diff --git a/Cargo.lock b/Cargo.lock
index fcf4aee4d..f2bf22bd0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1503,12 +1503,6 @@ dependencies = [
  "parking_lot_core",
 ]
 
-[[package]]
-name = "data-encoding"
-version = "2.8.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "575f75dfd25738df5b91b8e43e14d44bda14637a58fae779fd2b064f8bf3e010"
-
 [[package]]
 name = "deadpool"
 version = "0.10.0"
@@ -3123,8 +3117,8 @@ version = "0.14.1"
 dependencies = [
  "axum",
  "axum-extra",
+ "base64ct",
  "chrono",
- "data-encoding",
  "headers",
  "http",
  "icu_locid",
@@ -4011,8 +4005,8 @@ name = "oauth2-types"
 version = "0.14.1"
 dependencies = [
  "assert_matches",
+ "base64ct",
  "chrono",
- "data-encoding",
  "language-tags",
  "mas-iana",
  "mas-jose",
diff --git a/crates/axum-utils/Cargo.toml b/crates/axum-utils/Cargo.toml
index bc2777658..c3fa87b6d 100644
--- a/crates/axum-utils/Cargo.toml
+++ b/crates/axum-utils/Cargo.toml
@@ -14,8 +14,8 @@ workspace = true
 [dependencies]
 axum.workspace = true
 axum-extra.workspace = true
+base64ct.workspace = true
 chrono.workspace = true
-data-encoding = "2.8.0"
 headers.workspace = true
 http.workspace = true
 icu_locid = "1.5.0"
diff --git a/crates/axum-utils/src/csrf.rs b/crates/axum-utils/src/csrf.rs
index 1ae1dcae2..bf94e4ce9 100644
--- a/crates/axum-utils/src/csrf.rs
+++ b/crates/axum-utils/src/csrf.rs
@@ -4,8 +4,8 @@
 // SPDX-License-Identifier: AGPL-3.0-only
 // Please see LICENSE in the repository root for full details.
 
+use base64ct::{Base64UrlUnpadded, Encoding};
 use chrono::{DateTime, Duration, Utc};
-use data_encoding::{BASE64URL_NOPAD, DecodeError};
 use mas_storage::Clock;
 use rand::{Rng, RngCore, distributions::Standard, prelude::Distribution as _};
 use serde::{Deserialize, Serialize};
@@ -35,7 +35,7 @@ pub enum CsrfError {
 
     /// Failed to decode the token
     #[error("could not decode CSRF token")]
-    Decode(#[from] DecodeError),
+    Decode(#[from] base64ct::Error),
 }
 
 /// A CSRF token
@@ -68,7 +68,7 @@ impl CsrfToken {
     /// Get the value to include in HTML forms
     #[must_use]
     pub fn form_value(&self) -> String {
-        BASE64URL_NOPAD.encode(&self.token[..])
+        Base64UrlUnpadded::encode_string(&self.token[..])
     }
 
     /// Verifies that the value got from an HTML form matches this token
@@ -77,7 +77,7 @@ impl CsrfToken {
     ///
     /// Returns an error if the value in the form does not match this token
     pub fn verify_form_value(&self, form_value: &str) -> Result<(), CsrfError> {
-        let form_value = BASE64URL_NOPAD.decode(form_value.as_bytes())?;
+        let form_value = Base64UrlUnpadded::decode_vec(form_value)?;
         if self.token[..] == form_value {
             Ok(())
         } else {
diff --git a/crates/oauth2-types/Cargo.toml b/crates/oauth2-types/Cargo.toml
index bf4bff277..d8e49f380 100644
--- a/crates/oauth2-types/Cargo.toml
+++ b/crates/oauth2-types/Cargo.toml
@@ -12,6 +12,7 @@ repository.workspace = true
 workspace = true
 
 [dependencies]
+base64ct.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 language-tags = { version = "0.3.2", features = ["serde"] }
@@ -19,7 +20,6 @@ url.workspace = true
 serde_with = { version = "3.12.0", features = ["chrono"] }
 chrono.workspace = true
 sha2 = "0.10.8"
-data-encoding = "2.8.0"
 thiserror.workspace = true
 
 mas-iana.workspace = true
diff --git a/crates/oauth2-types/src/pkce.rs b/crates/oauth2-types/src/pkce.rs
index 786026adb..0682cb149 100644
--- a/crates/oauth2-types/src/pkce.rs
+++ b/crates/oauth2-types/src/pkce.rs
@@ -10,7 +10,7 @@
 
 use std::borrow::Cow;
 
-use data_encoding::BASE64URL_NOPAD;
+use base64ct::{Base64UrlUnpadded, Encoding};
 use mas_iana::oauth::PkceCodeChallengeMethod;
 use serde::{Deserialize, Serialize};
 use sha2::{Digest, Sha256};
@@ -98,7 +98,7 @@ impl CodeChallengeMethodExt for PkceCodeChallengeMethod {
                 let mut hasher = Sha256::new();
                 hasher.update(verifier.as_bytes());
                 let hash = hasher.finalize();
-                let verifier = BASE64URL_NOPAD.encode(&hash);
+                let verifier = Base64UrlUnpadded::encode_string(&hash);
                 verifier.into()
             }
             _ => return Err(CodeChallengeError::UnknownChallengeMethod),