diff --git a/CHANGELOG.md b/CHANGELOG.md
index 86f4a584..9a0b4887 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,13 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## UNRELEASED
+### Changed
+- Pin upper version of `serde` to <1.0.172 to work around [serde-rs/serde/#2538] ([#359])
+
+[#359]: https://github.com/RustCrypto/RSA/pull/359
+[serde-rs/serde/#2538]: https://github.com/serde-rs/serde/issues/2538
+
 ## 0.9.2 (2023-05-08)
 ### Fixed
 - pkcs1v15: have `fmt` impls call `SignatureEncoding::to_bytes` ([#330])
diff --git a/Cargo.toml b/Cargo.toml
index 73c6f89e..c4082f52 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -27,9 +27,10 @@ spki = { version = "0.7.2", default-features = false, features = ["alloc"] }
 zeroize = { version = "1.5", features = ["alloc"] }
 
 # optional dependencies
-serde = { version = "1.0.103", optional = true, default-features = false, features = ["derive"] }
 sha1 = { version = "0.10.5", optional = true, default-features = false, features = ["oid"] }
 sha2 = { version = "0.10.6", optional = true, default-features = false, features = ["oid"] }
+# Pin upper version of serde to work around https://github.com/serde-rs/serde/issues/2538
+serde = { version = "1.0.103, <1.0.171", optional = true, default-features = false, features = ["derive"] }
 
 [dev-dependencies]
 base64ct = { version = "1", features = ["alloc"] }