diff --git a/Cargo.lock b/Cargo.lock
index 2fcbb550..fd93837a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -31,7 +31,7 @@ dependencies = [
  "byteorder 1.3.4",
  "lazy_static",
  "libloading 0.5.2",
- "protobuf",
+ "protobuf 3.5.1",
  "protoc-rust",
  "report-test",
  "sgx-isa",
@@ -2567,13 +2567,33 @@ version = "2.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1b7f4a129bb3754c25a4e04032a90173c68f85168f77118ac4cb4936e7f06f92"
 
+[[package]]
+name = "protobuf"
+version = "3.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0bcc343da15609eaecd65f8aa76df8dc4209d325131d8219358c0aaaebab0bf6"
+dependencies = [
+ "once_cell",
+ "protobuf-support",
+ "thiserror",
+]
+
 [[package]]
 name = "protobuf-codegen"
 version = "2.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5d2fa3a461857508103b914da60dd7b489c1a834967c2e214ecc1496f0c486a"
 dependencies = [
- "protobuf",
+ "protobuf 2.22.1",
+]
+
+[[package]]
+name = "protobuf-support"
+version = "3.5.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f0766e3675a627c327e4b3964582594b0e8741305d628a98a5de75a1d15f99b9"
+dependencies = [
+ "thiserror",
 ]
 
 [[package]]
@@ -2592,7 +2612,7 @@ version = "2.22.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "e5198afa8fca3f419b36db9a70ede51ff845938ef0386b49f4b02a5a322015a6"
 dependencies = [
- "protobuf",
+ "protobuf 2.22.1",
  "protobuf-codegen",
  "protoc",
  "tempfile",
diff --git a/intel-sgx/aesm-client/Cargo.toml b/intel-sgx/aesm-client/Cargo.toml
index 6fae4777..0d639316 100644
--- a/intel-sgx/aesm-client/Cargo.toml
+++ b/intel-sgx/aesm-client/Cargo.toml
@@ -32,7 +32,7 @@ sgx-isa = { version = "0.4.0", path = "../sgx-isa"}
 # External dependencies
 byteorder = "1.0"          # Unlicense/MIT
 lazy_static = "1"          # MIT/Apache-2.0
-protobuf = "2.22.1"        # MIT/Apache-2.0
+protobuf = "3.5.1"        # MIT/Apache-2.0
 thiserror = "1.0"          # MIT/Apache-2.0
 anyhow = "1.0"             # MIT/Apache-2.0