diff --git a/Cargo.toml b/Cargo.toml
index c3707e765..eddc09b03 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,10 +1,6 @@
 [workspace]
-members = [
-    "libsignal-service",
-    "libsignal-service-actix",
-    "libsignal-service-hyper",
-]
+members = ["libsignal-service", "libsignal-service-actix", "libsignal-service-hyper"]
 default-members = ["libsignal-service", "libsignal-service-hyper"]
 
 [patch.crates-io]
-"curve25519-dalek" = { git = 'https://github.com/signalapp/curve25519-dalek', branch = 'lizard2' }
+curve25519-dalek = { git = 'https://github.com/signalapp/curve25519-dalek', tag = 'signal-curve25519-4.0.0' }
diff --git a/libsignal-service-actix/Cargo.toml b/libsignal-service-actix/Cargo.toml
index faab0d370..27a853942 100644
--- a/libsignal-service-actix/Cargo.toml
+++ b/libsignal-service-actix/Cargo.toml
@@ -9,7 +9,7 @@ edition = "2018"
 # the Send requirement in libsignal-service needs to be lifted by enabling `unsend-futures`.
 libsignal-service = { path = "../libsignal-service", features = ["unsend-futures"] }
 
-awc = { version = "3.0.0-beta.19", features=["rustls"] }
+awc = { version = "3.0.0-beta.19", features = ["rustls"] }
 actix = "0.13"
 actix-http = "3.0.0-beta.19"
 actix-rt = "2.4"
@@ -23,7 +23,7 @@ rustls-pemfile = "0.3"
 url = "2.1"
 serde = "1.0"
 log = "0.4"
-rand = "0.7"
+rand = "0.8"
 
 thiserror = "1.0"
 async-trait = "0.1"
@@ -31,18 +31,16 @@ base64 = "0.13"
 
 phonenumber = "0.3"
 
-# Pin this for 1.52.1 compat
-proc-macro2 = { version = "=1.0.26", optional = true }
-quote = { version = "=1.0.10", optional = true }
+proc-macro2 = { version = "1.0.66", optional = true }
+quote = { version = "1.0.33", optional = true }
 
 [dev-dependencies]
 env_logger = "0.9"
 image = { version = "0.23", default-features = false, features = ["png"] }
 opener = "0.5"
 qrcode = "0.12"
-rand = "0.7"
 structopt = "0.3"
-tokio = { version = "1", features=["macros"] }
+tokio = { version = "1", features = ["macros"] }
 anyhow = "1.0"
 
 [features]
diff --git a/libsignal-service-actix/examples/link.rs b/libsignal-service-actix/examples/link.rs
index 325573c96..131724983 100644
--- a/libsignal-service-actix/examples/link.rs
+++ b/libsignal-service-actix/examples/link.rs
@@ -26,12 +26,15 @@ async fn main() -> Result<(), Error> {
     let args = Args::from_args();
 
     // generate a random 16 bytes password
-    let mut csprng = rand::thread_rng();
-    let password: String = csprng.sample_iter(&Alphanumeric).take(24).collect();
+    let password: String = rand::thread_rng()
+        .sample_iter(&Alphanumeric)
+        .take(24)
+        .map(char::from)
+        .collect();
 
     // generate a 52 bytes signaling key
     let mut signaling_key = [0u8; 52];
-    csprng.fill_bytes(&mut signaling_key);
+    rand::thread_rng().fill_bytes(&mut signaling_key);
     log::info!("generated signaling key: {}", base64::encode(signaling_key));
 
     let push_service =
@@ -44,7 +47,7 @@ async fn main() -> Result<(), Error> {
 
     let (fut1, fut2) = future::join(
         provision_manager.provision_secondary_device(
-            &mut csprng,
+            &mut rand::thread_rng(),
             signaling_key,
             tx,
         ),
diff --git a/libsignal-service-hyper/Cargo.toml b/libsignal-service-hyper/Cargo.toml
index 11b93c2cc..3fb1a546e 100644
--- a/libsignal-service-hyper/Cargo.toml
+++ b/libsignal-service-hyper/Cargo.toml
@@ -18,27 +18,27 @@ serde_json = "1.0"
 thiserror = "1.0"
 url = "2.1"
 
