diff --git a/Cargo.lock b/Cargo.lock
index f3191af..07b5825 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -54,7 +54,7 @@ version = "0.3.3"
 dependencies = [
  "age-core",
  "age-plugin",
- "base64 0.20.0",
+ "base64 0.21.0",
  "bech32",
  "console",
  "dialoguer",
@@ -162,12 +162,6 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9e1b586273c5702936fe7b7d6896644d8be71e6314cfe09d3167c95f712589e8"
 
-[[package]]
-name = "base64"
-version = "0.20.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0ea22880d78093b0cbe17c89f64a7d457941e65759157ec6cb31a31d652b05e5"
-
 [[package]]
 name = "base64"
 version = "0.21.0"
diff --git a/Cargo.toml b/Cargo.toml
index 48a1c70..8a119b3 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,7 +24,7 @@ assets = [
 [dependencies]
 age-core = "0.9"
 age-plugin = "0.4"
-base64 = "0.20"
+base64 = "0.21"
 bech32 = "0.9"
 console = { version = "0.15", default-features = false }
 dialoguer = { version = "0.10", default-features = false, features = ["password"] }
diff --git a/src/format.rs b/src/format.rs
index d9c0bd2..56d1e50 100644
--- a/src/format.rs
+++ b/src/format.rs
@@ -3,6 +3,7 @@ use age_core::{
     primitives::aead_encrypt,
     secrecy::ExposeSecret,
 };
+use base64::{prelude::BASE64_STANDARD_NO_PAD, Engine};
 use p256::{
     ecdh::EphemeralSecret,
     elliptic_curve::sec1::{FromEncodedPoint, ToEncodedPoint},
@@ -18,14 +19,6 @@ const TAG_BYTES: usize = 4;
 const EPK_BYTES: usize = 33;
 const ENCRYPTED_FILE_KEY_BYTES: usize = 32;
 
-const STANDARD_NO_PAD: &base64::engine::fast_portable::FastPortable = {
-    use base64::{
-        alphabet::STANDARD,
-        engine::fast_portable::{FastPortable, NO_PAD},
-    };
-    &FastPortable::from(&STANDARD, NO_PAD)
-};
-
 /// The ephemeral key bytes in a piv-p256 stanza.
 ///
 /// The bytes contain a compressed SEC-1 encoding of a valid point.
@@ -73,8 +66,8 @@ impl From<RecipientLine> for Stanza {
         Stanza {
             tag: STANZA_TAG.to_owned(),
             args: vec![
-                base64::encode_engine(&r.tag, STANDARD_NO_PAD),
-                base64::encode_engine(r.epk_bytes.as_bytes(), STANDARD_NO_PAD),
+                BASE64_STANDARD_NO_PAD.encode(&r.tag),
+                BASE64_STANDARD_NO_PAD.encode(r.epk_bytes.as_bytes()),
             ],
             body: r.encrypted_file_key.to_vec(),
         }
@@ -92,9 +85,10 @@ impl RecipientLine {
                 return None;
             }
 
-            base64::decode_engine_slice(arg, buf.as_mut(), STANDARD_NO_PAD)
+            BASE64_STANDARD_NO_PAD
+                .decode_slice_unchecked(arg, buf.as_mut())
                 .ok()
-                .map(|_| buf)
+                .and_then(|len| (len == buf.as_mut().len()).then_some(buf))
         }
 
         let (tag, epk_bytes) = match &s.args[..] {