diff --git a/crates/encryption/Cargo.toml b/crates/encryption/Cargo.toml
index a4f42277..4988dd56 100644
--- a/crates/encryption/Cargo.toml
+++ b/crates/encryption/Cargo.toml
@@ -24,7 +24,10 @@ ed25519-dalek = { version = "2", default-features = false, features = ["alloc",
 sha2 = { version = "0.10", default-features = false }
 # X448 key agreement — AdaWorldAPI fork of RustCrypto/elliptic-curves. No dalek,
 # and crypto-bigint underneath means no foreign AVX2 for the polyfill to fix.
-x448 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", rev = "739304e026fdf06cd1a31606e4db487d3f47c5ae", default-features = false }
+# Floats on `master` (internal pins are prohibited, 2026-11-08): consumers already take
+# `ed448-goldilocks` and `p256` from the same repository on `master`, so a rev here would
+# put a second copy of the curve crate in their graph as soon as `master` moved.
+x448 = { git = "https://github.com/AdaWorldAPI/elliptic-curves", branch = "master", default-features = false }
 zeroize = { version = "1", features = ["derive"] }
 
 # THE ONLY ENTROPY SOURCE. On wasm32 the `js` feature routes this to