diff --git a/Cargo.lock b/Cargo.lock
index 8a1b8a8a..099aace8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1299,7 +1299,9 @@ dependencies = [
  "hex",
  "hmac",
  "http 1.0.0",
+ "http-body-util",
  "hyper 1.1.0",
+ "hyper-util",
  "k2v-client",
  "kuska-sodiumoxide",
  "mktemp",
@@ -1906,7 +1908,7 @@ dependencies = [
  "hyper 0.14.28",
  "log",
  "rustls 0.20.9",
- "rustls-native-certs",
+ "rustls-native-certs 0.6.3",
  "tokio",
  "tokio-rustls 0.23.4",
 ]
@@ -1922,11 +1924,30 @@ dependencies = [
  "hyper 0.14.28",
  "log",
  "rustls 0.21.10",
- "rustls-native-certs",
+ "rustls-native-certs 0.6.3",
  "tokio",
  "tokio-rustls 0.24.1",
 ]
 
+[[package]]
+name = "hyper-rustls"
+version = "0.26.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
+dependencies = [
+ "futures-util",
+ "http 1.0.0",
+ "hyper 1.1.0",
+ "hyper-util",
+ "log",
+ "rustls 0.22.2",
+ "rustls-native-certs 0.7.0",
+ "rustls-pki-types",
+ "tokio",
+ "tokio-rustls 0.25.0",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-timeout"
 version = "0.4.1"
@@ -2123,8 +2144,10 @@ dependencies = [
  "format_table",
  "hex",
  "http 1.0.0",
+ "http-body-util",
  "hyper 1.1.0",
- "hyper-rustls 0.24.2",
+ "hyper-rustls 0.26.0",
+ "hyper-util",
  "log",
  "percent-encoding",
  "serde",
@@ -2189,7 +2212,7 @@ dependencies = [
  "pem",
  "pin-project",
  "rustls 0.20.9",
- "rustls-pemfile",
+ "rustls-pemfile 1.0.4",
  "secrecy",
  "serde",
  "serde_json",
@@ -3188,7 +3211,7 @@ dependencies = [
  "percent-encoding",
  "pin-project-lite",
  "rustls 0.21.10",
- "rustls-pemfile",
+ "rustls-pemfile 1.0.4",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -3334,10 +3357,24 @@ checksum = "f9d5a6813c0759e4609cd494e8e725babae6a2ca7b62a5536a13daaec6fcb7ba"
 dependencies = [
  "log",
  "ring 0.17.7",
- "rustls-webpki",
+ "rustls-webpki 0.101.7",
  "sct",
 ]
 
+[[package]]
+name = "rustls"
+version = "0.22.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"
+dependencies = [
+ "log",
+ "ring 0.17.7",
+ "rustls-pki-types",
+ "rustls-webpki 0.102.2",
+ "subtle",
+ "zeroize",
+]
+
 [[package]]
 name = "rustls-native-certs"
 version = "0.6.3"
@@ -3345,7 +3382,20 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a9aace74cb666635c918e9c12bc0d348266037aa8eb599b5cba565709a8dff00"
 dependencies = [
  "openssl-probe",
- "rustls-pemfile",
+ "rustls-pemfile 1.0.4",
+ "schannel",
+ "security-framework",
+]
+
+[[package]]
+name = "rustls-native-certs"
+version = "0.7.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792"
+dependencies = [
+ "openssl-probe",
+ "rustls-pemfile 2.0.0",
+ "rustls-pki-types",
  "schannel",
  "security-framework",
 ]
@@ -3359,6 +3409,22 @@ dependencies = [
  "base64 0.21.7",
 ]
 
+[[package]]
+name = "rustls-pemfile"
+version = "2.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "35e4980fa29e4c4b212ffb3db068a564cbf560e51d3944b7c88bd8bf5bec64f4"
+dependencies = [
+ "base64 0.21.7",
+ "rustls-pki-types",
+]
+
+[[package]]
+name = "rustls-pki-types"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a716eb65e3158e90e17cd93d855216e27bde02745ab842f2cab4a39dba1bacf"
+
 [[package]]
 name = "rustls-webpki"
 version = "0.101.7"
@@ -3369,6 +3435,17 @@ dependencies = [
  "untrusted 0.9.0",
 ]
 
