diff --git a/Cargo.toml b/Cargo.toml
index 1d39968..f94dc1e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -31,7 +31,7 @@ trussed-chunked = "0.1.0"
 trussed-hpke = "0.1.0"
 trussed-wrap-key-to-file = "0.1.0"
 trussed-staging = { version = "0.3.2", features = ["chunked", "hpke", "wrap-key-to-file"], default-features = false, optional = true }
-littlefs2 = "0.4.0"
+littlefs2-core = "0.1.0"
 cfg-if = "1.0.0"
 
 [dev-dependencies]
@@ -76,12 +76,11 @@ log-error = []
 dangerous-test-real-card = []
 
 [patch.crates-io]
-trussed = { git = "https://github.com/Nitrokey/trussed" , tag = "v0.1.0-nitrokey.18" }
-littlefs2 = { git = "https://github.com/trussed-dev/littlefs2.git", rev = "498fee7f7b908cb14e6ac18dca8442e19c89c0a9" }
-trussed-auth = { git = "https://github.com/trussed-dev/trussed-auth.git", tag = "v0.3.0"}
+trussed = { git = "https://github.com/trussed-dev/trussed", rev = "046478b7a4f6e2315acf9112d98308379c2e3eee" }
+trussed-auth = { git = "https://github.com/trussed-dev/trussed-auth.git", rev = "c030b82ad3441f337af09afe3a69e8a6da5785ea" }
 trussed-rsa-alloc = { git = "https://github.com/trussed-dev/trussed-rsa-backend.git", tag = "v0.2.1" }
 trussed-chunked = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "chunked-v0.1.0" }
-trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "v0.3.2" }
+trussed-staging = { git = "https://github.com/trussed-dev/trussed-staging.git", rev = "53eba84d2cd0bcacc3a7096d4b7a2490dcf6f069" }
 trussed-hpke = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "hpke-v0.1.0" }
 trussed-wrap-key-to-file = { git = "https://github.com/trussed-dev/trussed-staging.git", tag = "wrap-key-to-file-v0.1.0" }
 
diff --git a/src/container.rs b/src/container.rs
index 89a88aa..3e0c6c8 100644
--- a/src/container.rs
+++ b/src/container.rs
@@ -2,7 +2,7 @@ use core::convert::TryFrom;
 
 use hex_literal::hex;
 
-use littlefs2::{path, path::Path};
+use littlefs2_core::{path, Path};
 
 macro_rules! enum_subset {
     (
diff --git a/src/state.rs b/src/state.rs
index b986bd3..fa5ce39 100644
--- a/src/state.rs
+++ b/src/state.rs
@@ -5,13 +5,13 @@ use flexiber::EncodableHeapless;
 use heapless::Vec;
 use heapless_bytes::Bytes;
 use iso7816::Status;
-use littlefs2::{path, path::Path};
+use littlefs2_core::path;
 use trussed::Client;
 use trussed::{
     api::reply::Metadata,
     config::MAX_MESSAGE_LENGTH,
     syscall, try_syscall,
-    types::{KeyId, KeySerialization, Location, Mechanism, PathBuf, StorageAttributes},
+    types::{KeyId, KeySerialization, Location, Mechanism, Path, PathBuf, StorageAttributes},
 };
 use trussed_chunked::utils;
 
@@ -544,7 +544,7 @@ impl Persistent {
     pub const PIN_RETRIES_DEFAULT: u8 = 3;
     // hmm...!
     pub const PUK_RETRIES_DEFAULT: u8 = 5;
-    const FILENAME: &'static [u8] = b"persistent-state.cbor";
+    const FILENAME: &'static Path = path!("persistent-state.cbor");
     const DEFAULT_PIN: Pin = Pin(*b"123456\xff\xff");
     const DEFAULT_PUK: Puk = Puk(*b"12345678");
 
@@ -901,7 +901,7 @@ impl Persistent {
         options: &crate::Options,
     ) -> Result<Self, Status> {
         // todo: can't seem to combine load + initialize without code repetition
-        let data = load_if_exists(client, options.storage, &PathBuf::from(Self::FILENAME))?;
+        let data = load_if_exists(client, options.storage, Self::FILENAME)?;
         let Some(bytes) = data else {
             return Self::initialize(client, options);
         };
@@ -930,11 +930,11 @@ impl Persistent {
 fn load_if_exists(
     client: &mut impl crate::Client,
     location: Location,
-    path: &PathBuf,
+    path: &Path,
 ) -> Result<Option<Bytes<MAX_MESSAGE_LENGTH>>, Status> {
-    match try_syscall!(client.read_file(location, path.clone())) {
+    match try_syscall!(client.read_file(location, path.into())) {
         Ok(r) => Ok(Some(r.data)),
-        Err(_) => match try_syscall!(client.entry_metadata(location, path.clone())) {
+        Err(_) => match try_syscall!(client.entry_metadata(location, path.into())) {
             Ok(Metadata { metadata: None }) => Ok(None),
             Ok(Metadata {
                 metadata: Some(_metadata),
@@ -1057,11 +1057,11 @@ impl ContainerStorage {
     }
 
     fn path_key(self) -> PathBuf {
-        PathBuf::from(self.path_key_str())
+        PathBuf::try_from(self.path_key_str()).unwrap()
     }
 
     fn path(self) -> PathBuf {
-        PathBuf::from(self.path_key_str().strip_suffix(".key").unwrap())
+        PathBuf::try_from(self.path_key_str().strip_suffix(".key").unwrap()).unwrap()
     }
 
     fn default(self) -> Option<Vec<u8, MAX_MESSAGE_LENGTH>> {
diff --git a/src/virt.rs b/src/virt.rs
index cc820d8..a3efd58 100644
--- a/src/virt.rs
+++ b/src/virt.rs
@@ -11,7 +11,7 @@ pub mod dispatch {
         service::ServiceResources,
         types::{Bytes, Context, Location},
     };
-    use trussed_auth::{AuthBackend, AuthContext, AuthExtension, MAX_HW_KEY_LEN};
+    use trussed_auth::{AuthBackend, AuthContext, AuthExtension, FilesystemLayout, MAX_HW_KEY_LEN};
     use trussed_chunked::ChunkedExtension;
     use trussed_hpke::HpkeExtension;
     #[cfg(feature = "rsa")]
@@ -86,14 +86,14 @@ pub mod dispatch {
     impl Dispatch {
         pub fn new() -> Self {
             Self {
-                auth: AuthBackend::new(Location::Internal),
+                auth: AuthBackend::new(Location::Internal, FilesystemLayout::V0),
                 staging: StagingBackend::new(),
             }
         }
 
         pub fn with_hw_key(hw_key: Bytes<MAX_HW_KEY_LEN>) -> Self {
             Self {
-                auth: AuthBackend::with_hw_key(Location::Internal, hw_key),
+                auth: AuthBackend::with_hw_key(Location::Internal, hw_key, FilesystemLayout::V0),
                 staging: StagingBackend::new(),
             }
         }