-hyper = { version = "0.14", features = [ "client", "stream" ] }
+hyper = { version = "0.14", features = ["client", "stream"] }
 hyper-rustls = "0.23"
 hyper-timeout = "0.4"
 headers = "0.3"
 
 # for websocket support
-async-tungstenite = { version = "0.17", features = [ "tokio-rustls-native-certs" ] }
+async-tungstenite = { version = "0.17", features = ["tokio-rustls-native-certs"] }
 
-tokio = { version = "1.0", features = [ "macros" ] }
+tokio = { version = "1.0", features = ["macros"] }
 tokio-rustls = "0.23"
 
 rustls-pemfile = "0.3"
 
 [dev-dependencies]
 env_logger = "0.9"
-image = { version = "0.23", default-features = false, features = [ "png" ] }
+image = { version = "0.23", default-features = false, features = ["png"] }
 opener = "0.5"
 qrcode = "0.12"
-rand = "0.7"
+rand = "0.8"
 structopt = "0.3"
-tokio = { version = "1.0", features = [ "rt-multi-thread" ]}
+tokio = { version = "1.0", features = ["rt-multi-thread"] }
 
 [features]
 unsend-futures = ["libsignal-service/unsend-futures"]
diff --git a/libsignal-service/Cargo.toml b/libsignal-service/Cargo.toml
index b7a2d933d..2073bcd03 100644
--- a/libsignal-service/Cargo.toml
+++ b/libsignal-service/Cargo.toml
@@ -7,8 +7,8 @@ license = "GPLv3"
 readme = "../README.md"
 
 [dependencies]
-libsignal-protocol = { git = "https://github.com/signalapp/libsignal", tag = "v0.28.1" }
-zkgroup = { git = "https://github.com/signalapp/libsignal", tag = "v0.28.1" }
+libsignal-protocol = { git = "https://github.com/signalapp/libsignal", tag = "v0.32.0" }
+zkgroup = { git = "https://github.com/signalapp/libsignal", tag = "v0.32.0" }
 
 aes = { version = "0.7", features = ["ctr"] }
 aes-gcm = "0.9"
@@ -26,7 +26,7 @@ hmac = "0.12"
 log = "0.4"
 phonenumber = "0.3"
 prost = "0.10"
-rand = "0.7"
+rand = "0.8"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0.85"
 sha2 = "0.10"
diff --git a/libsignal-service/src/account_manager.rs b/libsignal-service/src/account_manager.rs
index d4cd7fa78..59355eaeb 100644
--- a/libsignal-service/src/account_manager.rs
+++ b/libsignal-service/src/account_manager.rs
@@ -128,8 +128,7 @@ impl<Service: PushService> AccountManager<Service> {
             ));
         }
 
-        let identity_key_pair =
-            protocol_store.get_identity_key_pair(None).await?;
+        let identity_key_pair = protocol_store.get_identity_key_pair().await?;
 
         let mut pre_key_entities = vec![];
         let mut pq_pre_key_entities = vec![];
@@ -143,7 +142,7 @@ impl<Service: PushService> AccountManager<Service> {
             .into();
             let pre_key_record = PreKeyRecord::new(pre_key_id, &key_pair);
             protocol_store
-                .save_pre_key(pre_key_id, &pre_key_record, None)
+                .save_pre_key(pre_key_id, &pre_key_record)
                 .await?;
             // TODO: Shouldn't this also remove the previous pre-keys from storage?
             //       I think we might want to update the storage, and then sync the storage to the
@@ -164,7 +163,7 @@ impl<Service: PushService> AccountManager<Service> {
                 identity_key_pair.private_key(),
             )?;
             protocol_store
-                .save_kyber_pre_key(pre_key_id, &pre_key_record, None)
+                .save_kyber_pre_key(pre_key_id, &pre_key_record)
                 .await?;
             // TODO: Shouldn't this also remove the previous pre-keys from storage?
             //       I think we might want to update the storage, and then sync the storage to the
@@ -196,7 +195,6 @@ impl<Service: PushService> AccountManager<Service> {
             .save_signed_pre_key(
                 next_signed_pre_key_id.into(),
                 &signed_prekey_record,
-                None,
             )
             .await?;
 
