diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 8e27d2fc..3922d74e 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -8,6 +8,7 @@ on:
   push:
     branches:
       - master
+      - ci
   pull_request:
     branches:
       - master
diff --git a/http-client-tls/ChangeLog.md b/http-client-tls/ChangeLog.md
index 5eeb923d..6fc694d8 100644
--- a/http-client-tls/ChangeLog.md
+++ b/http-client-tls/ChangeLog.md
@@ -1,5 +1,10 @@
 # Changelog for http-client-tls
 
+## 0.4.0
+
+* For MD5 hashes in Base16 format, depend on packages `cryptohash-md5` and
+  `base16` rather than `crypton` and `memory` (the latter is unmaintained).
+
 ## 0.3.6.4
 
 * data-default-class -> data-default [#546](https://github.com/snoyberg/http-client/pull/546/files)
diff --git a/http-client-tls/Network/HTTP/Client/TLS.hs b/http-client-tls/Network/HTTP/Client/TLS.hs
index e0103335..965d3fda 100644
--- a/http-client-tls/Network/HTTP/Client/TLS.hs
+++ b/http-client-tls/Network/HTTP/Client/TLS.hs
@@ -41,9 +41,10 @@ import Control.Monad (guard, unless)
 import qualified Data.CaseInsensitive as CI
 import Data.Maybe (fromMaybe, isJust)
 import Network.HTTP.Types (status401)
-import Crypto.Hash (hash, Digest, MD5)
+import qualified Crypto.Hash.MD5 as MD5
 import Control.Arrow ((***))
-import Data.ByteArray.Encoding (convertToBase, Base (Base16))
+import Data.Base16.Types (extractBase16)
+import Data.ByteString.Base16 (encodeBase16')
 import Data.Typeable (Typeable)
 import Control.Monad.Catch (MonadThrow, throwM)
 import qualified Data.Map as Map
@@ -361,7 +362,7 @@ applyDigestAuth user pass req0 man = liftIO $ do
                 -- we always use no qop or qop=auth
                 ha2 = md5 $ S.concat [method req, ":", path req]
 
-                md5 bs = convertToBase Base16 (hash bs :: Digest MD5)
+                md5 = extractBase16 . encodeBase16' . MD5.hash
             key = "Authorization"
             val = S.concat
                 [ "Digest username=\""
diff --git a/http-client-tls/http-client-tls.cabal b/http-client-tls/http-client-tls.cabal
index f8f1a94c..e80136f5 100644
--- a/http-client-tls/http-client-tls.cabal
+++ b/http-client-tls/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.6.4
+version:             0.4.0
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client
@@ -17,6 +17,8 @@ library
   exposed-modules:     Network.HTTP.Client.TLS
   other-extensions:    ScopedTypeVariables
   build-depends:       base >= 4.10 && < 5
+                     , base16 >= 1.0
+                     , cryptohash-md5
                      , data-default
                      , http-client >= 0.7.11
                      , crypton-connection
@@ -26,8 +28,6 @@ library
                      , case-insensitive
                      , transformers
                      , http-types
-                     , crypton
-                     , memory
                      , exceptions
                      , containers
                      , text
diff --git a/http-conduit/http-conduit.cabal b/http-conduit/http-conduit.cabal
index 8062b4da..32cd93a4 100644
--- a/http-conduit/http-conduit.cabal
+++ b/http-conduit/http-conduit.cabal
@@ -68,6 +68,7 @@ test-suite test
                  , warp-tls
                  , tls < 1.5 || >= 1.5.2
                  , time
+                 , time-manager < 0.3
                  , blaze-builder
                  , bytestring
                  , text
diff --git a/stack.yaml b/stack.yaml
index f17a8879..88a9d5ee 100644
--- a/stack.yaml
+++ b/stack.yaml
@@ -1,4 +1,4 @@
-resolver: nightly-2025-03-20
+snapshot: lts-24.33 # GHC 9.10.3
 packages:
 - http-client
 - http-client-tls