diff --git a/zerotier-core-crypto/Cargo.toml b/zerotier-core-crypto/Cargo.toml
index 767075738..378c67ef6 100644
--- a/zerotier-core-crypto/Cargo.toml
+++ b/zerotier-core-crypto/Cargo.toml
@@ -18,7 +18,7 @@ gcrypt = "0.7.0"
 x25519-dalek = { version = "1.2.0", features = ["u64_backend"] }
 ed25519-dalek = { version = "1.0.1", features = ["u64_backend"] }
 heapless = "0.7.7"
-subtle = "^2"
+subtle = "2.4.1"
 
 [dev-dependencies]
 quickcheck = "^1"
diff --git a/zerotier-core-crypto/src/kbkdf.rs b/zerotier-core-crypto/src/kbkdf.rs
index ebbacddc3..d397f9b3c 100644
--- a/zerotier-core-crypto/src/kbkdf.rs
+++ b/zerotier-core-crypto/src/kbkdf.rs
@@ -13,7 +13,6 @@ use crate::secret::Secret;
 /// This is a fixed cost key derivation function used to derive sub-keys from a single original
 /// shared secret for different uses, such as the K0/K1 in AES-GMAC-SIV.
 /// Key must be 384 bits in length.
-#[inline(always)]
 pub fn zt_kbkdf_hmac_sha384(key: &[u8], label: u8, context: u8, iter: u32) -> Secret<{ SHA384_HASH_SIZE }> {
     debug_assert_eq!(key.len(), SHA384_HASH_SIZE);
 
diff --git a/zerotier-network-hypervisor/src/util/gate.rs b/zerotier-network-hypervisor/src/util/gate.rs
index ea53bc1a1..a5545d831 100644
--- a/zerotier-network-hypervisor/src/util/gate.rs
+++ b/zerotier-network-hypervisor/src/util/gate.rs
@@ -9,6 +9,7 @@
 use std::sync::atomic::{AtomicI64, Ordering};
 
 /// Boolean rate limiter with normal (non-atomic) semantics.
+#[repr(transparent)]
 pub struct IntervalGate<const FREQ: i64>(i64);
 
 impl<const FREQ: i64> Default for IntervalGate<FREQ> {
@@ -35,6 +36,7 @@ impl<const FREQ: i64> IntervalGate<FREQ> {
 }
 
 /// Boolean rate limiter with atomic semantics.
+#[repr(transparent)]
 pub struct AtomicIntervalGate<const FREQ: i64>(AtomicI64);
 
 impl<const FREQ: i64> Default for AtomicIntervalGate<FREQ> {