+[[package]]
+name = "rustls-webpki"
+version = "0.102.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"
+dependencies = [
+ "ring 0.17.7",
+ "rustls-pki-types",
+ "untrusted 0.9.0",
+]
+
 [[package]]
 name = "rustversion"
 version = "1.0.14"
@@ -3998,6 +4075,17 @@ dependencies = [
  "tokio",
 ]
 
+[[package]]
+name = "tokio-rustls"
+version = "0.25.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"
+dependencies = [
+ "rustls 0.22.2",
+ "rustls-pki-types",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-stream"
 version = "0.1.14"
diff --git a/Cargo.nix b/Cargo.nix
index f0fcce3c..86a20104 100644
--- a/Cargo.nix
+++ b/Cargo.nix
@@ -33,7 +33,7 @@ args@{
   ignoreLockHash,
 }:
 let
-  nixifiedLockHash = "b09e8e1592cb6ec8175708b13ee4a2578aa697c18a94d5a545328078ab263b2f";
+  nixifiedLockHash = "ae22401ab1ffcc653dc14ce17eaece13d9fb2dad1422ae9ada91c1757cc85575";
   workspaceSrc = if args.workspaceSrc == null then ./. else args.workspaceSrc;
   currentLockHash = builtins.hashFile "sha256" (workspaceSrc + /Cargo.lock);
   lockHashIgnored = if ignoreLockHash
@@ -1917,7 +1917,9 @@ in
       chrono = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".chrono."0.4.33" { inherit profileName; }).out;
       hmac = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hmac."0.12.1" { inherit profileName; }).out;
       http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."1.0.0" { inherit profileName; }).out;
+      http_body_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http-body-util."0.1.0" { inherit profileName; }).out;
       hyper = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper."1.1.0" { inherit profileName; }).out;
+      hyper_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper-util."0.1.3" { inherit profileName; }).out;
       k2v_client = (rustPackages."unknown".k2v-client."0.0.4" { inherit profileName; }).out;
       mktemp = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".mktemp."0.5.1" { inherit profileName; }).out;
       serde_json = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".serde_json."1.0.113" { inherit profileName; }).out;
@@ -2731,6 +2733,37 @@ in
     };
   });
   
+  "registry+https://github.com/rust-lang/crates.io-index".hyper-rustls."0.26.0" = overridableMkRustCrate (profileName: rec {
+    name = "hyper-rustls";
+    version = "0.26.0";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"; };
+    features = builtins.concatLists [
+      [ "default" ]
+      [ "http1" ]
+      [ "http2" ]
+      [ "log" ]
+      [ "logging" ]
+      [ "native-tokio" ]
+      [ "ring" ]
+      [ "rustls-native-certs" ]
+      [ "tls12" ]
+    ];
+    dependencies = {
+      futures_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".futures-util."0.3.30" { inherit profileName; }).out;
+      http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."1.0.0" { inherit profileName; }).out;
+      hyper = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper."1.1.0" { inherit profileName; }).out;
+      hyper_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper-util."0.1.3" { inherit profileName; }).out;
+      log = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".log."0.4.20" { inherit profileName; }).out;
+      rustls = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls."0.22.2" { inherit profileName; }).out;
+      rustls_native_certs = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-native-certs."0.7.0" { inherit profileName; }).out;
+      pki_types = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" { inherit profileName; }).out;
+      tokio = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".tokio."1.36.0" { inherit profileName; }).out;
+      tokio_rustls = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".tokio-rustls."0.25.0" { inherit profileName; }).out;
+      tower_service = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".tower-service."0.3.2" { inherit profileName; }).out;
+    };
+  });
+  
   "registry+https://github.com/rust-lang/crates.io-index".hyper-timeout."0.4.1" = overridableMkRustCrate (profileName: rec {
     name = "hyper-timeout";
     version = "0.4.1";
@@ -3007,8 +3040,10 @@ in
       ${ if rootFeatures' ? "k2v-client/cli" || rootFeatures' ? "k2v-client/format_table" then "format_table" else null } = (rustPackages."unknown".format_table."0.1.1" { inherit profileName; }).out;
       hex = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hex."0.4.3" { inherit profileName; }).out;
       http = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http."1.0.0" { inherit profileName; }).out;
+      http_body_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".http-body-util."0.1.0" { inherit profileName; }).out;
       hyper = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper."1.1.0" { inherit profileName; }).out;
-      hyper_rustls = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper-rustls."0.24.2" { inherit profileName; }).out;
+      hyper_rustls = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper-rustls."0.26.0" { inherit profileName; }).out;
+      hyper_util = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".hyper-util."0.1.3" { inherit profileName; }).out;
       log = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".log."0.4.20" { inherit profileName; }).out;
       percent_encoding = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".percent-encoding."2.3.1" { inherit profileName; }).out;
       serde = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".serde."1.0.196" { inherit profileName; }).out;
@@ -4789,6 +4824,27 @@ in
     };
   });
   
