diff --git a/package-lock.json b/package-lock.json
index 060edf3..ec7c5f3 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10,7 +10,7 @@
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "@small-tech/auto-encrypt": "^3.1.0",
-        "activitypub-express": "^3.3.0",
+        "activitypub-express": "^4.0.1",
         "connect-history-api-fallback": "^1.6.0",
         "cors": "^2.8.4",
         "dotenv": "^16.0.3",
@@ -1250,13 +1250,13 @@
       }
     },
     "node_modules/activitypub-express": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/activitypub-express/-/activitypub-express-3.3.0.tgz",
-      "integrity": "sha512-oApaM0hoUMTwLtfNGDsJYTShUJ5NS30kBWhPm4iSGn83EET17BveDxS9tpeIM8LBWKLe0NgV1SF2cUCgQrMzXA==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/activitypub-express/-/activitypub-express-4.0.1.tgz",
+      "integrity": "sha512-EB5dIFmWhBU+m/WKIzdCxIdE97I6pJ63XzM01u9yHTKI7bnfdUsZlVZUSrekIzjS/Vdp4OvUyZDRSQwcispaUQ==",
       "dependencies": {
         "deepmerge": "^4.2.2",
         "express": "^4.18.0",
-        "http-signature": "github:wmurphyrd/node-http-signature#9c02eeb",
+        "http-signature": "git+https://git@github.com/wmurphyrd/node-http-signature.git#9c02eeb",
         "jsonld": "^5.2.0",
         "mongo-escape": "^2.0.6",
         "mongodb": "^4.5.0",
@@ -1266,7 +1266,8 @@
         "request-promise-native": "^1.0.9"
       },
       "engines": {
-        "node": ">=14.15"
+        "node": ">=16",
+        "npm": ">=7"
       }
     },
     "node_modules/activitypub-express/node_modules/on-finished": {
@@ -6300,13 +6301,13 @@
       "requires": {}
     },
     "activitypub-express": {
-      "version": "3.3.0",
-      "resolved": "https://registry.npmjs.org/activitypub-express/-/activitypub-express-3.3.0.tgz",
-      "integrity": "sha512-oApaM0hoUMTwLtfNGDsJYTShUJ5NS30kBWhPm4iSGn83EET17BveDxS9tpeIM8LBWKLe0NgV1SF2cUCgQrMzXA==",
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/activitypub-express/-/activitypub-express-4.0.1.tgz",
+      "integrity": "sha512-EB5dIFmWhBU+m/WKIzdCxIdE97I6pJ63XzM01u9yHTKI7bnfdUsZlVZUSrekIzjS/Vdp4OvUyZDRSQwcispaUQ==",
       "requires": {
         "deepmerge": "^4.2.2",
         "express": "^4.18.0",
-        "http-signature": "github:wmurphyrd/node-http-signature#9c02eeb",
+        "http-signature": "git+https://git@github.com/wmurphyrd/node-http-signature.git#9c02eeb",
         "jsonld": "^5.2.0",
         "mongo-escape": "^2.0.6",
         "mongodb": "^4.5.0",
@@ -7644,7 +7645,7 @@
     "http-signature": {
       "version": "git+ssh://git@github.com/wmurphyrd/node-http-signature.git#9c02eeb45af7cbfc59dab927a2577a27c4fe7683",
       "integrity": "sha512-0tGAI8AqiCE1FQxP6/w26GGk50SYIxx5o6dNLabmG2r8AytiJchpr5Qn7Ho5hfN54Q/yna5puvsHMj8Y3gCtDA==",
-      "from": "http-signature@github:wmurphyrd/node-http-signature#9c02eeb",
+      "from": "http-signature@git+https://git@github.com/wmurphyrd/node-http-signature.git#9c02eeb",
       "requires": {
         "assert-plus": "^1.0.0",
         "jsprim": "^1.2.2",
diff --git a/package.json b/package.json
index fb07567..72ec176 100644
--- a/package.json
+++ b/package.json
@@ -5,7 +5,7 @@
   "main": "index.js",
   "dependencies": {
     "@small-tech/auto-encrypt": "^3.1.0",
-    "activitypub-express": "^3.3.0",
+    "activitypub-express": "^4.0.1",
     "connect-history-api-fallback": "^1.6.0",
     "cors": "^2.8.4",
     "dotenv": "^16.0.3",