diff --git a/README.md b/README.md
index c0ad3cd..2f3a948 100644
--- a/README.md
+++ b/README.md
@@ -93,7 +93,7 @@ to improve hardware capability detection on `android/arm64`.
 (Adapted from ooni/oohttp instructions.)
 
 - [ ] check whether hardware capability detection has been improved upstream
-by reading [os_linux.go](https://github.com/golang/go/blob/go1.20.8/src/runtime/os_linux.go#L246)
+by reading [os_linux.go](https://github.com/golang/go/blob/go1.20.14/src/runtime/os_linux.go#L246)
 and update the link to `os_linux.go` based on the upstream version that
 we're tracking with this fork
 
diff --git a/UPSTREAM b/UPSTREAM
index 54cdc74..e36050d 100644
--- a/UPSTREAM
+++ b/UPSTREAM
@@ -1 +1 @@
-go1.20.12
+go1.20.14
diff --git a/go.mod b/go.mod
index d9045a4..0f62bd2 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,6 @@ module github.com/ooni/oocrypto
 
 go 1.20
 
-require golang.org/x/crypto v0.11.0
+require golang.org/x/crypto v0.21.0
 
-require golang.org/x/sys v0.10.0
+require golang.org/x/sys v0.18.0
diff --git a/go.sum b/go.sum
index 7f80147..137e277 100644
--- a/go.sum
+++ b/go.sum
@@ -1,4 +1,4 @@
-golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA=
-golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio=
-golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA=
-golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=