+  "registry+https://github.com/rust-lang/crates.io-index".rustls."0.22.2" = overridableMkRustCrate (profileName: rec {
+    name = "rustls";
+    version = "0.22.2";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "e87c9956bd9807afa1f77e0f7594af32566e830e088a5576d27c5b6f30f49d41"; };
+    features = builtins.concatLists [
+      [ "log" ]
+      [ "logging" ]
+      [ "ring" ]
+      [ "tls12" ]
+    ];
+    dependencies = {
+      log = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".log."0.4.20" { inherit profileName; }).out;
+      ring = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".ring."0.17.7" { inherit profileName; }).out;
+      pki_types = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" { inherit profileName; }).out;
+      webpki = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-webpki."0.102.2" { inherit profileName; }).out;
+      subtle = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".subtle."2.5.0" { inherit profileName; }).out;
+      zeroize = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".zeroize."1.7.0" { inherit profileName; }).out;
+    };
+  });
+  
   "registry+https://github.com/rust-lang/crates.io-index".rustls-native-certs."0.6.3" = overridableMkRustCrate (profileName: rec {
     name = "rustls-native-certs";
     version = "0.6.3";
@@ -4802,6 +4858,20 @@ in
     };
   });
   
+  "registry+https://github.com/rust-lang/crates.io-index".rustls-native-certs."0.7.0" = overridableMkRustCrate (profileName: rec {
+    name = "rustls-native-certs";
+    version = "0.7.0";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "8f1fb85efa936c42c6d5fc28d2629bb51e4b2f4b8a5211e297d599cc5a093792"; };
+    dependencies = {
+      ${ if hostPlatform.isUnix && !(hostPlatform.parsed.kernel.name == "darwin") then "openssl_probe" else null } = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".openssl-probe."0.1.5" { inherit profileName; }).out;
+      rustls_pemfile = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pemfile."2.0.0" { inherit profileName; }).out;
+      pki_types = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" { inherit profileName; }).out;
+      ${ if hostPlatform.isWindows then "schannel" else null } = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".schannel."0.1.23" { inherit profileName; }).out;
+      ${ if hostPlatform.parsed.kernel.name == "darwin" then "security_framework" else null } = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".security-framework."2.9.2" { inherit profileName; }).out;
+    };
+  });
+  
   "registry+https://github.com/rust-lang/crates.io-index".rustls-pemfile."1.0.4" = overridableMkRustCrate (profileName: rec {
     name = "rustls-pemfile";
     version = "1.0.4";
@@ -4812,6 +4882,33 @@ in
     };
   });
   
