diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index d871898f3..9fef98dcd 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -31,7 +31,7 @@ jobs:
         run: cargo llvm-cov --workspace --all-features --codecov --output-path codecov.json
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v4.0.0
+        uses: codecov/codecov-action@v4.0.1
         with:
           files: codecov.json
           fail_ci_if_error: true
diff --git a/actix-web/Cargo.toml b/actix-web/Cargo.toml
index 44a7f3e87..014675cd9 100644
--- a/actix-web/Cargo.toml
+++ b/actix-web/Cargo.toml
@@ -118,7 +118,7 @@ url = "2.1"
 
 [dev-dependencies]
 actix-files = "0.6"
-actix-test = { version = "0.1", features = ["openssl", "rustls-0_21"] }
+actix-test = { version = "0.1", features = ["openssl", "rustls-0_22"] }
 awc = { version = "3", features = ["openssl"] }
 
 brotli = "3.3.3"
@@ -128,12 +128,12 @@ env_logger = "0.11"
 flate2 = "1.0.13"
 futures-util = { version = "0.3.17", default-features = false, features = ["std"] }
 rand = "0.8"
-rcgen = "0.11"
-rustls-pemfile = "1"
+rcgen = "0.12"
+rustls-pemfile = "2"
 serde = { version = "1.0", features = ["derive"] }
 static_assertions = "1"
 tls-openssl = { package = "openssl", version = "0.10.55" }
-tls-rustls = { package = "rustls", version = "0.21" }
+tls-rustls = { package = "rustls", version = "0.22" }
 tokio = { version = "1.24.2", features = ["rt-multi-thread", "macros"] }
 zstd = "0.13"
 
diff --git a/actix-web/tests/test_server.rs b/actix-web/tests/test_server.rs
index 0df6e2124..8fb80216b 100644
--- a/actix-web/tests/test_server.rs
+++ b/actix-web/tests/test_server.rs
@@ -1,6 +1,6 @@
 #[cfg(feature = "openssl")]
 extern crate tls_openssl as openssl;
-#[cfg(feature = "rustls-0_21")]
+#[cfg(feature = "rustls-0_22")]
 extern crate tls_rustls as rustls;
 
 use std::{
@@ -704,11 +704,11 @@ async fn test_brotli_encoding_large_openssl() {
     srv.stop().await;
 }
 
-#[cfg(feature = "rustls-0_21")]
+#[cfg(feature = "rustls-0_22")]
 mod plus_rustls {
     use std::io::BufReader;
 
-    use rustls::{Certificate, PrivateKey, ServerConfig as RustlsServerConfig};
+    use rustls::{pki_types::PrivateKeyDer, ServerConfig as RustlsServerConfig};
     use rustls_pemfile::{certs, pkcs8_private_keys};
 
     use super::*;
@@ -721,17 +721,14 @@ mod plus_rustls {
         let cert_file = &mut BufReader::new(cert_file.as_bytes());
         let key_file = &mut BufReader::new(key_file.as_bytes());
 
-        let cert_chain = certs(cert_file)
-            .unwrap()
-            .into_iter()
-            .map(Certificate)
-            .collect();
-        let mut keys = pkcs8_private_keys(key_file).unwrap();
+        let cert_chain = certs(cert_file).collect::<Result<Vec<_>, _>>().unwrap();
+        let mut keys = pkcs8_private_keys(key_file)
+            .collect::<Result<Vec<_>, _>>()
+            .unwrap();
 
         RustlsServerConfig::builder()
-            .with_safe_defaults()
             .with_no_client_auth()
-            .with_single_cert(cert_chain, PrivateKey(keys.remove(0)))
+            .with_single_cert(cert_chain, PrivateKeyDer::Pkcs8(keys.remove(0)))
             .unwrap()
     }
 
@@ -743,7 +740,7 @@ mod plus_rustls {
             .map(char::from)
             .collect::<String>();
 
-        let srv = actix_test::start_with(actix_test::config().rustls_0_21(tls_config()), || {
+        let srv = actix_test::start_with(actix_test::config().rustls_0_22(tls_config()), || {
             App::new().service(web::resource("/").route(web::to(|bytes: Bytes| async {
                 // echo decompressed request body back in response
                 HttpResponse::Ok()