diff --git a/Cargo.lock b/Cargo.lock
index f7d24bb..e62ae20 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2090,7 +2090,7 @@ dependencies = [
 name = "rite-piv"
 version = "0.4.1"
 dependencies = [
- "der 0.7.10",
+ "der 0.8.0",
  "rite-sdk",
  "serde_json",
  "sha2 0.11.0",
diff --git a/crates/rite-piv/Cargo.toml b/crates/rite-piv/Cargo.toml
index 9d7a0ac..3c92f47 100644
--- a/crates/rite-piv/Cargo.toml
+++ b/crates/rite-piv/Cargo.toml
@@ -18,7 +18,7 @@ yubikey    = { workspace = true }
 # Tracks the `yubikey` crate's der version (0.7), not the workspace der (0.8):
 # this crate only uses der to re-encode certificate/SPKI values returned by
 # yubikey, so its der must match yubikey's or those types lose their der traits.
-der        = "0.7"
+der        = "0.8"
 sha2       = { workspace = true }
 serde_json = { workspace = true }