+  "registry+https://github.com/rust-lang/crates.io-index".rustls-pemfile."2.0.0" = overridableMkRustCrate (profileName: rec {
+    name = "rustls-pemfile";
+    version = "2.0.0";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "35e4980fa29e4c4b212ffb3db068a564cbf560e51d3944b7c88bd8bf5bec64f4"; };
+    features = builtins.concatLists [
+      [ "default" ]
+      [ "std" ]
+    ];
+    dependencies = {
+      base64 = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".base64."0.21.7" { inherit profileName; }).out;
+      pki_types = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" { inherit profileName; }).out;
+    };
+  });
+  
+  "registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" = overridableMkRustCrate (profileName: rec {
+    name = "rustls-pki-types";
+    version = "1.2.0";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "0a716eb65e3158e90e17cd93d855216e27bde02745ab842f2cab4a39dba1bacf"; };
+    features = builtins.concatLists [
+      [ "alloc" ]
+      [ "default" ]
+      [ "std" ]
+    ];
+  });
+  
   "registry+https://github.com/rust-lang/crates.io-index".rustls-webpki."0.101.7" = overridableMkRustCrate (profileName: rec {
     name = "rustls-webpki";
     version = "0.101.7";
@@ -4828,6 +4925,23 @@ in
     };
   });
   
+  "registry+https://github.com/rust-lang/crates.io-index".rustls-webpki."0.102.2" = overridableMkRustCrate (profileName: rec {
+    name = "rustls-webpki";
+    version = "0.102.2";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "faaa0a62740bedb9b2ef5afa303da42764c012f743917351dc9a237ea1663610"; };
+    features = builtins.concatLists [
+      [ "alloc" ]
+      [ "ring" ]
+      [ "std" ]
+    ];
+    dependencies = {
+      ring = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".ring."0.17.7" { inherit profileName; }).out;
+      pki_types = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" { inherit profileName; }).out;
+      untrusted = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".untrusted."0.9.0" { inherit profileName; }).out;
+    };
+  });
+  
   "registry+https://github.com/rust-lang/crates.io-index".rustversion."1.0.14" = overridableMkRustCrate (profileName: rec {
     name = "rustversion";
     version = "1.0.14";
@@ -5701,6 +5815,22 @@ in
     };
   });
   
+  "registry+https://github.com/rust-lang/crates.io-index".tokio-rustls."0.25.0" = overridableMkRustCrate (profileName: rec {
+    name = "tokio-rustls";
+    version = "0.25.0";
+    registry = "registry+https://github.com/rust-lang/crates.io-index";
+    src = fetchCratesIo { inherit name version; sha256 = "775e0c0f0adb3a2f22a00c4745d728b479985fc15ee7ca6a2608388c5569860f"; };
+    features = builtins.concatLists [
+      [ "logging" ]
+      [ "tls12" ]
+    ];
+    dependencies = {
+      rustls = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls."0.22.2" { inherit profileName; }).out;
+      pki_types = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".rustls-pki-types."1.2.0" { inherit profileName; }).out;
+      tokio = (rustPackages."registry+https://github.com/rust-lang/crates.io-index".tokio."1.36.0" { inherit profileName; }).out;
+    };
+  });
+  
   "registry+https://github.com/rust-lang/crates.io-index".tokio-stream."0.1.14" = overridableMkRustCrate (profileName: rec {
     name = "tokio-stream";
     version = "0.1.14";
diff --git a/Cargo.toml b/Cargo.toml
index 58b00ee2..b47f2e33 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -116,8 +116,8 @@ opentelemetry-otlp = "0.10"
 prometheus = "0.13"
 
 # used by the k2v-client crate only
-aws-sigv4 = {version = "1.1", features = ["http0-compat"] }
-hyper-rustls = { version = "0.24", features = ["http2"] }
+aws-sigv4 = {version = "1.1" }
+hyper-rustls = { version = "0.26", features = ["http2"] }
 log = "0.4"
 thiserror = "1.0"
 
diff --git a/src/garage/Cargo.toml b/src/garage/Cargo.toml
index 1d299030..41fd32a1 100644
--- a/src/garage/Cargo.toml
+++ b/src/garage/Cargo.toml
@@ -66,7 +66,9 @@ aws-sdk-s3.workspace = true
 chrono.workspace = true
 http.workspace = true
 hmac.workspace = true
+http-body-util.workspace = true
 hyper.workspace = true
+hyper-util.workspace = true
 mktemp.workspace = true
 sha2.workspace = true
 
