diff --git a/CHANGELOG b/CHANGELOG
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,5 +1,9 @@
 # Changelog
 
+- 0.2.2 (2026-01-10)
+  * Places bounds on the ppad-sha{256,512} dependencies used in the test and
+    benchmark suites.
+
 - 0.2.1 (2025-12-28)
   * Adds an 'llvm' build flag and tests with GHC 9.10.3.
 
diff --git a/bench/Main.hs b/bench/Main.hs
--- a/bench/Main.hs
+++ b/bench/Main.hs
@@ -6,22 +6,31 @@
 import qualified Crypto.KDF.PBKDF as KDF
 import qualified Crypto.Hash.SHA256 as SHA256
 import qualified Crypto.Hash.SHA512 as SHA512
+import qualified Data.ByteString as BS
 
 main :: IO ()
 main = defaultMain [
     suite
   ]
 
+hmac_sha256 :: BS.ByteString -> BS.ByteString -> BS.ByteString
+hmac_sha256 k b = case SHA256.hmac k b of
+  SHA256.MAC mac -> mac
+
+hmac_sha512 :: BS.ByteString -> BS.ByteString -> BS.ByteString
+hmac_sha512 k b = case SHA512.hmac k b of
+  SHA512.MAC mac -> mac
+
 suite :: Benchmark
 suite =
   bgroup "ppad-pbkdf" [
     bgroup "PBKDF-SHA256" [
       bench "derive (outlen 32)" $
-        nf (KDF.derive SHA256.hmac "muh password" "muh salt" 32) 64
+        nf (KDF.derive hmac_sha256 "muh password" "muh salt" 32) 64
     ]
   , bgroup "PBKDF-SHA512" [
       bench "derive (outlen 32)" $
-        nf (KDF.derive SHA512.hmac "muh password" "muh salt" 32) 64
+        nf (KDF.derive hmac_sha512 "muh password" "muh salt" 32) 64
     ]
   ]
 
diff --git a/ppad-pbkdf.cabal b/ppad-pbkdf.cabal
--- a/ppad-pbkdf.cabal
+++ b/ppad-pbkdf.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               ppad-pbkdf
-version:            0.2.1
+version:            0.2.2
 synopsis:           A password-based key derivation function
 license:            MIT
 license-file:       LICENSE
@@ -53,8 +53,8 @@
     , bytestring
     , ppad-base16
     , ppad-pbkdf
-    , ppad-sha256
-    , ppad-sha512
+    , ppad-sha256 >= 0.3 && < 0.4
+    , ppad-sha512 >= 0.2 && < 0.4
     , tasty
     , tasty-hunit
     , text
@@ -73,6 +73,6 @@
     , bytestring
     , criterion
     , ppad-pbkdf
-    , ppad-sha256
-    , ppad-sha512
+    , ppad-sha256 >= 0.3 && < 0.4
+    , ppad-sha512 >= 0.2 && < 0.3
 
diff --git a/test/Main.hs b/test/Main.hs
--- a/test/Main.hs
+++ b/test/Main.hs
@@ -54,8 +54,8 @@
         | pt_result == "invalid" -> assertBool "invalid" (pec /= out)
         | otherwise -> assertEqual mempty pec out
   where
-    hmac = case h of
-      SHA256 -> SHA256.hmac
-      SHA512 -> SHA512.hmac
+    hmac k b = case h of
+      SHA256 -> let SHA256.MAC mac = SHA256.hmac k b in mac
+      SHA512 -> let SHA512.MAC mac = SHA512.hmac k b in mac
     t_msg = "test " <> show pt_tcId -- XX embellish