diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,8 @@
 # Changelog
 
+- 0.3.3 (2026-01-10)
+  * Bumps the ppad-sha{256,512} dependencies.
+
 - 0.3.2 (2025-12-28)
   * Upgrades to newer dependencies and tests with GHC 9.10.3.
 
diff --git a/lib/Crypto/HDKey/BIP32.hs b/lib/Crypto/HDKey/BIP32.hs
--- a/lib/Crypto/HDKey/BIP32.hs
+++ b/lib/Crypto/HDKey/BIP32.hs
@@ -318,7 +318,7 @@
   | l < 16 = Nothing
   | l > 64 = Nothing
   | otherwise = do
-      let i = SHA512.hmac "Bitcoin seed" seed
+      let SHA512.MAC i = SHA512.hmac "Bitcoin seed" seed
           (il, c) = BS.splitAt 32 i
           s = unsafe_roll32 il -- safe due to 512-bit hmac
       pure $! (XPrv (X s c))
@@ -326,7 +326,7 @@
 -- private parent key -> private child key
 ckd_priv :: XPrv -> Word32 -> XPrv
 ckd_priv _xprv@(XPrv (X sec cod)) i =
-    let l = SHA512.hmac cod dat
+    let SHA512.MAC l = SHA512.hmac cod dat
         (il, ci) = BS.splitAt 32 l
         pil = unsafe_roll32 il -- safe due to 512-bit hmac
         ki  = S.from (S.to pil + S.to sec)
@@ -347,7 +347,7 @@
   | hardened i = Nothing
   | otherwise = do
       let dat = Secp256k1.serialize_point pub <> ser32 i
-          l   = SHA512.hmac cod dat
+          SHA512.MAC l = SHA512.hmac cod dat
           (il, ci) = BS.splitAt 32 l
           pil = unsafe_roll32 il -- safe due to 512-bit hmac
       pt <- Secp256k1.mul_vartime Secp256k1._CURVE_G pil
@@ -369,7 +369,7 @@
 --   calculations.
 ckd_priv' :: Context -> XPrv -> Word32 -> XPrv
 ckd_priv' ctx _xprv@(XPrv (X sec cod)) i =
-    let l = SHA512.hmac cod dat
+    let SHA512.MAC l = SHA512.hmac cod dat
         (il, ci) = BS.splitAt 32 l
         pil = unsafe_roll32 il -- safe due to 512-bit hmac
         ki  = S.from (S.to pil + S.to sec)
@@ -391,7 +391,7 @@
   | hardened i = Nothing
   | otherwise = do
       let dat = Secp256k1.serialize_point pub <> ser32 i
-          l   = SHA512.hmac cod dat
+          SHA512.MAC l = SHA512.hmac cod dat
           (il, ci) = BS.splitAt 32 l
           pil = unsafe_roll32 il -- safe due to 512-bit hmac
       pt <- Secp256k1.mul_wnaf ctx pil
diff --git a/ppad-bip32.cabal b/ppad-bip32.cabal
--- a/ppad-bip32.cabal
+++ b/ppad-bip32.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               ppad-bip32
-version:            0.3.2
+version:            0.3.3
 synopsis:           BIP32 hierarchical deterministic wallets.
 license:            MIT
 license-file:       LICENSE
@@ -36,12 +36,12 @@
   build-depends:
       base >= 4.9 && < 5
     , bytestring >= 0.9 && < 0.13
-    , ppad-base58 >= 0.2.2 && < 0.3
+    , ppad-base58 >= 0.2.3 && < 0.3
     , ppad-fixed >= 0.1.3 && < 0.2
     , ppad-ripemd160 >= 0.1.4 && < 0.2
-    , ppad-secp256k1 >= 0.5.2 && < 0.6
-    , ppad-sha256 >= 0.2.4 && < 0.3
-    , ppad-sha512 >= 0.1.4 && < 0.2
+    , ppad-secp256k1 >= 0.5.3 && < 0.6
+    , ppad-sha256 >= 0.3 && < 0.4
+    , ppad-sha512 >= 0.2 && < 0.3
 
 test-suite bip32-tests
   type:                exitcode-stdio-1.0