diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1d77998..e599c95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 Entries are listed in reverse chronological order.
 
+# 4.0.2
+
+* Update `curve25519-dalek` to `4.0.0`
+
 # 4.0.1
 
 * Fix no-std build with serde activated (#87)
diff --git a/Cargo.toml b/Cargo.toml
index 817fbdc..2ea461e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -2,7 +2,7 @@
 name = "ed25519-zebra"
 # Before publishing:
 # - update CHANGELOG.md
-version = "4.0.1"
+version = "4.0.2"
 rust-version = "1.65.0"
 authors = ["Henry de Valence <hdevalence@hdevalence.ca>", "Zcash Foundation <zebra@zfnd.org>"]
 license = "MIT OR Apache-2.0"
@@ -15,8 +15,10 @@ resolver = "2"
 features = ["nightly"]
 
 [dependencies]
-# "digest" is exempt from SemVer, so we should always use a specific version
-curve25519-dalek = { version = "=4.0.0-rc.3", default-features = false, features = ["alloc", "digest", "zeroize", "precomputed-tables"] }
+# "digest" is exempt from SemVer but breaking changes will bump minor versions
+# (see https://github.com/dalek-cryptography/curve25519-dalek/tree/main/curve25519-dalek#public-api-semver-exemptions)
+# so only allow patch changes
+curve25519-dalek = { version = "~4.0", default-features = false, features = ["alloc", "digest", "zeroize", "precomputed-tables"] }
 der = { version = "0.7.1", optional = true }
 ed25519 = { version = "2.2.0", default-features = false }
 hashbrown = "0.14.0"