diff --git a/libraries/crypto/Cargo.toml b/libraries/crypto/Cargo.toml
index ead1294..a3322af 100644
--- a/libraries/crypto/Cargo.toml
+++ b/libraries/crypto/Cargo.toml
@@ -23,6 +23,11 @@ serde = { version = "1.0", optional = true, features = ["derive"] }
 serde_json = { version = "1.0", optional = true }
 regex = { version = "1", optional = true }
 
+# We explicitly lock the version of those transitive dependencies because their
+# Cargo.toml don't parse with the nightly compiler used by Tock. Remove this
+# whole block once CTAP is a library.
+bumpalo = "=3.8.0" # transitive dependency of ring
+
 [features]
 std = ["cbor/std", "hex", "rand", "ring", "untrusted", "serde", "serde_json", "regex"]
 derive_debug = []