diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # ChangeLog for warp
 
+## 3.3.26
+
+* Using crypton instead of cryptonite.
+  [#931](https://github.com/yesodweb/wai/pull/931)
+
 ## 3.3.25
 
 * Catching up the signature change of openFd in the unix package v2.8.
diff --git a/Network/Wai/Handler/Warp.hs b/Network/Wai/Handler/Warp.hs
--- a/Network/Wai/Handler/Warp.hs
+++ b/Network/Wai/Handler/Warp.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE RankNTypes #-}
 {-# LANGUAGE PatternGuards #-}
 {-# OPTIONS_GHC -fno-warn-deprecations #-}
@@ -101,9 +100,7 @@
   , pauseTimeout
   , FileInfo(..)
   , getFileInfo
-#ifdef MIN_VERSION_x509
   , clientCertificate
-#endif
   , withApplication
   , withApplicationSettings
   , testWithApplication
@@ -132,9 +129,7 @@
 import UnliftIO.Exception (SomeException, throwIO)
 import Data.Streaming.Network (HostPreference)
 import qualified Data.Vault.Lazy as Vault
-#ifdef MIN_VERSION_x509
 import Data.X509
-#endif
 import qualified Network.HTTP.Types as H
 import Network.Socket (Socket, SockAddr)
 import Network.Wai (Request, Response, vault)
@@ -539,10 +534,8 @@
 getGracefulCloseTimeout2 :: Settings -> Int
 getGracefulCloseTimeout2 = settingsGracefulCloseTimeout2
 
-#ifdef MIN_VERSION_x509
 -- | Getting information of client certificate.
 --
 -- Since 3.3.5
 clientCertificate :: Request -> Maybe CertificateChain
 clientCertificate = join . Vault.lookup getClientCertificateKey . vault
-#endif
diff --git a/Network/Wai/Handler/Warp/Buffer.hs b/Network/Wai/Handler/Warp/Buffer.hs
--- a/Network/Wai/Handler/Warp/Buffer.hs
+++ b/Network/Wai/Handler/Warp/Buffer.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE BangPatterns #-}
-
 module Network.Wai.Handler.Warp.Buffer (
     createWriteBuffer
   , allocateBuffer
diff --git a/Network/Wai/Handler/Warp/FileInfoCache.hs b/Network/Wai/Handler/Warp/FileInfoCache.hs
--- a/Network/Wai/Handler/Warp/FileInfoCache.hs
+++ b/Network/Wai/Handler/Warp/FileInfoCache.hs
@@ -6,10 +6,14 @@
   , getInfo -- test purpose only
   ) where
 
-import qualified UnliftIO (onException, bracket, throwIO)
 import Control.Reaper
 import Network.HTTP.Date
+#if WINDOWS
 import System.PosixCompat.Files
+#else
+import System.Posix.Files
+#endif
+import qualified UnliftIO (onException, bracket, throwIO)
 
 import Network.Wai.Handler.Warp.HashMap (HashMap)
 import qualified Network.Wai.Handler.Warp.HashMap as M
diff --git a/Network/Wai/Handler/Warp/HTTP2.hs b/Network/Wai/Handler/Warp/HTTP2.hs
--- a/Network/Wai/Handler/Warp/HTTP2.hs
+++ b/Network/Wai/Handler/Warp/HTTP2.hs
@@ -1,7 +1,6 @@
 {-# LANGUAGE RecordWildCards #-}
 {-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE PatternGuards #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 
 module Network.Wai.Handler.Warp.HTTP2 (
diff --git a/Network/Wai/Handler/Warp/HTTP2/PushPromise.hs b/Network/Wai/Handler/Warp/HTTP2/PushPromise.hs
--- a/Network/Wai/Handler/Warp/HTTP2/PushPromise.hs
+++ b/Network/Wai/Handler/Warp/HTTP2/PushPromise.hs
@@ -1,5 +1,4 @@
 {-# LANGUAGE BangPatterns #-}
-{-# LANGUAGE RecordWildCards #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 
 module Network.Wai.Handler.Warp.HTTP2.PushPromise where
diff --git a/Network/Wai/Handler/Warp/HTTP2/Request.hs b/Network/Wai/Handler/Warp/HTTP2/Request.hs
--- a/Network/Wai/Handler/Warp/HTTP2/Request.hs
+++ b/Network/Wai/Handler/Warp/HTTP2/Request.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE BangPatterns #-}
 
 module Network.Wai.Handler.Warp.HTTP2.Request (
@@ -24,9 +23,7 @@
 import Network.Wai.Handler.Warp.HTTP2.Types
 import Network.Wai.Handler.Warp.Imports
 import Network.Wai.Handler.Warp.Request (getFileInfoKey, pauseTimeoutKey)
-#ifdef MIN_VERSION_x509
 import Network.Wai.Handler.Warp.Request (getClientCertificateKey)
-#endif
 import qualified Network.Wai.Handler.Warp.Settings as S (Settings, settingsNoParsePath)
 import Network.Wai.Handler.Warp.Types
 