diff --git a/src/garage/tests/common/custom_requester.rs b/src/garage/tests/common/custom_requester.rs
index 4133bb8b..72fb1a46 100644
--- a/src/garage/tests/common/custom_requester.rs
+++ b/src/garage/tests/common/custom_requester.rs
@@ -5,12 +5,17 @@ use std::convert::TryFrom;
 
 use chrono::{offset::Utc, DateTime};
 use hmac::{Hmac, Mac};
-use hyper::client::HttpConnector;
-use hyper::{Body, Client, Method, Request, Response, Uri};
+use http_body_util::BodyExt;
+use http_body_util::Full as FullBody;
+use hyper::{Method, Request, Response, Uri};
+use hyper_util::client::legacy::{connect::HttpConnector, Client};
+use hyper_util::rt::TokioExecutor;
 
 use super::garage::{Instance, Key};
 use garage_api::signature;
 
+pub type Body = FullBody<hyper::body::Bytes>;
+
 /// You should ever only use this to send requests AWS sdk won't send,
 /// like to reproduce behavior of unusual implementations found to be
 /// problematic.
@@ -19,7 +24,7 @@ pub struct CustomRequester {
 	key: Key,
 	uri: Uri,
 	service: &'static str,
-	client: Client<HttpConnector>,
+	client: Client<HttpConnector, Body>,
 }
 
 impl CustomRequester {
@@ -28,7 +33,7 @@ impl CustomRequester {
 			key: key.clone(),
 			uri: instance.s3_uri(),
 			service: "s3",
-			client: Client::new(),
+			client: Client::builder(TokioExecutor::new()).build_http(),
 		}
 	}
 
@@ -37,7 +42,7 @@ impl CustomRequester {
 			key: key.clone(),
 			uri: instance.k2v_uri(),
 			service: "k2v",
-			client: Client::new(),
+			client: Client::builder(TokioExecutor::new()).build_http(),
 		}
 	}
 
@@ -139,7 +144,7 @@ impl<'a> RequestBuilder<'a> {
 		self
 	}
 
-	pub async fn send(&mut self) -> hyper::Result<Response<Body>> {
+	pub async fn send(&mut self) -> Result<Response<Body>, String> {
 		// TODO this is a bit incorrect in that path and query params should be url-encoded and
 		// aren't, but this is good enought for now.
 
@@ -242,7 +247,22 @@ impl<'a> RequestBuilder<'a> {
 			.method(self.method.clone())
 			.body(Body::from(body))
 			.unwrap();
-		self.requester.client.request(request).await
+
+		let result = self
+			.requester
+			.client
+			.request(request)
+			.await
+			.map_err(|err| format!("hyper client error: {}", err))?;
+
+		let (head, body) = result.into_parts();
+		let body = Body::new(
+			body.collect()
+				.await
+				.map_err(|err| format!("hyper client error in body.collect: {}", err))?
+				.to_bytes(),
+		);
+		Ok(Response::from_parts(head, body))
 	}
 }
 
diff --git a/src/garage/tests/k2v/batch.rs b/src/garage/tests/k2v/batch.rs
index 417fe7ea..39554d4d 100644
--- a/src/garage/tests/k2v/batch.rs
+++ b/src/garage/tests/k2v/batch.rs
@@ -7,7 +7,8 @@ use base64::prelude::*;
 use serde_json::json;
 
 use crate::json_body;
-use hyper::{body::HttpBody, Method, StatusCode};
+use http_body_util::BodyExt;
+use hyper::{Method, StatusCode};
 
 #[tokio::test]
 async fn test_batch() {
diff --git a/src/garage/tests/k2v/item.rs b/src/garage/tests/k2v/item.rs
index 6b653088..5a347bd9 100644
--- a/src/garage/tests/k2v/item.rs
+++ b/src/garage/tests/k2v/item.rs
@@ -7,7 +7,8 @@ use base64::prelude::*;
 use serde_json::json;
 
 use crate::json_body;
-use hyper::{body::HttpBody, Method, StatusCode};
+use http_body_util::BodyExt;
+use hyper::{Method, StatusCode};
 
