diff --git a/go.mod b/go.mod
index 6ff55da..ec9e032 100644
--- a/go.mod
+++ b/go.mod
@@ -2,8 +2,8 @@ module github.com/micromdm/nanodep
 
 go 1.17
 
-require go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
-
-require github.com/gomodule/oauth1 v0.2.0
-
-require github.com/go-sql-driver/mysql v1.7.1
+require (
+	github.com/go-sql-driver/mysql v1.7.1
+	github.com/gomodule/oauth1 v0.2.0
+	github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13
+)
diff --git a/go.sum b/go.sum
index 8fe0c9f..c16027b 100644
--- a/go.sum
+++ b/go.sum
@@ -2,5 +2,5 @@ github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrt
 github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI=
 github.com/gomodule/oauth1 v0.2.0 h1:/nNHAD99yipOEspQFbAnNmwGTZ1UNXiD/+JLxwx79fo=
 github.com/gomodule/oauth1 v0.2.0/go.mod h1:4r/a8/3RkhMBxJQWL5qzbOEcaQmNPIkNoI7P8sXeI08=
-go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 h1:CCriYyAfq1Br1aIYettdHZTy8mBTIPo7We18TuO/bak=
-go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352/go.mod h1:SNgMg+EgDFwmvSmLRTNKC5fegJjB7v23qTQ0XLGUNHk=
+github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13 h1:qRxEt9ESQhAg1kjmgJ8oyyzlc9zkAjOooe7bcKjKORQ=
+github.com/smallstep/pkcs7 v0.0.0-20231107075624-be1870d87d13/go.mod h1:SoUAr/4M46rZ3WaLstHxGhLEgoYIDRqxQEXLOmOEB0Y=
diff --git a/tokenpki/parse.go b/tokenpki/parse.go
index 197631b..d234a2d 100644
--- a/tokenpki/parse.go
+++ b/tokenpki/parse.go
@@ -11,7 +11,7 @@ import (
 	"io"
 	"net/textproto"
 
-	"go.mozilla.org/pkcs7"
+	"github.com/smallstep/pkcs7"
 )
 
 // UnwrapSMIME removes the S/MIME-like header wrapper around the raw encrypted