diff --git a/http-client-tls/ChangeLog.md b/http-client-tls/ChangeLog.md
index 5eeb923d..08116771 100644
--- a/http-client-tls/ChangeLog.md
+++ b/http-client-tls/ChangeLog.md
@@ -1,5 +1,10 @@
 # Changelog for http-client-tls
 
+## 0.3.6.5
+
+* For MD5 hashes in Base16 format, depend on packages `cryptohash-md5` and
+  `base16` rather than `crypton` and `memory` (the latter is unmaintained).
+
 ## 0.3.6.4
 
 * data-default-class -> data-default [#546](https://github.com/snoyberg/http-client/pull/546/files)
diff --git a/http-client-tls/Network/HTTP/Client/TLS.hs b/http-client-tls/Network/HTTP/Client/TLS.hs
index e0103335..965d3fda 100644
--- a/http-client-tls/Network/HTTP/Client/TLS.hs
+++ b/http-client-tls/Network/HTTP/Client/TLS.hs
@@ -41,9 +41,10 @@ import Control.Monad (guard, unless)
 import qualified Data.CaseInsensitive as CI
 import Data.Maybe (fromMaybe, isJust)
 import Network.HTTP.Types (status401)
-import Crypto.Hash (hash, Digest, MD5)
+import qualified Crypto.Hash.MD5 as MD5
 import Control.Arrow ((***))
-import Data.ByteArray.Encoding (convertToBase, Base (Base16))
+import Data.Base16.Types (extractBase16)
+import Data.ByteString.Base16 (encodeBase16')
 import Data.Typeable (Typeable)
 import Control.Monad.Catch (MonadThrow, throwM)
 import qualified Data.Map as Map
@@ -361,7 +362,7 @@ applyDigestAuth user pass req0 man = liftIO $ do
                 -- we always use no qop or qop=auth
                 ha2 = md5 $ S.concat [method req, ":", path req]
 
-                md5 bs = convertToBase Base16 (hash bs :: Digest MD5)
+                md5 = extractBase16 . encodeBase16' . MD5.hash
             key = "Authorization"
             val = S.concat
                 [ "Digest username=\""
diff --git a/http-client-tls/http-client-tls.cabal b/http-client-tls/http-client-tls.cabal
index f8f1a94c..2e2808ab 100644
--- a/http-client-tls/http-client-tls.cabal
+++ b/http-client-tls/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.6.4
+version:             0.3.6.5
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client
@@ -17,6 +17,8 @@ library
   exposed-modules:     Network.HTTP.Client.TLS
   other-extensions:    ScopedTypeVariables
   build-depends:       base >= 4.10 && < 5
+                     , base16
+                     , cryptohash-md5
                      , data-default
                      , http-client >= 0.7.11
                      , crypton-connection
@@ -26,8 +28,6 @@ library
                      , case-insensitive
                      , transformers
                      , http-types
-                     , crypton
-                     , memory
                      , exceptions
                      , containers
                      , text
diff --git a/stack.yaml b/stack.yaml
index f17a8879..88a9d5ee 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -1,4 +1,4 @@
-resolver: nightly-2025-03-20
+snapshot: lts-24.33 # GHC 9.10.3
 packages:
 - http-client
 - http-client-tls
diff --git a/stack.yaml.lock b/stack.yaml.lock
new file mode 100644
index 00000000..a8f2d2f2
--- /dev/null
+++ b/stack.yaml.lock
@@ -0,0 +1,12 @@
+# This file was autogenerated by Stack.
+# You should not edit this file by hand.
+# For more information, please see the documentation at:
+#   https://docs.haskellstack.org/en/stable/topics/lock_files
+
+packages: []
+snapshots:
+- completed:
+    sha256: a8cfaae441160430cdde558cb80d4f9d60746e7417b275250e4e0af57ee14f36
+    size: 728954
+    url: https://raw.githubusercontent.com/commercialhaskell/stackage-snapshots/master/lts/24/33.yaml
+  original: lts-24.33