 #[tokio::test]
 async fn test_items_and_indices() {
diff --git a/src/garage/tests/k2v/poll.rs b/src/garage/tests/k2v/poll.rs
index b75fa9c7..277f8bc8 100644
--- a/src/garage/tests/k2v/poll.rs
+++ b/src/garage/tests/k2v/poll.rs
@@ -1,5 +1,6 @@
 use base64::prelude::*;
-use hyper::{body::HttpBody, Method, StatusCode};
+use http_body_util::BodyExt;
+use hyper::{Method, StatusCode};
 use std::time::Duration;
 
 use assert_json_diff::assert_json_eq;
diff --git a/src/garage/tests/k2v/simple.rs b/src/garage/tests/k2v/simple.rs
index a1d5008b..1017330d 100644
--- a/src/garage/tests/k2v/simple.rs
+++ b/src/garage/tests/k2v/simple.rs
@@ -1,6 +1,7 @@
 use crate::common;
 
-use hyper::{body::HttpBody, Method, StatusCode};
+use http_body_util::BodyExt;
+use hyper::{Method, StatusCode};
 
 #[tokio::test]
 async fn test_simple() {
diff --git a/src/garage/tests/lib.rs b/src/garage/tests/lib.rs
index 3cb17a2b..ef370db3 100644
--- a/src/garage/tests/lib.rs
+++ b/src/garage/tests/lib.rs
@@ -11,9 +11,14 @@ mod k2v;
 #[cfg(feature = "k2v")]
 mod k2v_client;
 
-use hyper::{body::HttpBody, Body, Response};
+use http_body_util::BodyExt;
+use hyper::{body::Body, Response};
 
-pub async fn json_body(res: Response<Body>) -> serde_json::Value {
+pub async fn json_body<B>(res: Response<B>) -> serde_json::Value
+where
+	B: Body,
+	<B as Body>::Error: std::fmt::Debug,
+{
 	let body = res.into_body().collect().await.unwrap().to_bytes();
 	let res_body: serde_json::Value = serde_json::from_slice(&body).unwrap();
 	res_body
diff --git a/src/garage/tests/s3/website.rs b/src/garage/tests/s3/website.rs
index 94acafc7..19f53fcd 100644
--- a/src/garage/tests/s3/website.rs
+++ b/src/garage/tests/s3/website.rs
@@ -8,15 +8,18 @@ use aws_sdk_s3::{
 	types::{CorsConfiguration, CorsRule, ErrorDocument, IndexDocument, WebsiteConfiguration},
 };
 use http::{Request, StatusCode};
-use hyper::{
-	body::{Body, HttpBody},
-	Client,
-};
+use http_body_util::BodyExt;
+use http_body_util::Full as FullBody;
+use hyper::body::Bytes;
+use hyper_util::client::legacy::Client;
+use hyper_util::rt::TokioExecutor;
 use serde_json::json;
 
 const BODY: &[u8; 16] = b"<h1>bonjour</h1>";
 const BODY_ERR: &[u8; 6] = b"erreur";
 
+pub type Body = FullBody<Bytes>;
+
 #[tokio::test]
 async fn test_website() {
 	const BCKT_NAME: &str = "my-website";
@@ -34,14 +37,14 @@ async fn test_website() {
 		.await
 		.unwrap();
 
-	let client = Client::new();
+	let client = Client::builder(TokioExecutor::new()).build_http();
 
 	let req = || {
 		Request::builder()
 			.method("GET")
 			.uri(format!("http://127.0.0.1:{}/", ctx.garage.web_port))
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
@@ -49,7 +52,7 @@ async fn test_website() {
 
 	assert_eq!(resp.status(), StatusCode::NOT_FOUND);
 	assert_ne!(
-		resp.into_body().collect().await.unwrap().to_bytes(),
+		BodyExt::collect(resp.into_body()).await.unwrap().to_bytes(),
 		BODY.as_ref()
 	); /* check that we do not leak body */
 