@@ -311,8 +309,7 @@ impl<Service: PushService> AccountManager<Service> {
         let pub_key = PublicKey::deserialize(&pub_key)
             .map_err(|_e| LinkError::InvalidPublicKey)?;
 
-        let identity_key_pair =
-            identity_store.get_identity_key_pair(None).await?;
+        let identity_key_pair = identity_store.get_identity_key_pair().await?;
 
         if credentials.uuid.is_none() {
             log::warn!("No local UUID set");
@@ -363,14 +360,14 @@ impl<Service: PushService> AccountManager<Service> {
     /// currently set avatar.
     pub async fn upload_versioned_profile_without_avatar<S: AsRef<str>>(
         &mut self,
-        uuid: uuid::Uuid,
+        aci: libsignal_protocol::Aci,
         name: ProfileName<S>,
         about: Option<String>,
         about_emoji: Option<String>,
         retain_avatar: bool,
     ) -> Result<(), ProfileManagerError> {
         self.upload_versioned_profile::<std::io::Cursor<Vec<u8>>, _>(
-            uuid,
+            aci,
             name,
             about,
             about_emoji,
@@ -411,7 +408,7 @@ impl<Service: PushService> AccountManager<Service> {
         S: AsRef<str>,
     >(
         &mut self,
-        uuid: uuid::Uuid,
+        aci: libsignal_protocol::Aci,
         name: ProfileName<S>,
         about: Option<String>,
         about_emoji: Option<String>,
@@ -436,9 +433,8 @@ impl<Service: PushService> AccountManager<Service> {
         }
 
         let profile_key = profile_cipher.into_inner();
-        let commitment = profile_key.get_commitment(*uuid.as_bytes());
-        let profile_key_version =
-            profile_key.get_profile_key_version(*uuid.as_bytes());
+        let commitment = profile_key.get_commitment(aci);
+        let profile_key_version = profile_key.get_profile_key_version(aci);
 
         Ok(self
             .service
diff --git a/libsignal-service/src/cipher.rs b/libsignal-service/src/cipher.rs
index 7cdf23441..33064d5ed 100644
--- a/libsignal-service/src/cipher.rs
+++ b/libsignal-service/src/cipher.rs
@@ -1,13 +1,13 @@
-use std::convert::TryFrom;
+use std::{convert::TryFrom, time::SystemTime};
 
 use block_modes::block_padding::{Iso7816, Padding};
 use libsignal_protocol::{
     group_decrypt, message_decrypt_prekey, message_decrypt_signal,
     message_encrypt, process_sender_key_distribution_message,
     sealed_sender_decrypt_to_usmc, sealed_sender_encrypt,
-    CiphertextMessageType, Context, DeviceId, IdentityKeyStore,
-    KyberPreKeyStore, PreKeySignalMessage, PreKeyStore, ProtocolAddress,
-    ProtocolStore, PublicKey, SealedSenderDecryptionResult, SenderCertificate,
+    CiphertextMessageType, DeviceId, IdentityKeyStore, KyberPreKeyStore,
+    PreKeySignalMessage, PreKeyStore, ProtocolAddress, ProtocolStore,
+    PublicKey, SealedSenderDecryptionResult, SenderCertificate,
     SenderKeyDistributionMessage, SenderKeyStore, SessionStore, SignalMessage,
     SignalProtocolError, SignedPreKeyStore,
 };
@@ -72,7 +72,6 @@ where
                     &plaintext.metadata.protocol_address(),
                     &skdm,
                     &mut self.protocol_store,
-                    None,
                 )
                 .await?;
                 Ok(None)
@@ -130,7 +129,6 @@ where
                     &mut self.protocol_store.clone(),
                     &mut self.protocol_store.clone(),
                     &mut self.csprng,
-                    None,
                 )
                 .await?
                 .as_slice()
@@ -138,7 +136,7 @@ where
 
                 let session_record = self
                     .protocol_store
-                    .load_session(&sender, None)
+                    .load_session(&sender)
                     .await?
                     .ok_or(SignalProtocolError::SessionNotFound(sender))?;
 
