diff --git a/ChangeLog.md b/ChangeLog.md
index 957793f..ccdbc92 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,12 +1,17 @@
 # Changelog
 
+## 2.3.3
+
+- Bump wai-app-static upper bound to include 3.2.x
+- Add crypton dependency bounds (>=1.1.0 && <1.2) to support upstream RAM changes
+- Add http-client-tls dependency bounds (>=0.4.0 && <0.5)
+
 ## 2.3.2
 
 - Bump `tls` upper bound from `<2.2` to `<2.4` to allow tls 2.2.x and 2.3.x.
 - Bump `tls-session-manager` to allow `^>=0.1.0` (needed for tls 2.3.x support).
 
 ## 2.3.1
-
 - Add `port-env-vars` option for webapp stanzas. Allows specifying additional
   environment variable names (e.g., `YESOD_PORT`) that receive the same
   port value as `PORT`. This avoids the need to change app configuration
diff --git a/flake.nix b/flake.nix
index 4267c5b..a03ce9a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -88,7 +88,11 @@
                   "LICENSE"
                 ];
               in
-              hprev.callCabal2nix "keter" haskellSourceFilter { };
+              # doJailbreak: nixpkgs has crypton 1.0.x but cabal file requires >= 1.1.0.
+              # The bound is correct for Hackage/cabal users; jailbreak lets nix CI pass
+              # until nixpkgs updates crypton. Remove once nixpkgs has crypton >= 1.1.0.
+              prev.haskell.lib.doJailbreak
+                (hprev.callCabal2nix "keter" haskellSourceFilter { });
 
           });
         };
diff --git a/keter.cabal b/keter.cabal
index 2f393fe..dbc5cac 100644
--- a/keter.cabal
+++ b/keter.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               keter
-version:            2.3.2
+version:            2.3.3
 synopsis:
   Web application deployment manager, focusing on Haskell web frameworks. It mitigates downtime.
 
@@ -39,11 +39,13 @@ library
     , conduit               >=1.3.4    && <1.4
     , conduit-extra         >=1.3.5    && <1.4
     , containers            ^>=0.6.4   || ^>=0.7
+    , crypton               >=1.1.0    && <1.2
     , directory             >=1.3.6    && <1.4
     , fast-logger           >=3.0.0    && <4.0.0
     , filepath              >=1.4.2    && <1.6
     , fsnotify              >=0.3.0    && <0.5
     , http-client           >=0.7.11   && <0.8
+    , http-client-tls       >=0.4.0    && <0.5
     , http-conduit          >=2.3.8    && <2.4
     , http-reverse-proxy    >=0.6.2    && <0.7
     , http-types            >=0.12.3   && <0.13
@@ -71,7 +73,7 @@ library
     , unordered-containers  >=0.2.17   && <0.3
     , vector                >=0.12.3.0 && <1.0.0.0
     , wai                   >=3.2.3    && <3.3
-    , wai-app-static        >=3.1      && <3.2
+    , wai-app-static        >=3.1      && <3.3
     , wai-extra             >=3.0.3    && <3.2
     , warp                  >=3.3.20   && <3.4     || ^>=3.4.0
     , warp-tls              ^>=3.0.3   || ^>=3.1   || ^>=3.2      || ^>=3.3 || ^>=3.4