diff --git a/builtins/web/crypto/crypto-algorithm.cpp b/builtins/web/crypto/crypto-algorithm.cpp
index e1ebbd76..b7e2be09 100644
--- a/builtins/web/crypto/crypto-algorithm.cpp
+++ b/builtins/web/crypto/crypto-algorithm.cpp
@@ -1358,14 +1358,16 @@ JSObject *CryptoAlgorithmHMAC_Import::importKey(JSContext *cx, CryptoKeyFormat f
     return nullptr;
   }
 
-  std::unique_ptr<std::span<uint8_t>> data;
+  std::unique_ptr<std::vector<uint8_t>> data;
   // 3. Let hash be a new KeyAlgorithm.
   // 4.
   switch (format) {
   // 5. If format is "raw":
   case CryptoKeyFormat::Raw: {
     // 5.1 Let data be the octet string contained in keyData.
-    data = std::make_unique<std::span<uint8_t>>(std::get<std::span<uint8_t>>(key_data));
+    // keyData is a view of the caller's buffer, which can change after import, so copy it.
+    auto key_bytes = std::get<std::span<uint8_t>>(key_data);
+    data = std::make_unique<std::vector<uint8_t>>(key_bytes.begin(), key_bytes.end());
     if (!data) {
       DOMException::raise(cx, "Supplied keyData must be either an ArrayBuffer, TypedArray, or DataView.", "DataError");
       return nullptr;
@@ -1400,10 +1402,7 @@ JSObject *CryptoAlgorithmHMAC_Import::importKey(JSContext *cx, CryptoKeyFormat f
       return nullptr;
     }
     auto data_string = dataResult.unwrap();
-    auto ddd = std::vector<uint8_t>(data_string.begin(), data_string.end());
-    data = std::make_unique<std::span<uint8_t>>(
-      ddd
-    );
+    data = std::make_unique<std::vector<uint8_t>>(data_string.begin(), data_string.end());
     // 6.7 Set the hash to equal the hash member of normalizedAlgorithm.
     CryptoAlgorithmIdentifier hash = this->hashIdentifier;
     switch(hash) {
diff --git a/builtins/web/crypto/crypto-key.cpp b/builtins/web/crypto/crypto-key.cpp
index a1d5e6b7..403488bb 100644
--- a/builtins/web/crypto/crypto-key.cpp
+++ b/builtins/web/crypto/crypto-key.cpp
@@ -594,7 +594,7 @@ EvpPkeyPtr create_rsa_key_from_parts(
 } // namespace
 
 JSObject *CryptoKey::createHMAC(JSContext *cx, CryptoAlgorithmHMAC_Import *algorithm,
-                                std::unique_ptr<std::span<uint8_t>> data, unsigned long length,
+                                std::unique_ptr<std::vector<uint8_t>> data, unsigned long length,
                                 bool extractable, CryptoKeyUsages usages) {
   MOZ_ASSERT(cx);
   MOZ_ASSERT(algorithm);
diff --git a/builtins/web/crypto/crypto-key.h b/builtins/web/crypto/crypto-key.h
index 88db236d..f474222c 100644
--- a/builtins/web/crypto/crypto-key.h
+++ b/builtins/web/crypto/crypto-key.h
@@ -126,7 +126,7 @@ class CryptoKey : public BuiltinNoConstructor<CryptoKey> {
   static bool init_class(JSContext *cx, JS::HandleObject global);
 
   static JSObject *createHMAC(JSContext *cx, CryptoAlgorithmHMAC_Import *algorithm,
-                              std::unique_ptr<std::span<uint8_t>> data, unsigned long length,
+                              std::unique_ptr<std::vector<uint8_t>> data, unsigned long length,
                               bool extractable, CryptoKeyUsages usages);
   static JSObject *createRSA(JSContext *cx, CryptoAlgorithmRSASSA_PKCS1_v1_5_Import *algorithm,
                              std::unique_ptr<CryptoKeyRSAComponents> keyData, bool extractable,