diff --git a/README.md b/README.md
index bfdaca8..b715304 100644
--- a/README.md
+++ b/README.md
@@ -42,4 +42,5 @@ colon in them, and since the WebPKI crate is more strict than Go, Click will not
 from the API Server even though kubectl will.  
 
 For the moment, you can build click, then run the `fix_bad_der.sh` script that's in the util
-directory, and then rebuild click.  This patches WebPKI to accept the cert.
+directory, and then run `cargo clean`, and then rebuild click.  This patches WebPKI to accept the
+cert.
diff --git a/util/fix_bad_der.sh b/util/fix_bad_der.sh
index 5dadd2d..8ee147a 100755
--- a/util/fix_bad_der.sh
+++ b/util/fix_bad_der.sh
@@ -4,7 +4,7 @@
 # cases.  This is a hack, but right now we don't really have a better idea
 
 CARGO_DIR="${CARGO_HOME:-$HOME}/.cargo"
-WEBPKI_VERSION=${WEBPKI_VERSION:-"0.10.2"}
+WEBPKI_VERSION=${WEBPKI_VERSION:-"0.12.1"}
 WEBPKI_DIR=$(find $CARGO_DIR/registry/src/ -name webpki-$WEBPKI_VERSION)
 
 pushd $WEBPKI_DIR