@@ -90,9 +87,7 @@
                 $ Vault.insert setHTTP2DataKey (writeIORef ref)
                 $ Vault.insert modifyHTTP2DataKey (modifyIORef' ref)
                 $ Vault.insert pauseTimeoutKey (T.pause th)
-#ifdef MIN_VERSION_x509
                 $ Vault.insert getClientCertificateKey (getTransportClientCertificate transport)
-#endif
                   Vault.empty
 
 getHTTP2DataKey :: Vault.Key (IO (Maybe HTTP2Data))
diff --git a/Network/Wai/Handler/Warp/HTTP2/Response.hs b/Network/Wai/Handler/Warp/HTTP2/Response.hs
--- a/Network/Wai/Handler/Warp/HTTP2/Response.hs
+++ b/Network/Wai/Handler/Warp/HTTP2/Response.hs
@@ -1,5 +1,4 @@
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE RecordWildCards #-}
 {-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE ScopedTypeVariables #-}
 
diff --git a/Network/Wai/Handler/Warp/HashMap.hs b/Network/Wai/Handler/Warp/HashMap.hs
--- a/Network/Wai/Handler/Warp/HashMap.hs
+++ b/Network/Wai/Handler/Warp/HashMap.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE BangPatterns #-}
-
 module Network.Wai.Handler.Warp.HashMap where
 
 import Data.Hashable (hash)
diff --git a/Network/Wai/Handler/Warp/IO.hs b/Network/Wai/Handler/Warp/IO.hs
--- a/Network/Wai/Handler/Warp/IO.hs
+++ b/Network/Wai/Handler/Warp/IO.hs
@@ -1,4 +1,3 @@
-{-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE CPP #-}
 
 module Network.Wai.Handler.Warp.IO where
diff --git a/Network/Wai/Handler/Warp/MultiMap.hs b/Network/Wai/Handler/Warp/MultiMap.hs
--- a/Network/Wai/Handler/Warp/MultiMap.hs
+++ b/Network/Wai/Handler/Warp/MultiMap.hs
@@ -1,5 +1,3 @@
-{-# LANGUAGE BangPatterns #-}
-
 module Network.Wai.Handler.Warp.MultiMap (
     MultiMap
   , isEmpty
diff --git a/Network/Wai/Handler/Warp/Request.hs b/Network/Wai/Handler/Warp/Request.hs
--- a/Network/Wai/Handler/Warp/Request.hs
+++ b/Network/Wai/Handler/Warp/Request.hs
@@ -1,6 +1,5 @@
 {-# LANGUAGE BangPatterns #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE CPP #-}
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# OPTIONS_GHC -fno-warn-deprecations #-}
 
@@ -9,9 +8,7 @@
   , headerLines
   , pauseTimeoutKey
   , getFileInfoKey
-#ifdef MIN_VERSION_x509
   , getClientCertificateKey
-#endif
   , NoKeepAliveRequest (..)
   ) where
 
@@ -24,9 +21,7 @@
 import qualified Data.IORef as I
 import Data.Typeable (Typeable)
 import qualified Data.Vault.Lazy as Vault
-#ifdef MIN_VERSION_x509
 import Data.X509
-#endif
 import qualified Network.HTTP.Types as H
 import Network.Socket (SockAddr)
 import Network.Wai
@@ -76,9 +71,7 @@
         rawPath = if settingsNoParsePath settings then unparsedPath else path
         vaultValue = Vault.insert pauseTimeoutKey (Timeout.pause th)
                    $ Vault.insert getFileInfoKey (getFileInfo ii)
-#ifdef MIN_VERSION_x509
                    $ Vault.insert getClientCertificateKey (getTransportClientCertificate transport)
-#endif
                      Vault.empty
     (rbody, remainingRef, bodyLength) <- bodyAndSource src cl te
     -- body producing function which will produce '100-continue', if needed
@@ -323,8 +316,6 @@
 getFileInfoKey = unsafePerformIO Vault.newKey
 {-# NOINLINE getFileInfoKey #-}
 
