diff --git a/coldcard-cli/Cargo.toml b/coldcard-cli/Cargo.toml
index 6b3408a..8f39ca4 100644
--- a/coldcard-cli/Cargo.toml
+++ b/coldcard-cli/Cargo.toml
@@ -19,14 +19,14 @@ path = "src/main.rs"
 [dependencies]
 coldcard = { version = "0.12.1", path = "../coldcard" }
 base64 = "0.21.7"
-clap = { version = "3.1.6", features = ["derive"] }
+clap = { version = "3.2.22", features = ["derive"] }
 hex = "0.4.3"
 hmac-sha256 = "1.1.7"
 indicatif = "0.17.7"
 json = "0.12.4"
 rpassword = "7.3.1"
-env_logger = "0.11.0"
+env_logger = "0.11.1"
 regex = "1.10.3"
-ureq = "2.9.1"
+ureq = "2.9.4"
 semver = "1.0.21"
 console = "0.15.8"
diff --git a/coldcard/Cargo.toml b/coldcard/Cargo.toml
index f4f5ff1..87ceb7f 100644
--- a/coldcard/Cargo.toml
+++ b/coldcard/Cargo.toml
@@ -15,10 +15,11 @@ linux-static-hidraw = ["hidapi/linux-static-hidraw"]
 linux-static-libusb = ["hidapi/linux-static-libusb"]
 
 [dependencies]
-aes-ctr = "0.6.0"
+aes = "0.8.3"
 base58 = "0.2.0"
 bitcoin_hashes = "0.13.0"
-hidapi = { version = "2.4.1", default-features = false }
+ctr = "0.9.2"
+hidapi = { version = "2.5.1", default-features = false }
 k256 = { version = "0.13.3", features = ["arithmetic"] }
 log = { version = "0.4.20", optional = true }
 rand = "0.8.5"
diff --git a/coldcard/src/lib.rs b/coldcard/src/lib.rs
index 423824a..e452e67 100644
--- a/coldcard/src/lib.rs
+++ b/coldcard/src/lib.rs
@@ -45,6 +45,8 @@ pub mod util;
 use protocol::{DerivationPath, DescriptorName, Request, Response, Username};
 use util::MaybeOwned;
 
+type Aes256Ctr = ctr::Ctr64BE<aes::Aes256>;
+
 /// Coinkite's HID vendor id.
 pub const COINKITE_VID: u16 = 0xd13e;
 /// Coldcard's HID product id.
@@ -191,8 +193,8 @@ pub enum SignMode {
 pub struct Coldcard {
     cc: hidapi::HidDevice,
     session_key: [u8; 32],
-    encrypt: aes_ctr::Aes256Ctr,
-    decrypt: aes_ctr::Aes256Ctr,
+    encrypt: Aes256Ctr,
+    decrypt: Aes256Ctr,
     sn: String,
 
     // performance helpers
@@ -249,8 +251,7 @@ impl Coldcard {
         let session_key = session_key(our_sk, cc_pk)?;
 
         let (encrypt, decrypt) = {
-            use aes_ctr::cipher::{generic_array::GenericArray, stream::NewStreamCipher};
-            use aes_ctr::Aes256Ctr;
+            use aes::cipher::{generic_array::GenericArray, KeyIvInit};
 
             let key = GenericArray::from_slice(&session_key);
             let nonce = GenericArray::from_slice(&[0_u8; 16]);
@@ -739,7 +740,7 @@ fn session_key(sk: k256::SecretKey, pk: k256::PublicKey) -> Result<[u8; 32], Err
 fn send(
     request: Request,
     cc: &mut hidapi::HidDevice,
-    cipher: Option<&mut aes_ctr::Aes256Ctr>,
+    cipher: Option<&mut Aes256Ctr>,
     send_buf: &mut [u8; 2 + constants::CHUNK_SIZE],
 ) -> Result<(), Error> {
     let mut data = request.encode();
@@ -756,7 +757,7 @@ fn send(
     }
 
     if let Some(cipher) = cipher {
-        use aes_ctr::cipher::stream::SyncStreamCipher;
+        use aes::cipher::StreamCipher;
         cipher.apply_keystream(&mut data);
     }
 
@@ -789,7 +790,7 @@ fn send(
 /// Reads a response from a Coldcard.
 fn recv(
     cc: &mut hidapi::HidDevice,
-    cipher: Option<&mut aes_ctr::Aes256Ctr>,
+    cipher: Option<&mut Aes256Ctr>,
     read_buf: &mut [u8; 64],
 ) -> Result<Response, Error> {
     let mut data: Vec<u8> = Vec::new();
@@ -830,7 +831,7 @@ fn recv(
 
     if is_encrypted {
         if let Some(cipher) = cipher {
-            use aes_ctr::cipher::stream::SyncStreamCipher;
+            use aes::cipher::StreamCipher;
             cipher.apply_keystream(data);
         } else {
             return Err(Error::EncryptionNotSetUp);