diff --git a/Cargo.lock b/Cargo.lock
index e8e621e..b94b0f8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -936,9 +936,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkcs8"
-version = "0.11.0-rc.11"
+version = "0.11.0-rc.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "12922b6296c06eb741b02d7b5161e3aaa22864af38dfa025a1a3ba3f68c84577"
+checksum = "9d71d6da5a0e652b5c694049095a52f5e564012b8ee5001cf10d84a4ca9a7f9d"
 dependencies = [
  "der",
  "spki",
@@ -1362,9 +1362,9 @@ dependencies = [
 
 [[package]]
 name = "spki"
-version = "0.8.0-rc.4"
+version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8baeff88f34ed0691978ec34440140e1572b68c7dd4a495fd14a3dc1944daa80"
+checksum = "1d9efca8738c78ee9484207732f728b1ef517bbb1833d6fc0879ca898a522f6f"
 dependencies = [
  "base64ct",
  "der",
diff --git a/ml-kem/Cargo.toml b/ml-kem/Cargo.toml
index e744368..0766231 100644
--- a/ml-kem/Cargo.toml
+++ b/ml-kem/Cargo.toml
@@ -33,7 +33,7 @@ sha3 = { version = "0.11", default-features = false }
 
 # optional dependencies
 const-oid = { version = "0.10.1", optional = true, default-features = false, features = ["db"] }
-pkcs8 = { version = "0.11.0-rc.11", optional = true, default-features = false }
+pkcs8 = { version = "0.11.0-rc.12", optional = true, default-features = false }
 zeroize = { version = "1.8.1", optional = true, default-features = false }
 
 [dev-dependencies]
diff --git a/ml-kem/src/pkcs8.rs b/ml-kem/src/pkcs8.rs
index 1910969..6c12b13 100644
--- a/ml-kem/src/pkcs8.rs
+++ b/ml-kem/src/pkcs8.rs
@@ -159,7 +159,7 @@ where
     /// Serialize the given `DecapsulationKey` into DER format.
     /// Returns a `SecretDocument` which wraps the DER document in case of success.
     fn to_pkcs8_der(&self) -> ::pkcs8::Result<pkcs8::SecretDocument> {
-        let seed = self.to_seed().ok_or(pkcs8::Error::KeyMalformed)?;
+        let seed = self.to_seed().ok_or(pkcs8::KeyError::Invalid)?;
 
         let seed_der = SeedString {
             tag_mode: TagMode::Implicit,
@@ -189,12 +189,12 @@ where
 
         let mut reader = SliceReader::new(private_key_info_ref.private_key.as_bytes())?;
         let seed_string = SeedString::decode_implicit(&mut reader, SEED_TAG_NUMBER)?
-            .ok_or(pkcs8::Error::KeyMalformed)?;
+            .ok_or(pkcs8::KeyError::Invalid)?;
         let seed = seed_string
             .value
             .as_bytes()
             .try_into()
-            .map_err(|_| pkcs8::Error::KeyMalformed)?;
+            .map_err(|_| pkcs8::KeyError::Invalid)?; // TODO(tarcieri): more specific error
         reader.finish()?;
 
         Ok(Self::from_seed(seed))