-#ifdef MIN_VERSION_x509
 getClientCertificateKey :: Vault.Key (Maybe CertificateChain)
 getClientCertificateKey = unsafePerformIO Vault.newKey
 {-# NOINLINE getClientCertificateKey #-}
-#endif
diff --git a/Network/Wai/Handler/Warp/Settings.hs b/Network/Wai/Handler/Warp/Settings.hs
--- a/Network/Wai/Handler/Warp/Settings.hs
+++ b/Network/Wai/Handler/Warp/Settings.hs
@@ -1,5 +1,5 @@
 {-# LANGUAGE OverloadedStrings, ScopedTypeVariables, ViewPatterns #-}
-{-# LANGUAGE PatternGuards, RankNTypes #-}
+{-# LANGUAGE PatternGuards #-}
 {-# LANGUAGE ImpredicativeTypes, CPP #-}
 {-# LANGUAGE MagicHash, UnboxedTuples #-}
 
@@ -25,7 +25,9 @@
 
 import Network.Wai.Handler.Warp.Imports
 import Network.Wai.Handler.Warp.Types
+#if WINDOWS
 import Network.Wai.Handler.Warp.Windows (windowsThreadBlockHack)
+#endif
 
 -- | Various Warp server settings. This is purposely kept as an abstract data
 -- type so that new settings can be added without breaking backwards
diff --git a/Network/Wai/Handler/Warp/Types.hs b/Network/Wai/Handler/Warp/Types.hs
--- a/Network/Wai/Handler/Warp/Types.hs
+++ b/Network/Wai/Handler/Warp/Types.hs
@@ -1,6 +1,5 @@
 {-# LANGUAGE DeriveDataTypeable #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE CPP #-}
 
 module Network.Wai.Handler.Warp.Types where
 
@@ -8,9 +7,7 @@
 import qualified Data.ByteString as S
 import Data.IORef (IORef, readIORef, writeIORef, newIORef)
 import Data.Typeable (Typeable)
-#ifdef MIN_VERSION_x509
 import Data.X509
-#endif
 import Network.Socket.BufferPool
 import System.Posix.Types (Fd)
 import qualified System.TimeManager as T
@@ -180,16 +177,12 @@
                  , tlsMinorVersion :: Int
                  , tlsNegotiatedProtocol :: Maybe ByteString -- ^ The result of Application Layer Protocol Negociation in RFC 7301
                  , tlsChiperID :: Word16
-#ifdef MIN_VERSION_x509
                  , tlsClientCertificate :: Maybe CertificateChain
-#endif
                  }  -- ^ Encrypted channel: TLS or SSL
                | QUIC {
                    quicNegotiatedProtocol :: Maybe ByteString
                  , quicChiperID :: Word16
-#ifdef MIN_VERSION_x509
                  , quicClientCertificate :: Maybe CertificateChain
-#endif
                  }
 
 isTransportSecure :: Transport -> Bool
@@ -200,9 +193,7 @@
 isTransportQUIC QUIC{} = True
 isTransportQUIC _      = False
 
-#ifdef MIN_VERSION_x509
 getTransportClientCertificate :: Transport -> Maybe CertificateChain
 getTransportClientCertificate TCP              = Nothing
 getTransportClientCertificate (TLS _ _ _ _ cc) = cc
 getTransportClientCertificate (QUIC _ _ cc)    = cc
-#endif
diff --git a/test/ConduitSpec.hs b/test/ConduitSpec.hs
--- a/test/ConduitSpec.hs
+++ b/test/ConduitSpec.hs
@@ -32,7 +32,7 @@
         z <- replicateM 40 $ readSource src
         S.concat z `shouldBe` S.pack [41..50]
     it "chunkedSource" $ do
-        ref <- newIORef $ "5\r\n12345\r\n3\r\n678\r\n0\r\n\r\nBLAH"
+        ref <- newIORef "5\r\n12345\r\n3\r\n678\r\n0\r\n\r\nBLAH"
         src <- mkSource $ do
             x <- readIORef ref
             writeIORef ref S.empty
diff --git a/test/RequestSpec.hs b/test/RequestSpec.hs
--- a/test/RequestSpec.hs
+++ b/test/RequestSpec.hs
@@ -1,6 +1,5 @@
 {-# OPTIONS_GHC -fno-warn-orphans #-}
 {-# LANGUAGE OverloadedStrings #-}
-{-# LANGUAGE StandaloneDeriving #-}
 