@@ -61,7 +64,7 @@ async fn test_website() {
 				ctx.garage.admin_port,
 				BCKT_NAME.to_string()
 			))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
@@ -103,7 +106,7 @@ async fn test_website() {
 					"http://127.0.0.1:{0}/check?domain={1}",
 					ctx.garage.admin_port, bname
 				))
-				.body(Body::empty())
+				.body(Body::new(Bytes::new()))
 				.unwrap()
 		};
 
@@ -136,7 +139,7 @@ async fn test_website() {
 				ctx.garage.admin_port,
 				BCKT_NAME.to_string()
 			))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
@@ -248,7 +251,7 @@ async fn test_website_s3_api() {
 		);
 	}
 
-	let client = Client::new();
+	let client = Client::builder(TokioExecutor::new()).build_http();
 
 	// Test direct requests with CORS
 	{
@@ -257,7 +260,7 @@ async fn test_website_s3_api() {
 			.uri(format!("http://127.0.0.1:{}/site/", ctx.garage.web_port))
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
 			.header("Origin", "https://example.com")
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap();
 
 		let resp = client.request(req).await.unwrap();
@@ -282,7 +285,7 @@ async fn test_website_s3_api() {
 				ctx.garage.web_port
 			))
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap();
 
 		let resp = client.request(req).await.unwrap();
@@ -302,7 +305,7 @@ async fn test_website_s3_api() {
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
 			.header("Origin", "https://example.com")
 			.header("Access-Control-Request-Method", "PUT")
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap();
 
 		let resp = client.request(req).await.unwrap();
@@ -326,7 +329,7 @@ async fn test_website_s3_api() {
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
 			.header("Origin", "https://example.com")
 			.header("Access-Control-Request-Method", "DELETE")
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap();
 
 		let resp = client.request(req).await.unwrap();
@@ -367,7 +370,7 @@ async fn test_website_s3_api() {
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
 			.header("Origin", "https://example.com")
 			.header("Access-Control-Request-Method", "PUT")
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap();
 
 		let resp = client.request(req).await.unwrap();
@@ -393,7 +396,7 @@ async fn test_website_s3_api() {
 			.method("GET")
 			.uri(format!("http://127.0.0.1:{}/site/", ctx.garage.web_port))
 			.header("Host", format!("{}.web.garage", BCKT_NAME))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap();
 
 		let resp = client.request(req).await.unwrap();
@@ -409,13 +412,13 @@ async fn test_website_s3_api() {
 async fn test_website_check_domain() {
 	let ctx = common::context();
 
-	let client = Client::new();
+	let client = Client::builder(TokioExecutor::new()).build_http();
 
 	let admin_req = || {
 		Request::builder()
 			.method("GET")
 			.uri(format!("http://127.0.0.1:{}/check", ctx.garage.admin_port))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
@@ -439,7 +442,7 @@ async fn test_website_check_domain() {
 				"http://127.0.0.1:{}/check?domain=",
 				ctx.garage.admin_port
 			))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
@@ -463,7 +466,7 @@ async fn test_website_check_domain() {
 				"http://127.0.0.1:{}/check?domain=foobar",
 				ctx.garage.admin_port
 			))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
@@ -487,7 +490,7 @@ async fn test_website_check_domain() {
 				"http://127.0.0.1:{}/check?domain=%E2%98%B9",
 				ctx.garage.admin_port
 			))
-			.body(Body::empty())
+			.body(Body::new(Bytes::new()))
 			.unwrap()
 	};
 
