diff --git a/executables/README.lhs b/executables/README.lhs
--- a/executables/README.lhs
+++ b/executables/README.lhs
@@ -32,6 +32,7 @@
 
 ~~~ {.haskell}
 {-# OPTIONS_GHC -fno-warn-unused-binds #-}
+{-# OPTIONS_GHC -fno-warn-deprecations #-}
 import Control.Concurrent (forkIO)
 import Control.Monad (forever)
 import Control.Monad.Trans (liftIO)
@@ -77,7 +78,7 @@
   :<|> Raw
 
 unprotected :: CookieSettings -> JWTSettings -> Server Unprotected
-unprotected cs jwts = checkCreds cs jwts :<|> serveDirectory "example/static" 
+unprotected cs jwts = checkCreds cs jwts :<|> serveDirectory "example/static"
 
 type API auths = (Auth auths User :> Protected) :<|> Unprotected
 
diff --git a/package.yaml b/package.yaml
--- a/package.yaml
+++ b/package.yaml
@@ -1,5 +1,5 @@
 name:                servant-auth-server
-version:             0.2.4.0
+version:             0.2.6.0
 synopsis:            servant-server/servant-auth compatibility
 description:         |
     This package provides the required instances for using the @Auth@ combinator
@@ -37,7 +37,7 @@
   - jose                    >= 0.5  && < 0.6
   - monad-time              >= 0.2  && < 0.3
   - time                    >= 1.5  && < 1.7
-  - servant-server          >= 0.9.1  && < 0.10
+  - servant-server          >= 0.9.1  && < 0.11
   - base64-bytestring       >= 1    && < 2
   - blaze-builder           >= 0.4  && < 0.5
   - unordered-containers    >= 0.2  && < 0.3
@@ -82,13 +82,13 @@
     dependencies:
       - servant-auth-server
       - hspec > 2 && < 3
-      - QuickCheck >= 2.8 && < 2.9
+      - QuickCheck >= 2.8 && < 2.10
       - aeson
       - lens-aeson
       - warp
       - wreq
       - http-types
-      - http-client
+      - http-client >= 0.4 && < 0.6
 
 executables:
   readme:
@@ -98,7 +98,7 @@
     dependencies:
       - servant-auth
       - servant-auth-server
-      - servant-server  >= 0.9.1 && < 0.10
+      - servant-server
       - warp
       - markdown-unlit
       - transformers
diff --git a/servant-auth-server.cabal b/servant-auth-server.cabal
--- a/servant-auth-server.cabal
+++ b/servant-auth-server.cabal
@@ -3,7 +3,7 @@
 -- see: https://github.com/sol/hpack
 
 name:           servant-auth-server
-version:        0.2.4.0
+version:        0.2.6.0
 synopsis:       servant-server/servant-auth compatibility
 description:    This package provides the required instances for using the @Auth@ combinator
                 in your 'servant' server.
@@ -48,7 +48,7 @@
     , jose                    >= 0.5  && < 0.6
     , monad-time              >= 0.2  && < 0.3
     , time                    >= 1.5  && < 1.7
-    , servant-server          >= 0.9.1  && < 0.10
+    , servant-server          >= 0.9.1  && < 0.11
     , base64-bytestring       >= 1    && < 2
     , blaze-builder           >= 0.4  && < 0.5
     , unordered-containers    >= 0.2  && < 0.3
@@ -93,7 +93,7 @@
     , jose                    >= 0.5  && < 0.6
     , monad-time              >= 0.2  && < 0.3
     , time                    >= 1.5  && < 1.7
-    , servant-server          >= 0.9.1  && < 0.10
+    , servant-server          >= 0.9.1  && < 0.11
     , base64-bytestring       >= 1    && < 2
     , blaze-builder           >= 0.4  && < 0.5
     , unordered-containers    >= 0.2  && < 0.3
@@ -106,7 +106,7 @@
     , http-types              >= 0.9  && < 0.10
     , servant-auth
     , servant-auth-server
-    , servant-server  >= 0.9.1 && < 0.10
+    , servant-server
     , warp
     , markdown-unlit
     , transformers
@@ -132,7 +132,7 @@
     , jose                    >= 0.5  && < 0.6
     , monad-time              >= 0.2  && < 0.3
     , time                    >= 1.5  && < 1.7
-    , servant-server          >= 0.9.1  && < 0.10
+    , servant-server          >= 0.9.1  && < 0.11
     , base64-bytestring       >= 1    && < 2
     , blaze-builder           >= 0.4  && < 0.5
     , unordered-containers    >= 0.2  && < 0.3
@@ -145,13 +145,13 @@
     , http-types              >= 0.9  && < 0.10
     , servant-auth-server
     , hspec > 2 && < 3
-    , QuickCheck >= 2.8 && < 2.9
+    , QuickCheck >= 2.8 && < 2.10
     , aeson
     , lens-aeson
     , warp
     , wreq
     , http-types
-    , http-client
+    , http-client >= 0.4 && < 0.6
   other-modules:
       Doctest
       Servant.Auth.ServerSpec
diff --git a/test/Servant/Auth/ServerSpec.hs b/test/Servant/Auth/ServerSpec.hs
--- a/test/Servant/Auth/ServerSpec.hs
+++ b/test/Servant/Auth/ServerSpec.hs
@@ -1,43 +1,62 @@
+{-# LANGUAGE CPP #-}
 module Servant.Auth.ServerSpec (spec) where
 
 import           Control.Lens
-import           Control.Monad.Except     (runExceptT)
-import           Crypto.JOSE              (Alg (HS256, None), Error, JWK,
-                                           JWSHeader,
-                                           KeyMaterialGenParam (OctGenParam),
-                                           Protection (Protected), ToCompact,
-                                           encodeCompact, genJWK, newJWSHeader)
-import           Crypto.JWT               (Audience (..), ClaimsSet, JWT,
-                                           NumericDate (NumericDate), claimAud,
-                                           claimNbf, createJWSJWT,
