diff --git a/ChangeLog.md b/ChangeLog.md
index ac53fef..2aeb87c 100644
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,9 +1,14 @@
 # Changelog
 
+## 2.3.4
+
+- Widen `tls` upper bound from `<2.4` to `<2.5` for tls 2.4.x compatibility
+
 ## 2.3.3
 
 - Bump wai-app-static upper bound to include 3.2.x
-- set tls bound to be bigger then 2.3.0, this forces the solver to include ram on any comming version
+- Add crypton dependency bounds (>=1.1.0 && <1.2) to support upstream RAM changes
+- Add http-client-tls dependency bounds (>=0.4.0 && <0.5)
 
 ## 2.3.2
 
@@ -11,7 +16,6 @@
 - Bump `tls-session-manager` to allow `^>=0.1.0` (needed for tls 2.3.x support).
 
 ## 2.3.1
-
 - Add `port-env-vars` option for webapp stanzas. Allows specifying additional
   environment variable names (e.g., `YESOD_PORT`) that receive the same
   port value as `PORT`. This avoids the need to change app configuration
diff --git a/flake.nix b/flake.nix
index 4267c5b..a03ce9a 100644
--- a/flake.nix
+++ b/flake.nix
@@ -88,7 +88,11 @@
                   "LICENSE"
                 ];
               in
-              hprev.callCabal2nix "keter" haskellSourceFilter { };
+              # doJailbreak: nixpkgs has crypton 1.0.x but cabal file requires >= 1.1.0.
+              # The bound is correct for Hackage/cabal users; jailbreak lets nix CI pass
+              # until nixpkgs updates crypton. Remove once nixpkgs has crypton >= 1.1.0.
+              prev.haskell.lib.doJailbreak
+                (hprev.callCabal2nix "keter" haskellSourceFilter { });
 
           });
         };
diff --git a/keter.cabal b/keter.cabal
index 7871e01..aa341b3 100644
--- a/keter.cabal
+++ b/keter.cabal
@@ -1,6 +1,6 @@
 cabal-version:      3.0
 name:               keter
-version:            2.3.3
+version:            2.3.4
 synopsis:
   Web application deployment manager, focusing on Haskell web frameworks. It mitigates downtime.
 
@@ -39,11 +39,13 @@ library
     , conduit               >=1.3.4    && <1.4
     , conduit-extra         >=1.3.5    && <1.4
     , containers            ^>=0.6.4   || ^>=0.7
+    , crypton               >=1.1.0    && <1.2
     , directory             >=1.3.6    && <1.4
     , fast-logger           >=3.0.0    && <4.0.0
     , filepath              >=1.4.2    && <1.6
     , fsnotify              >=0.3.0    && <0.5
     , http-client           >=0.7.11   && <0.8
+    , http-client-tls       >=0.4.0    && <0.5
     , http-conduit          >=2.3.8    && <2.4
     , http-reverse-proxy    >=0.6.2    && <0.7
     , http-types            >=0.12.3   && <0.13
@@ -62,7 +64,7 @@ library
     , template-haskell      >=2.17.0   && <3.0
     , text                  >=1.2.5    && <3.0
     , time                  >=1.9.3    && <2.0
-    , tls                   >=1.5.7    && <2.4
+    , tls                   >=1.5.7    && <2.5
     , tls-session-manager   >=0.0.4    && <0.1     || ^>=0.1.0
     , transformers          >=0.5.6    && <0.7
     , unix                  >=2.7.2    && <2.9