diff --git a/Cargo.lock b/Cargo.lock
index a2a57081..2629d350 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3180,7 +3180,6 @@ dependencies = [
  "rcgen",
  "regex-set-map",
  "rustls 0.23.16",
- "rustls-pemfile 2.2.0",
  "serde",
  "serde_json",
  "throttle",
diff --git a/Cargo.toml b/Cargo.toml
index 7d6e9548..ac23a16c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -144,7 +144,6 @@ reqwest = {version="0.12", default-features=false, features=["rustls-tls"]}
 ring = "0.17"
 rocksdb = {version="0.22", features=["jemalloc"]}
 rustls = "0.23"
-rustls-pemfile = "2.1"
 rustls-platform-verifier = "0.4"
 self_cell = "1.0"
 serde = {version="1.0", features=["derive"]}
diff --git a/crates/kumo-server-common/Cargo.toml b/crates/kumo-server-common/Cargo.toml
index 2c4b93a5..26ce4108 100644
--- a/crates/kumo-server-common/Cargo.toml
+++ b/crates/kumo-server-common/Cargo.toml
@@ -50,7 +50,6 @@ prometheus = {workspace=true}
 rcgen = {workspace=true}
 regex-set-map = {path="../regex-set-map"}
 rustls = {workspace=true}
-rustls-pemfile = {workspace=true}
 serde = {workspace=true}
 serde_json = {workspace=true}
 throttle = {path="../throttle"}
diff --git a/crates/kumo-server-common/src/tls_helpers.rs b/crates/kumo-server-common/src/tls_helpers.rs
index 0d38ac7b..bb05cf7c 100644
--- a/crates/kumo-server-common/src/tls_helpers.rs
+++ b/crates/kumo-server-common/src/tls_helpers.rs
@@ -1,5 +1,6 @@
 use anyhow::Context;
 use data_loader::KeySource;
+use rustls::pki_types::pem::PemObject;
 use rustls::pki_types::{CertificateDer, PrivateKeyDer, PrivatePkcs8KeyDer};
 use rustls::ServerConfig;
 use std::sync::Arc;
@@ -11,10 +12,8 @@ pub async fn make_server_config(
 ) -> anyhow::Result<Arc<ServerConfig>> {
     let mut certificates = vec![];
     let private_key = match tls_private_key {
-        Some(key) => {
-            let data = key.get().await?;
-            load_private_key(&data).with_context(|| format!("loading private key from {key:?}"))?
-        }
+        Some(key) => PrivateKeyDer::from_pem_slice(&key.get().await?)
+            .with_context(|| format!("loading private key from {key:?}"))?,
         None => {
             let key = rcgen::generate_simple_self_signed(vec![hostname.to_string()])?;
             certificates.push(CertificateDer::from_slice(key.cert.der()).into_owned());
@@ -24,7 +23,8 @@ pub async fn make_server_config(
 
     if let Some(cert_file) = tls_certificate {
         let data = cert_file.get().await?;
-        certificates = load_certs(&data)
+        certificates = CertificateDer::pem_slice_iter(&data)
+            .collect::<Result<Vec<_>, _>>()
             .with_context(|| format!("loading certificates from {cert_file:?}"))?;
     }
 
@@ -34,29 +34,3 @@ pub async fn make_server_config(
 
     Ok(Arc::new(config))
 }
-
-fn load_certs(data: &[u8]) -> anyhow::Result<Vec<CertificateDer<'static>>> {
-    let mut certs = vec![];
-    let mut reader = std::io::BufReader::new(data);
-    for res in rustls_pemfile::certs(&mut reader) {
-        let cert = res.context("failed to read PEM encoded certificates")?;
-        certs.push(cert);
-    }
-    Ok(certs)
-}
-
-fn load_private_key(data: &[u8]) -> anyhow::Result<PrivateKeyDer<'static>> {
-    let mut reader = std::io::BufReader::new(data);
-
-    loop {
-        match rustls_pemfile::read_one(&mut reader).expect("cannot parse private key .pem file") {
-            Some(rustls_pemfile::Item::Pkcs8Key(key)) => return Ok(key.into()),
-            Some(rustls_pemfile::Item::Pkcs1Key(key)) => return Ok(key.into()),
-            Some(rustls_pemfile::Item::Sec1Key(key)) => return Ok(key.into()),
-            None => break,
-            _ => {}
-        }
-    }
-
-    anyhow::bail!("no keys found in key data (encrypted keys not supported)",);
-}