diff --git a/Cargo.lock b/Cargo.lock
index 0a56f3c51..430634455 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -3282,6 +3282,26 @@ dependencies = [
  "pkg-config",
 ]
 
+[[package]]
+name = "liblzma"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "243510a5543c358949902b9e76daec3a32d7b03a43abce823e7c62a1a8360172"
+dependencies = [
+ "liblzma-sys",
+]
+
+[[package]]
+name = "liblzma-sys"
+version = "0.3.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "83cf78d20a45b5c0f3c7da2dcac255b230efe7d8684282bd35873164c1491187"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+]
+
 [[package]]
 name = "libm"
 version = "0.2.8"
@@ -3712,7 +3732,7 @@ version = "5.0.0-alpha.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "098af5a5110b4deacf3200682963713b143ae9d28762b739bdb7b98429dfaf68"
 dependencies = [
- "base64 0.21.7",
+ "base64 0.22.1",
  "chrono",
  "getrandom",
  "http 1.1.0",
@@ -5068,16 +5088,6 @@ dependencies = [
  "walkdir",
 ]
 
-[[package]]
-name = "rust-lzma"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7d62915608f6cee1d7f2fc00f28b4f058ff79d6e4ec3c2fe0006b09b52437c84"
-dependencies = [
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "rust_decimal"
 version = "1.35.0"
@@ -5532,7 +5542,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b870b0275eeae174058fcf0ce5affccaaafeb7eceeabce8d6c7f51fbe6a41e2a"
 dependencies = [
  "anyhow",
- "base64 0.21.7",
+ "base64 0.22.1",
  "buffered-reader",
  "chrono",
  "dyn-clone",
@@ -7137,9 +7147,9 @@ version = "0.1.0-alpha.11"
 dependencies = [
  "anyhow",
  "futures",
+ "liblzma",
  "log",
  "postgresql_embedded",
- "rust-lzma",
  "test-context",
  "test-log",
  "tokio",
@@ -7158,6 +7168,7 @@ version = "0.1.0-alpha.11"
 dependencies = [
  "anyhow",
  "clap",
+ "liblzma",
  "libz-sys",
  "log",
  "openssl",
diff --git a/Cargo.toml b/Cargo.toml
index 19e61047e..7cef3cb45 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -63,6 +63,7 @@ itertools = "0.13"
 jsn = "0.14"
 jsonpath-rust = "0.6.1"
 lenient_semver = "0.4.2"
+liblzma = "0.3"
 libz-sys = "*"
 log = "0.4.19"
 native-tls = "0.2"
@@ -84,7 +85,6 @@ regex = "1.10.3"
 reqwest = "0.12"
 ring = "0.17.8"
 rstest = "0.21"
-rust-lzma = "0.6.0"
 sbom-walker = { version = "0.8.6", default-features = false, features = ["crypto-openssl", "cyclonedx-bom", "spdx-rs"] }
 schemars = "0.8"
 sea-orm = "0.12"
diff --git a/test-context/Cargo.toml b/test-context/Cargo.toml
index e4164812a..98829c1b3 100644
--- a/test-context/Cargo.toml
+++ b/test-context/Cargo.toml
@@ -8,16 +8,17 @@ trustify-common = { workspace = true }
 trustify-migration = { workspace = true }
 trustify-module-ingestor = { workspace = true }
 trustify-module-storage = { workspace = true }
-test-context = { workspace = true }
-postgresql_embedded = { workspace = true }
-tracing = { workspace = true }
+
 anyhow = { workspace = true }
-rust-lzma = { workspace = true }
+futures = { workspace = true }
+liblzma = { workspace = true }
 log = { workspace = true }
+postgresql_embedded = { workspace = true }
+test-context = { workspace = true }
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
 tokio-util = { workspace = true }
-futures = { workspace = true }
+tracing = { workspace = true }
 
 [dev-dependencies]
 #chrono = { workspace = true }
diff --git a/test-context/src/lib.rs b/test-context/src/lib.rs
index 58dfda870..292737bbb 100644
--- a/test-context/src/lib.rs
+++ b/test-context/src/lib.rs
@@ -55,7 +55,7 @@ impl TrustifyContext {
         let mut bytes = Vec::new();
         file.read_to_end(&mut bytes).await?;
         if path.ends_with(".xz") {
-            bytes = lzma::decompress(&bytes)?;
+            bytes = liblzma::decode_all(&*bytes)?;
         }
         Ok(Bytes::copy_from_slice(&bytes))
     }
diff --git a/trustd/Cargo.toml b/trustd/Cargo.toml
index 1571c7803..439ffd90e 100644
--- a/trustd/Cargo.toml
+++ b/trustd/Cargo.toml
@@ -22,6 +22,7 @@ url = { workspace = true }
 
 openssl = { workspace = true }
 libz-sys = { workspace = true }
+liblzma = { workspace = true }
 
 [dev-dependencies]
 temp-env = { workspace = true }
@@ -36,7 +37,8 @@ vendored = [
     "openssl/vendored",
     # when using a vendored approach, we need to statically link zlib, otherwise we get some strange linker error
     #   unresolvable R_AARCH64_ADR_PREL_PG_HI21 relocation against symbol `__stack_chk_guard@@GLIBC_2.17'
-    "libz-sys/static"
+    "libz-sys/static",
+    "liblzma/static",
 ]
 pm = [
     "garage-door",