diff --git a/crates/cargo-util/Cargo.toml b/crates/cargo-util/Cargo.toml
index aa25c137640..7427ceb1a8e 100644
--- a/crates/cargo-util/Cargo.toml
+++ b/crates/cargo-util/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "cargo-util"
-version = "0.2.3"
+version = "0.2.4"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 homepage = "https://github.com/rust-lang/cargo"
@@ -9,7 +9,7 @@ description = "Miscellaneous support code used by Cargo."
 
 [dependencies]
 anyhow = "1.0.34"
-crypto-hash = "0.3.1"
+sha2 = "0.10.6"
 filetime = "0.2.9"
 hex = "0.4.2"
 jobserver = "0.1.26"
diff --git a/crates/cargo-util/src/sha256.rs b/crates/cargo-util/src/sha256.rs
index 58821f43f7a..8906fe93d79 100644
--- a/crates/cargo-util/src/sha256.rs
+++ b/crates/cargo-util/src/sha256.rs
@@ -1,20 +1,20 @@
 use super::paths;
 use anyhow::{Context, Result};
-use crypto_hash::{Algorithm, Hasher};
+use sha2::{Digest, Sha256 as Sha2_sha256};
 use std::fs::File;
-use std::io::{self, Read, Write};
+use std::io::{self, Read};
 use std::path::Path;
 
-pub struct Sha256(Hasher);
+pub struct Sha256(Sha2_sha256);
 
 impl Sha256 {
     pub fn new() -> Sha256 {
-        let hasher = Hasher::new(Algorithm::SHA256);
+        let hasher = Sha2_sha256::new();
         Sha256(hasher)
     }
 
     pub fn update(&mut self, bytes: &[u8]) -> &mut Sha256 {
-        let _ = self.0.write_all(bytes);
+        let _ = self.0.update(bytes);
         self
     }
 
@@ -38,10 +38,7 @@ impl Sha256 {
     }
 
     pub fn finish(&mut self) -> [u8; 32] {
-        let mut ret = [0u8; 32];
-        let data = self.0.finish();
-        ret.copy_from_slice(&data[..]);
-        ret
+        self.0.finalize_reset().into()
     }
 
     pub fn finish_hex(&mut self) -> String {