diff --git a/cabal.project b/cabal.project
index 12875306d..43afe30ea 100644
--- a/cabal.project
+++ b/cabal.project
@@ -4,6 +4,11 @@ packages: .
 -- packages: . ../http2
 -- packages: . ../network-transport
 
+index-state: 2023-12-12T00:00:00Z
+
+package cryptostore
+    flags: +use_crypton
+
 source-repository-package
     type: git
     location: https://github.com/simplex-chat/aeson.git
diff --git a/package.yaml b/package.yaml
index 64f66d939..83d8a1ab2 100644
--- a/package.yaml
+++ b/package.yaml
@@ -36,8 +36,11 @@ dependencies:
   - composition == 1.0.*
   - constraints >= 0.12 && < 0.14
   - containers == 0.6.*
-  - cryptonite == 0.30.*
-  - cryptostore == 0.2.*
+  - crypton == 0.34.*
+  - crypton-x509 == 1.7.*
+  - crypton-x509-store == 1.6.*
+  - crypton-x509-validation == 1.6.*
+  - cryptostore == 0.3.*
   - data-default == 0.7.*
   - direct-sqlcipher == 2.3.*
   - directory == 1.3.*
@@ -65,14 +68,11 @@ dependencies:
   - time == 1.9.*
   - time-compat == 1.9.*
   - time-manager == 0.0.*
-  - tls >= 1.6.0 && < 1.7
+  - tls >= 1.7.0 && < 1.8
   - transformers == 0.6.*
   - unliftio == 0.2.*
   - unliftio-core == 0.2.*
   - websockets == 0.12.*
-  - x509 == 1.7.*
-  - x509-store == 1.6.*
-  - x509-validation == 1.6.*
   - yaml == 0.11.*
 
 flags:
@@ -80,6 +80,10 @@ flags:
     description: Enable swift JSON format
     manual: True
     default: False
+  use_crypton:
+    description: Use crypton etc. in cryptostore
+    manual: True
+    default: True
 
 when:
   - condition: flag(swift)
diff --git a/simplexmq.cabal b/simplexmq.cabal
index e45616c90..7ed3df683 100644
--- a/simplexmq.cabal
+++ b/simplexmq.cabal
@@ -34,6 +34,11 @@ flag swift
   manual: True
   default: False
 
+flag use_crypton
+  description: Use crypton etc. in cryptostore
+  manual: True
+  default: True
+
 library
   exposed-modules:
       Simplex.FileTransfer.Agent
@@ -178,8 +183,11 @@ library
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , direct-sqlcipher ==2.3.*
     , directory ==1.3.*
@@ -207,14 +215,11 @@ library
     , time ==1.9.*
     , time-compat ==1.9.*
     , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)
@@ -250,8 +255,11 @@ executable ntf-server
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , direct-sqlcipher ==2.3.*
     , directory ==1.3.*
@@ -280,14 +288,11 @@ executable ntf-server
     , time ==1.9.*
     , time-compat ==1.9.*
     , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)
@@ -323,8 +328,11 @@ executable smp-agent
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , direct-sqlcipher ==2.3.*
     , directory ==1.3.*
@@ -353,14 +361,11 @@ executable smp-agent
     , time ==1.9.*
     , time-compat ==1.9.*
     , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)
@@ -396,8 +401,11 @@ executable smp-server
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , direct-sqlcipher ==2.3.*
     , directory ==1.3.*
@@ -426,14 +434,11 @@ executable smp-server
     , time ==1.9.*
     , time-compat ==1.9.*
     , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)
@@ -469,8 +474,11 @@ executable xftp
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , direct-sqlcipher ==2.3.*
     , directory ==1.3.*
@@ -499,14 +507,11 @@ executable xftp
     , time ==1.9.*
     , time-compat ==1.9.*
     , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)
@@ -542,8 +547,11 @@ executable xftp-server
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , direct-sqlcipher ==2.3.*
     , directory ==1.3.*
@@ -572,14 +580,11 @@ executable xftp-server
     , time ==1.9.*
     , time-compat ==1.9.*
     , time-manager ==0.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)
@@ -646,8 +651,11 @@ test-suite simplexmq-test
     , composition ==1.0.*
     , constraints >=0.12 && <0.14
     , containers ==0.6.*
-    , cryptonite ==0.30.*
-    , cryptostore ==0.2.*
+    , crypton ==0.34.*
+    , crypton-x509 ==1.7.*
+    , crypton-x509-store ==1.6.*
+    , crypton-x509-validation ==1.6.*
+    , cryptostore ==0.3.*
     , data-default ==0.7.*
     , deepseq ==1.4.*
     , direct-sqlcipher ==2.3.*
@@ -683,14 +691,11 @@ test-suite simplexmq-test
     , time-compat ==1.9.*
     , time-manager ==0.0.*
     , timeit ==2.0.*
-    , tls >=1.6.0 && <1.7
+    , tls >=1.7.0 && <1.8
     , transformers ==0.6.*
     , unliftio ==0.2.*
     , unliftio-core ==0.2.*
     , websockets ==0.12.*
-    , x509 ==1.7.*
-    , x509-store ==1.6.*
-    , x509-validation ==1.6.*
     , yaml ==0.11.*
   default-language: Haskell2010
   if flag(swift)