diff --git a/src/k2v-client/Cargo.toml b/src/k2v-client/Cargo.toml
index 9f27c47d..694be1f8 100644
--- a/src/k2v-client/Cargo.toml
+++ b/src/k2v-client/Cargo.toml
@@ -13,11 +13,13 @@ base64.workspace = true
 sha2.workspace = true
 hex.workspace = true
 http.workspace = true
+http-body-util.workspace = true
 log.workspace = true
 aws-sigv4.workspace = true
 aws-sdk-config.workspace = true
 percent-encoding.workspace = true
-hyper = { workspace = true, default-features = false, features = ["client", "http1", "http2"] }
+hyper = { workspace = true, default-features = false, features = ["http1", "http2"] }
+hyper-util.workspace = true
 hyper-rustls.workspace = true
 serde.workspace = true
 serde_json.workspace = true
diff --git a/src/k2v-client/error.rs b/src/k2v-client/error.rs
index aa84ee9f..96f5674a 100644
--- a/src/k2v-client/error.rs
+++ b/src/k2v-client/error.rs
@@ -22,6 +22,8 @@ pub enum Error {
 	Http(#[from] http::Error),
 	#[error("hyper error: {0}")]
 	Hyper(#[from] hyper::Error),
+	#[error("hyper client error: {0}")]
+	HyperClient(#[from] hyper_util::client::legacy::Error),
 	#[error("invalid header: {0}")]
 	Header(#[from] hyper::header::ToStrError),
 	#[error("deserialization error: {0}")]
diff --git a/src/k2v-client/lib.rs b/src/k2v-client/lib.rs
index f70442f4..13538909 100644
--- a/src/k2v-client/lib.rs
+++ b/src/k2v-client/lib.rs
@@ -9,9 +9,11 @@ use percent_encoding::{utf8_percent_encode, AsciiSet, NON_ALPHANUMERIC};
 use http::header::{ACCEPT, CONTENT_TYPE};
 use http::status::StatusCode;
 use http::{HeaderName, HeaderValue, Request};
-use hyper::{body::Bytes, body::HttpBody, Body};
-use hyper::{client::connect::HttpConnector, Client as HttpClient};
+use http_body_util::{BodyExt, Full as FullBody};
+use hyper::{body::Body as BodyTrait, body::Bytes};
 use hyper_rustls::HttpsConnector;
+use hyper_util::client::legacy::{connect::HttpConnector, Client as HttpClient};
+use hyper_util::rt::TokioExecutor;
 
 use aws_sdk_config::config::Credentials;
 use aws_sigv4::http_request::{sign, SignableBody, SignableRequest, SigningSettings};
@@ -24,6 +26,8 @@ mod error;
 
 pub use error::Error;
 
+pub type Body = FullBody<Bytes>;
+
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(5);
 const DEFAULT_POLL_TIMEOUT: Duration = Duration::from_secs(300);
 const SERVICE: &str = "k2v";
@@ -55,19 +59,19 @@ pub struct K2vClientConfig {
 pub struct K2vClient {
 	config: K2vClientConfig,
 	user_agent: HeaderValue,
-	client: HttpClient<HttpsConnector<HttpConnector>>,
+	client: HttpClient<HttpsConnector<HttpConnector>, Body>,
 }
 
 impl K2vClient {
 	/// Create a new K2V client.
 	pub fn new(config: K2vClientConfig) -> Result<Self, Error> {
 		let connector = hyper_rustls::HttpsConnectorBuilder::new()
-			.with_native_roots()
+			.with_native_roots()?
 			.https_or_http()
 			.enable_http1()
 			.enable_http2()
 			.build();
-		let client = HttpClient::builder().build(connector);
+		let client = HttpClient::builder(TokioExecutor::new()).build(connector);
 		let user_agent: std::borrow::Cow<str> = match &config.user_agent {
 			Some(ua) => ua.into(),
 			None => format!("k2v/{}", env!("CARGO_PKG_VERSION")).into(),
@@ -395,7 +399,7 @@ impl K2vClient {
 		// Sign and then apply the signature to the request
 		let (signing_instructions, _signature) =
 			sign(signable_request, &signing_params)?.into_parts();
-		signing_instructions.apply_to_request_http0x(&mut req);
+		signing_instructions.apply_to_request_http1x(&mut req);
 
 		// Send and wait for timeout
 		let res = tokio::select! {
@@ -416,7 +420,7 @@ impl K2vClient {
 		};
 
 		let body = match res.status {
-			StatusCode::OK => body.collect().await?.to_bytes(),
+			StatusCode::OK => BodyExt::collect(body).await?.to_bytes(),
 			StatusCode::NO_CONTENT => Bytes::new(),
 			StatusCode::NOT_FOUND => return Err(Error::NotFound),
 			StatusCode::NOT_MODIFIED => Bytes::new(),