , memory
+    , mtl
+    , network-uri
+    , path
+    , path-io
+    , persistent
+    , persistent-sqlite >=2.9.3
+    , persistent-template
+    , primitive
+    , resourcet
+    , rio
+    , rio-orphans
+    , rio-prettyprint >=0.1.7.0
+    , static-bytes >=0.1.1
+    , tar-conduit >=0.4.1
+    , text
+    , text-metrics
+    , time
+    , transformers
+    , unix-compat
+    , unliftio
+    , unordered-containers
+    , vector
+    , yaml
+    , zip-archive
+  default-language: Haskell2010
+  if impl(ghc >= 9.4.5) && os(windows)
+    build-depends:
+        network >=3.1.2.9
+  if os(windows)
+    other-modules:
+        System.IsWindows
+    hs-source-dirs:
+        src/windows/
+  else
+    other-modules:
+        System.IsWindows
+    hs-source-dirs:
+        src/unix/
+
+library internal
+  exposed-modules:
+      Pantry.HPack
+      Pantry.Internal
+      Pantry.SHA256
+      Pantry.Types
+  other-modules:
+      Paths_pantry
+  autogen-modules:
+      Paths_pantry
+  hs-source-dirs:
+      int/
+  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
+  build-depends:
+      Cabal >=3 && <3.15
+    , aeson
+    , aeson-warning-parser >=0.1.1
+    , ansi-terminal
+    , base >=4.13 && <5
+    , bytestring
+    , casa-client >=0.0.2
+    , casa-types
+    , companion
+    , conduit
+    , conduit-extra
+    , containers
+    , crypton
+    , crypton-conduit
+    , digest
+    , filelock
+    , generic-deriving
+    , hackage-security
+    , hpack >=0.35.3
+    , http-client
+    , http-client-tls >=0.3.6.2
+    , http-conduit
+    , http-download >=0.2.1.0
+    , http-types
+    , memory
+    , mtl
+    , network-uri
+    , path
+    , path-io
+    , persistent
+    , persistent-sqlite >=2.9.3
+    , persistent-template
+    , primitive
+    , resourcet
+    , rio
+    , rio-orphans
+    , rio-prettyprint >=0.1.7.0
+    , static-bytes >=0.1.1
+    , tar-conduit >=0.4.1
+    , text
+    , text-metrics
+    , time
+    , transformers
+    , unix-compat
+    , unliftio
+    , unordered-containers
+    , vector
+    , yaml
+    , zip-archive
+  default-language: Haskell2010
+  if impl(ghc >= 9.4.5) && os(windows)
+    build-depends:
+        network >=3.1.2.9
+
+executable test-pretty-exceptions
+  main-is: Main.hs
+  other-modules:
+      Paths_pantry
+  autogen-modules:
+      Paths_pantry
+  hs-source-dirs:
+      app/test-pretty-exceptions
+  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
+  build-depends:
+      Cabal >=3 && <3.15
+    , aeson
+    , aeson-warning-parser >=0.1.1
+    , ansi-terminal
+    , base >=4.13 && <5
+    , bytestring
+    , casa-client >=0.0.2
+    , casa-types
+    , companion
+    , conduit
+    , conduit-extra
+    , containers
+    , crypton
+    , crypton-conduit
+    , digest
+    , filelock
+    , generic-deriving
+    , hackage-security
+    , hpack >=0.35.3
+    , http-client
+    , http-client-tls >=0.3.6.2
+    , http-conduit
+    , http-download >=0.2.1.0
+    , http-types
+    , memory
+    , mtl
+    , network-uri
+    , optparse-applicative
+    , pantry
+    , path
+    , path-io
+    , persistent
+    , persistent-sqlite >=2.9.3
+    , persistent-template
+    , primitive
+    , resourcet
+    , rio
+    , rio-orphans
+    , rio-prettyprint >=0.1.7.0
+    , static-bytes >=0.1.1
+    , tar-conduit >=0.4.1
+    , text
+    , text-metrics
+    , time
+    , transformers
+    , unix-compat
+    , unliftio
+    , unordered-containers
+    , vector
+    , yaml
+    , zip-archive
+  default-language: Haskell2010
+  if impl(ghc >= 9.4.5) && os(windows)
+    build-depends:
+        network >=3.1.2.9
+  if !flag(test-pretty-exceptions)
+    buildable: False
+  if os(windows)
+    other-modules:
+        PathAbsExamples
+        System.Terminal
+    hs-source-dirs:
+        app/test-pretty-exceptions/windows/
+    build-depends:
+        Win32
+      , process
+  else
+    other-modules:
+        PathAbsExamples
+        System.Terminal
+    hs-source-dirs:
+        app/test-pretty-exceptions/unix/
+
+test-suite spec
+  type: exitcode-stdio-1.0
+  main-is: Spec.hs
+  other-modules:
+      Pantry.ArchiveSpec
+      Pantry.BuildPlanSpec
+      Pantry.CabalSpec
+      Pantry.CasaSpec
+      Pantry.FileSpec
+      Pantry.GlobalHintsSpec
+      Pantry.HackageSpec
+      Pantry.InternalSpec
+      Pantry.TreeSpec
+      Pantry.TypesSpec
+      Paths_pantry
+  autogen-modules:
+      Paths_pantry
+  hs-source-dirs:
+      test
+  ghc-options: -fwrite-ide-info -hiedir=.hie -Wall
+  build-tool-depends:
+      hspec-discover:hspec-discover
+  build-depends:
+      Cabal >=3 && <3.15
+    , QuickCheck
+    , aeson
+    , aeson-warning-parser >=0.1.1
+    , ansi-terminal
+    , base >=4.13 && <5
+    , bytestring
+    , casa-client >=0.0.2
+    , casa-types
+    , companion
+    , conduit
+    , conduit-extra
+    , containers
+    , crypton
+    , crypton-conduit
+    , digest
+    , exceptions
+    , filelock
+    , generic-deriving
+    , hackage-security
+    , hedgehog
+    , hpack >=0.35.3
+    , hspec
+    , http-client
+    , http-client-tls >=0.3.6.2
+    , http-conduit
+    , http-download >=0.2.1.0
+    , http-types
+    , internal
+    , memory
+    , mtl
+    , network-uri
+    , pantry
+    , path
+    , path-io
+    , persistent
+    , persistent-sqlite >=2.9.3
+    , persistent-template
+    , primitive
+    , raw-strings-qq
+    , resourcet
+    , rio
+    , rio-orphans
+    , rio-prettyprint >=0.1.7.0
+    , static-bytes >=0.1.1
+    , tar-conduit >=0.4.1
+    , text
+    , text-metrics
+    , time
+    , transformers
+    , unix-compat
+    , unliftio
+    , unordered-containers
+    , vector
+    , yaml
+    , zip-archive
+  default-language: Haskell2010
+  if impl(ghc >= 9.4.5) && os(windows)
+    build-depends:
+        network >=3.1.2.9
