diff --git a/packages/util-crypto/src/blake2/asU8a.ts b/packages/util-crypto/src/blake2/asU8a.ts
index eaf7a80..f62d2ab 100644
--- a/packages/util-crypto/src/blake2/asU8a.ts
+++ b/packages/util-crypto/src/blake2/asU8a.ts
@@ -1,7 +1,7 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { blake2b as blake2bJs } from '@noble/hashes/blake2b';
+import { blake2b as blake2bJs } from '@noble/hashes/blake2';
 
 import { hasBigInt, u8aToU8a } from '@pezkuwi/util';
 import { blake2b, isReady } from '@pezkuwi/wasm-crypto';
diff --git a/packages/util-crypto/src/hmac/shaAsU8a.ts b/packages/util-crypto/src/hmac/shaAsU8a.ts
index ab2e9b7..e41f277 100644
--- a/packages/util-crypto/src/hmac/shaAsU8a.ts
+++ b/packages/util-crypto/src/hmac/shaAsU8a.ts
@@ -1,9 +1,8 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { hmac } from '@noble/hashes/hmac';
-import { sha256 } from '@noble/hashes/sha256';
-import { sha512 } from '@noble/hashes/sha512';
+import { sha256, sha512 } from '@noble/hashes/sha2';
 
 import { hasBigInt, u8aToU8a } from '@pezkuwi/util';
 import { hmacSha256, hmacSha512, isReady } from '@pezkuwi/wasm-crypto';
diff --git a/packages/util-crypto/src/pbkdf2/encode.ts b/packages/util-crypto/src/pbkdf2/encode.ts
index 33e9f4c..d5b15bd 100644
--- a/packages/util-crypto/src/pbkdf2/encode.ts
+++ b/packages/util-crypto/src/pbkdf2/encode.ts
@@ -1,8 +1,8 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { pbkdf2 as pbkdf2Js } from '@noble/hashes/pbkdf2';
-import { sha512 } from '@noble/hashes/sha512';
+import { sha512 } from '@noble/hashes/sha2';
 
 import { hasBigInt, u8aToU8a } from '@pezkuwi/util';
 import { isReady, pbkdf2 } from '@pezkuwi/wasm-crypto';
diff --git a/packages/util-crypto/src/secp256k1/compress.ts b/packages/util-crypto/src/secp256k1/compress.ts
index 914e93e..ad5f600 100644
--- a/packages/util-crypto/src/secp256k1/compress.ts
+++ b/packages/util-crypto/src/secp256k1/compress.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { secp256k1 } from '@noble/curves/secp256k1';
@@ -17,5 +17,5 @@ export function secp256k1Compress (publicKey: Uint8Array, onlyJs?: boolean): Uin
 
   return !hasBigInt || (!onlyJs && isReady())
     ? wasm(publicKey)
-    : secp256k1.ProjectivePoint.fromHex(publicKey).toRawBytes(true);
+    : secp256k1.Point.fromHex(publicKey).toBytes(true);
 }
diff --git a/packages/util-crypto/src/secp256k1/expand.ts b/packages/util-crypto/src/secp256k1/expand.ts
index c4ac98a..c5d705a 100644
--- a/packages/util-crypto/src/secp256k1/expand.ts
+++ b/packages/util-crypto/src/secp256k1/expand.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import { secp256k1 } from '@noble/curves/secp256k1';
@@ -21,7 +21,7 @@ export function secp256k1Expand (publicKey: Uint8Array, onlyJs?: boolean): Uint8
     return wasm(publicKey).subarray(1);
   }
 
-  const { px, py } = secp256k1.ProjectivePoint.fromHex(publicKey);
+  const { x: px, y: py } = secp256k1.Point.fromHex(publicKey).toAffine();
 
   return u8aConcat(
     bnToU8a(px, BN_BE_256_OPTS),
diff --git a/packages/util-crypto/src/secp256k1/recover.ts b/packages/util-crypto/src/secp256k1/recover.ts
index 4e5c33c..9b6be8b 100644
--- a/packages/util-crypto/src/secp256k1/recover.ts
+++ b/packages/util-crypto/src/secp256k1/recover.ts
@@ -1,4 +1,4 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
 import type { HashType } from './types.js';
@@ -21,10 +21,15 @@ export function secp256k1Recover (msgHash: string | Uint8Array, signature: strin
   const publicKey = !hasBigInt || (!onlyJs && isReady())
     ? wasm(msg, sig, recovery)
     : secp256k1.Signature
-      .fromCompact(sig)
+      .fromBytes(sig, 'compact')
       .addRecoveryBit(recovery)
+      // The replacement, secp256k1.recoverPublicKey(bytes, msg), exists at run
+      // time in @noble/curves 1.9 but not in its types (secp256k1 is still
+      // typed as the legacy CurveFn); 2.x has it typed but is ESM-only, which
+      // would break this package's CommonJS build. Kept until then.
+      // eslint-disable-next-line deprecation/deprecation
       .recoverPublicKey(msg)
-      .toRawBytes();
+      .toBytes();
 
   if (!publicKey) {
     throw new Error('Unable to recover publicKey from signature');
diff --git a/packages/util-crypto/src/sha/asU8a.ts b/packages/util-crypto/src/sha/asU8a.ts
index b2da635..d0cac47 100644
--- a/packages/util-crypto/src/sha/asU8a.ts
+++ b/packages/util-crypto/src/sha/asU8a.ts
@@ -1,8 +1,7 @@
-// Copyright 2017-2025 @pezkuwi/util-crypto authors & contributors
+// Copyright 2017-2026 @pezkuwi/util-crypto authors & contributors
 // SPDX-License-Identifier: Apache-2.0
 
-import { sha256 as sha256Js } from '@noble/hashes/sha256';
-import { sha512 as sha512Js } from '@noble/hashes/sha512';
+import { sha256 as sha256Js, sha512 as sha512Js } from '@noble/hashes/sha2';
 
 import { sha256, sha512 } from '@pezkuwi/wasm-crypto';