 module RequestSpec (main, spec) where
 
@@ -25,9 +24,9 @@
 spec = do
   describe "headerLines" $ do
     it "takes until blank" $
-        blankSafe >>= (`shouldBe` ("", ["foo", "bar", "baz"]))
+        blankSafe `shouldReturn` ("", ["foo", "bar", "baz"])
     it "ignored leading whitespace in bodies" $
-        whiteSafe >>= (`shouldBe` (" hi there", ["foo", "bar", "baz"]))
+        whiteSafe `shouldReturn` (" hi there", ["foo", "bar", "baz"])
     it "throws OverLargeHeader when too many" $
         tooMany `shouldThrow` overLargeHeader
     it "throws OverLargeHeader when too large" $
diff --git a/test/RunSpec.hs b/test/RunSpec.hs
--- a/test/RunSpec.hs
+++ b/test/RunSpec.hs
@@ -381,9 +381,9 @@
                 doubleBS = S.concatMap $ \w -> S.pack [w, w]
             withApp defaultSettings app $ withMySocket $ \ms -> do
                 msWrite ms "POST / HTTP/1.1\r\n\r\n12345"
-                timeout 100000 (msRead ms 10) >>= (`shouldBe` Just "1122334455")
+                timeout 100000 (msRead ms 10) `shouldReturn` Just "1122334455"
                 msWrite ms "67890"
-                timeout 100000 (msRead ms 10) >>= (`shouldBe` Just "6677889900")
+                timeout 100000 (msRead ms 10) `shouldReturn` Just "6677889900"
     it "only one date and server header" $ do
         let app _ f = f $ responseLBS status200
                 [ ("server", "server")
diff --git a/warp.cabal b/warp.cabal
--- a/warp.cabal
+++ b/warp.cabal
@@ -1,5 +1,5 @@
 Name:                warp
-Version:             3.3.25
+Version:             3.3.26
 Synopsis:            A fast, light-weight web server for WAI applications.
 License:             MIT
 License-file:        LICENSE
@@ -56,13 +56,12 @@
                    , streaming-commons         >= 0.1.10
                    , text
                    , time-manager
-                   , unix-compat               >= 0.2
                    , vault                     >= 0.3
                    , wai                       >= 3.2      && < 3.3
                    , word8
                    , unliftio
   if flag(x509)
-      Build-Depends: x509
+      Build-Depends: crypton-x509
   if impl(ghc < 8)
       Build-Depends: semigroups
   if flag(network-bytestring)
@@ -112,6 +111,7 @@
   if os(windows)
       Cpp-Options:   -DWINDOWS
       Build-Depends: time
+                   , unix-compat >= 0.2
   else
       Build-Depends: unix
       Other-modules: Network.Wai.Handler.Warp.MultiMap
@@ -211,13 +211,12 @@
                    , streaming-commons         >= 0.1.10
                    , text
                    , time-manager
-                   , unix-compat               >= 0.2
                    , vault
                    , wai                       >= 3.2      && < 3.3
                    , word8
                    , unliftio
   if flag(x509)
-      Build-Depends: x509
+      Build-Depends: crypton-x509
   if impl(ghc < 8)
       Build-Depends: semigroups
                    , transformers
@@ -227,6 +226,7 @@
   if os(windows)
       Cpp-Options:   -DWINDOWS
       Build-Depends: time
+                 , unix-compat >= 0.2
   else
       Build-Depends: unix
       Other-modules: Network.Wai.Handler.Warp.MultiMap
@@ -257,10 +257,9 @@
                   , network
                   , recv
                   , time-manager
-                  , unix-compat
                   , unliftio
   if flag(x509)
-      Build-Depends: x509
+      Build-Depends: crypton-x509
   if impl(ghc < 8)
       Build-Depends: semigroups
 
@@ -270,6 +269,7 @@
   if os(windows)
     Cpp-Options:   -DWINDOWS
     Build-Depends: time
+                 , unix-compat >= 0.2
   if impl(ghc >= 8)
       Default-Extensions:  Strict StrictData
   Default-Language:     Haskell2010