-                                           emptyClaimsSet, unregisteredClaims)
-import           Data.Aeson               (FromJSON, ToJSON, Value, toJSON)
-import           Data.Aeson.Lens          (_JSON)
-import qualified Data.ByteString          as BS
-import qualified Data.ByteString.Lazy     as BSL
-import           Data.CaseInsensitive     (mk)
-import           Data.Foldable            (find)
+import           Control.Monad.Except                (runExceptT)
+import           Crypto.JOSE                         (Alg (HS256, None), Error,
+                                                      JWK, JWSHeader,
+                                                      KeyMaterialGenParam (OctGenParam),
+                                                      Protection (Protected),
+                                                      ToCompact, encodeCompact,
+                                                      genJWK, newJWSHeader)
+import           Crypto.JWT                          (Audience (..), ClaimsSet,
+                                                      JWT,
+                                                      NumericDate (NumericDate),
+                                                      claimAud, claimNbf,
+                                                      createJWSJWT,
+                                                      emptyClaimsSet,
+                                                      unregisteredClaims)
+import           Data.Aeson                          (FromJSON, ToJSON, Value,
+                                                      toJSON)
+import           Data.Aeson.Lens                     (_JSON)
+import qualified Data.ByteString                     as BS
+import qualified Data.ByteString.Lazy                as BSL
+import           Data.CaseInsensitive                (mk)
+import           Data.Foldable                       (find)
 import           Data.Monoid
 import           Data.Time
-import           GHC.Generics             (Generic)
-import           Network.HTTP.Client      (HttpException (StatusCodeException),
-                                           cookie_http_only, cookie_name,
-                                           cookie_value, destroyCookieJar)
-import           Network.HTTP.Types       (Status, status200, status401)
-import           Network.Wai              (responseLBS)
-import           Network.Wai.Handler.Warp (testWithApplication)
-import           Network.Wreq             (Options, auth, basicAuth,
-                                           cookieExpiryTime, cookies, defaults,
-                                           get, getWith, header, oauth2Bearer,
-                                           responseBody, responseCookieJar,
-                                           responseStatus, responseHeader)
-import           Servant                  hiding (BasicAuth, IsSecure (..))
+import           GHC.Generics                        (Generic)
+import           Network.HTTP.Client                 (cookie_http_only,
+                                                      cookie_name, cookie_value,
+                                                      destroyCookieJar)
+import           Network.HTTP.Types                  (Status, status200,
+                                                      status401)
+import           Network.Wai                         (responseLBS)
+import           Network.Wai.Handler.Warp            (testWithApplication)
+import           Network.Wreq                        (Options, auth, basicAuth,
+                                                      cookieExpiryTime, cookies,
+                                                      defaults, get, getWith,
+                                                      header, oauth2Bearer,
+                                                      responseBody,
+                                                      responseCookieJar,
+                                                      responseHeader,
+                                                      responseStatus)
+import           Servant                             hiding (BasicAuth,
+                                                      IsSecure (..))
 import           Servant.Auth.Server
 import           Servant.Auth.Server.SetCookieOrphan ()
-import           System.IO.Unsafe         (unsafePerformIO)
+import           System.IO.Unsafe                    (unsafePerformIO)
 import           Test.Hspec
 import           Test.QuickCheck
 
+#if MIN_VERSION_http_client(0,5,0)
+import qualified Network.HTTP.Client as HCli
+#else
+import Network.HTTP.Client (HttpException (StatusCodeException))
+#endif
+
+
+
 spec :: Spec
 spec = do
   authSpec
@@ -388,9 +407,15 @@
                         []  -> [cookie']
                         _   -> error "expecting single cookie header"
 
+
 shouldHTTPErrorWith :: IO a -> Status -> Expectation
 shouldHTTPErrorWith act stat = act `shouldThrow` \e -> case e of
+#if MIN_VERSION_http_client(0,5,0)
+  HCli.HttpExceptionRequest _ (HCli.StatusCodeException resp _)
+    -> HCli.responseStatus resp == stat
+#else
   StatusCodeException x _ _ -> x == stat
+#endif
   _ -> False
 
 url :: Int -> String
