diff --git a/Cargo.lock b/Cargo.lock
index e7f0af47..35e666e0 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2593,9 +2593,9 @@ dependencies = [
 
 [[package]]
 name = "pubgrub"
-version = "0.3.0"
+version = "0.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3f5df7e552bc7edd075f5783a87fbfc21d6a546e32c16985679c488c18192d83"
+checksum = "a1c3256d319f1ed35251223140ab8f29fd6b0528a1216344efd904c651fecd5e"
 dependencies = [
  "indexmap",
  "log",
diff --git a/core/Cargo.toml b/core/Cargo.toml
index 03cd1221..e2008e5a 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -42,7 +42,7 @@ fluent-uri = { version = "0.4.1", features = ["serde"] }
 indexmap = { version = "2.13.0", default-features = false, features = ["serde"] }
 # icu_normalizer = { version = "2.0.0", default-features = false, features = ["compiled_data"] }
 log = { version = "0.4.29", default-features = false }
-pubgrub = { version = "0.3.0", default-features = false }
+pubgrub = { version = "0.4.0", default-features = false }
 # partialzip = { version = "5.0.0", default-features = false, optional = true }
 pyo3 = { version = "0.28.2", default-features = false, features = ["macros", "chrono", "indexmap"], optional = true }
 reqwest-middleware = { version = "0.5.1", features = ["multipart"] }
diff --git a/core/src/solve/pubgrub.rs b/core/src/solve/pubgrub.rs
index 42391477..b584c269 100644
--- a/core/src/solve/pubgrub.rs
+++ b/core/src/solve/pubgrub.rs
@@ -2,7 +2,9 @@
 // SPDX-FileCopyrightText: © 2025 Sysand contributors <opensource@sensmetry.com>
 
 use fluent_uri::Iri;
-use pubgrub::{DefaultStringReporter, DependencyProvider, Reporter, VersionSet};
+use pubgrub::{
+    DefaultStringReporter, DependencyConstraints, DependencyProvider, Reporter, VersionSet,
+};
 
 use std::{
     cell::RefCell,
@@ -283,7 +285,7 @@ fn compute_deps<R: ResolveRead + fmt::Debug>(
     pubgrub::Dependencies<DependencyIdentifier, DiscreteHashSet, String>,
     InternalSolverError<R>,
 > {
-    let mut depmap: HashMap<DependencyIdentifier, DiscreteHashSet, _> = pubgrub::Map::default();
+    let mut deps: Vec<(DependencyIdentifier, DiscreteHashSet)> = Vec::new();
 
     for usage in usages {
         if let Some(constraint) = &usage.version_constraint {
@@ -315,10 +317,10 @@ fn compute_deps<R: ResolveRead + fmt::Debug>(
                 )));
             }
 
-            depmap.insert(
+            deps.push((
                 DependencyIdentifier::Remote(usage.resource.clone()),
                 DiscreteHashSet::Finite(valid_candidates),
-            );
+            ));
         } else {
             // Check that the project can be found
             resolve_candidates(resolver, &usage.resource, cache)?;
@@ -329,14 +331,17 @@ fn compute_deps<R: ResolveRead + fmt::Debug>(
             //     Err(err) => return Ok(pubgrub::Dependencies::Unavailable(err.to_string())),
             // };
 
-            depmap.insert(
+            deps.push((
                 DependencyIdentifier::Remote(usage.resource.clone()),
                 DiscreteHashSet::empty().complement(),
-            );
+            ));
         }
     }
 
-    Ok(pubgrub::Dependencies::Available(depmap))
+    // TODO: replace this with `from(deps)` when https://github.com/pubgrub-rs/pubgrub/pull/423
+    // is merged and released
+    let constraints = DependencyConstraints::from_iter(deps);
+    Ok(pubgrub::Dependencies::Available(constraints))
 }
 
 #[derive(Debug)]
diff --git a/sysand/Cargo.toml b/sysand/Cargo.toml
index e9346e7e..e795afd8 100644
--- a/sysand/Cargo.toml
+++ b/sysand/Cargo.toml
@@ -39,7 +39,7 @@ spdx = "0.13.4"
 fluent-uri = { version = "0.4.1", default-features = false }
 typed-path = { version = "0.12.3", default-features = false }
 url = { version = "2.5.8", default-features = false }
-pubgrub = { version = "0.3.0", default-features = false }
+pubgrub = { version = "0.4.0", default-features = false }
 indexmap = "2.13.0"
 tokio = { version = "1.50.0", default-features = false }
 reqwest-middleware = { version = "0.5.1", features = ["multipart"] }