diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,8 @@
 # Changelog
 
+- 0.3.6 (2026-09-06)
+  * Merely bumps the ppad-chacha dependency.
+
 - 0.3.5 (2026-08-01)
   * Merely bumps the ppad-poly1305 dependency.
 
diff --git a/lib/Crypto/AEAD/ChaCha20Poly1305.hs b/lib/Crypto/AEAD/ChaCha20Poly1305.hs
--- a/lib/Crypto/AEAD/ChaCha20Poly1305.hs
+++ b/lib/Crypto/AEAD/ChaCha20Poly1305.hs
@@ -87,6 +87,7 @@
 _poly1305_key_gen key nonce = case ChaCha20.block key 0 nonce of
   Left ChaCha20.InvalidKey -> Left InvalidKey
   Left ChaCha20.InvalidNonce -> Left InvalidNonce
+  Left ChaCha20.CounterOverflow -> Left CounterOverflow
   Right k -> pure (BS.take 32 k)
 {-# INLINEABLE _poly1305_key_gen #-}
 
@@ -98,9 +99,10 @@
 
 -- | Error values.
 data Error =
-    InvalidKey    -- ^ the provided key was not 256 bits long
-  | InvalidNonce  -- ^ the provided nonce was not 96 bits long
-  | InvalidMAC    -- ^ the provided MAC does not authenticate the ciphertext
+    InvalidKey      -- ^ the provided key was not 256 bits long
+  | InvalidNonce    -- ^ the provided nonce was not 96 bits long
+  | InvalidMAC      -- ^ the provided MAC does not authenticate the ciphertext
+  | CounterOverflow -- ^ cipher exhausted
   deriving (Eq, Show)
 
 -- RFC8439 2.8
@@ -122,7 +124,7 @@
   :: BS.ByteString -- ^ arbitrary-length additional authenticated data
   -> BS.ByteString -- ^ 256-bit key
   -> BS.ByteString -- ^ 96-bit nonce
-  -> BS.ByteString -- ^ arbitrary-length plaintext
+  -> BS.ByteString -- ^ arbitrary-length (technically, ~256 GiB) plaintext
   -> Either Error (BS.ByteString, BS.ByteString) -- ^ (ciphertext, 128-bit MAC)
 encrypt aad key nonce plaintext
   | BS.length key  /= 32  = Left InvalidKey
@@ -130,8 +132,9 @@
   | otherwise = do
       otk <- _poly1305_key_gen key nonce
       case ChaCha20.cipher key 1 nonce plaintext of
-        Left ChaCha20.InvalidKey -> Left InvalidKey     -- impossible, but..
-        Left ChaCha20.InvalidNonce -> Left InvalidNonce -- ditto
+        Left ChaCha20.InvalidKey      -> Left InvalidKey -- impossible, but..
+        Left ChaCha20.InvalidNonce    -> Left InvalidNonce -- ditto
+        Left ChaCha20.CounterOverflow -> Left CounterOverflow
         Right cip -> do
           let md0 = aad <> pad16 aad
               md1 = md0 <> cip <> pad16 cip
@@ -171,6 +174,7 @@
           | ct_eq mac tag -> case ChaCha20.cipher key 1 nonce cip of
               Left ChaCha20.InvalidKey -> Left InvalidKey
               Left ChaCha20.InvalidNonce -> Left InvalidNonce
+              Left ChaCha20.CounterOverflow -> Left CounterOverflow
               Right v -> pure v
           | otherwise ->
               Left InvalidMAC
diff --git a/lib/Data/Barrier.hs b/lib/Data/Barrier.hs
--- a/lib/Data/Barrier.hs
+++ b/lib/Data/Barrier.hs
@@ -29,8 +29,6 @@
 --       external call it cannot see through. Inline it into the caller
 --       and the barrier is gone.
 --
---   Guarded by the substratum + censor constant-time checks; weakening
---   either property re-introduces the timing leak.
 barrier :: Word8 -> Word8
 barrier x = x
 {-# NOINLINE barrier #-}
diff --git a/ppad-aead.cabal b/ppad-aead.cabal
--- a/ppad-aead.cabal
+++ b/ppad-aead.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               ppad-aead
-version:            0.3.5
+version:            0.3.6
 synopsis:           A pure AEAD-ChaCha20-Poly1305 construction
 license:            MIT
 license-file:       LICENSE
@@ -38,7 +38,7 @@
   build-depends:
       base >= 4.9 && < 5
     , bytestring >= 0.9 && < 0.13
-    , ppad-chacha >= 0.2.2 && < 0.3
+    , ppad-chacha >= 0.3 && < 0.4
     , ppad-poly1305 >= 0.4.6 && < 0.5
 
 test-suite aead-tests