diff --git a/external/mx25519/src/platform.c b/external/mx25519/src/platform.c
index a5ebb24..d632542 100644
--- a/external/mx25519/src/platform.c
+++ b/external/mx25519/src/platform.c
@@ -36,8 +36,9 @@ uint64_t mx25519_cpu_cycles() {
     uint64_t vct;
     __asm__ volatile("mrs %0, cntvct_el0" : "=r"(vct));
     return vct;
-#endif
+#else
     return clock(); /* fallback */
+#endif
 }
 
 double mx25519_wall_clock() {
diff --git a/src/carrot_crypto.cpp b/src/carrot_crypto.cpp
index 633141e..4278938 100644
--- a/src/carrot_crypto.cpp
+++ b/src/carrot_crypto.cpp
@@ -82,7 +82,8 @@ static void debug_hex(const char* label, const uint8_t* data, size_t len)
     static constexpr char log_category_prefix[] = "CarrotCrypto ";
     char hex[130] = {0};
     for (size_t i = 0; i < len && i < 64; ++i) {
-        sprintf(hex + i*2, "%02x", data[i]);
+        // Use snprintf to avoid deprecated sprintf and keep bounds safe
+        snprintf(hex + i*2, sizeof(hex) - (i*2), "%02x", data[i]);
     }
     LOGINFO(0, label << ": " << static_cast<const char*>(hex));
 }
@@ -420,4 +421,3 @@ void encrypt_anchor(
 
 } // namespace carrot
 } // namespace p2pool
-