diff --git a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
index 9956dacf8885..f8e17420c44c 100644
--- a/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
+++ b/pkgs/development/ocaml-modules/ca-certs-nss/default.nix
@@ -1,7 +1,7 @@
 { lib
 , buildDunePackage
 , fetchurl
-, mirage-crypto
+, digestif
 , mirage-clock
 , x509
 , logs
@@ -13,19 +13,19 @@
 
 buildDunePackage rec {
   pname = "ca-certs-nss";
-  version = "3.103";
+  version = "3.107";
 
-  minimalOCamlVersion = "4.08";
+  minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/mirage/ca-certs-nss/releases/download/v${version}/ca-certs-nss-${version}.tbz";
-    hash = "sha256-ZBwPBUwYuBBuzukgocEHBoqorotLmzHkjUYCmWRqYAw=";
+    hash = "sha256-VIT5cIa+MWpQlTLtywPp6Qx5jgCyNEyHRQcQWvXw/GA=";
   };
 
   propagatedBuildInputs = [
-    mirage-crypto
     mirage-clock
     x509
+    digestif
   ];
 
   buildInputs = [