@@ -183,7 +181,6 @@ where
                     &mut self.protocol_store.clone(),
                     &mut self.protocol_store.clone(),
                     &mut self.csprng,
-                    None,
                 )
                 .await?
                 .as_slice()
@@ -191,7 +188,7 @@ where
 
                 let session_record = self
                     .protocol_store
-                    .load_session(&sender, None)
+                    .load_session(&sender)
                     .await?
                     .ok_or(SignalProtocolError::SessionNotFound(sender))?;
 
@@ -220,7 +217,6 @@ where
                     &mut self.protocol_store.clone(),
                     &mut self.protocol_store.clone(),
                     &mut self.protocol_store,
-                    None,
                 )
                 .await?;
 
@@ -275,11 +271,11 @@ where
     ) -> Result<OutgoingPushMessage, ServiceError> {
         let session_record = self
             .protocol_store
-            .load_session(address, None)
+            .load_session(address)
             .await?
             .ok_or_else(|| {
-                SignalProtocolError::SessionNotFound(address.clone())
-            })?;
+            SignalProtocolError::SessionNotFound(address.clone())
+        })?;
 
         let padded_content =
             add_padding(session_record.session_version()?, content)?;
@@ -294,7 +290,7 @@ where
                 &padded_content,
                 &mut self.protocol_store.clone(),
                 &mut self.protocol_store,
-                None,
+                SystemTime::now(),
                 &mut self.csprng,
             )
             .await?;
@@ -312,7 +308,7 @@ where
                 address,
                 &mut self.protocol_store.clone(),
                 &mut self.protocol_store.clone(),
-                None,
+                SystemTime::now(),
             )
             .await?;
 
@@ -406,7 +402,7 @@ pub async fn get_preferred_protocol_address<S: SessionStore>(
     device_id: DeviceId,
 ) -> Result<ProtocolAddress, libsignal_protocol::error::SignalProtocolError> {
     let address = address.to_protocol_address(device_id);
-    if session_store.load_session(&address, None).await?.is_some() {
+    if session_store.load_session(&address).await?.is_some() {
         return Ok(address);
     }
 
@@ -434,10 +430,9 @@ async fn sealed_sender_decrypt(
     signed_pre_key_store: &mut dyn SignedPreKeyStore,
     sender_key_store: &mut dyn SenderKeyStore,
     kyber_pre_key_store: &mut dyn KyberPreKeyStore,
-    ctx: Context,
 ) -> Result<SealedSenderDecryptionResult, SignalProtocolError> {
     let usmc =
-        sealed_sender_decrypt_to_usmc(ciphertext, identity_store, ctx).await?;
+        sealed_sender_decrypt_to_usmc(ciphertext, identity_store).await?;
 
     if !usmc.sender()?.validate(trust_root, timestamp)? {
         return Err(SignalProtocolError::InvalidSealedSenderMessage(
@@ -474,7 +469,6 @@ async fn sealed_sender_decrypt(
                 session_store,
                 identity_store,
                 &mut rng,
-                ctx,
             )
             .await?
         },
@@ -489,18 +483,12 @@ async fn sealed_sender_decrypt(
                 signed_pre_key_store,
                 kyber_pre_key_store,
                 &mut rng,
-                ctx,
             )
             .await?
         },
         CiphertextMessageType::SenderKey => {
-            group_decrypt(
-                usmc.contents()?,
-                sender_key_store,
-                &remote_address,
-                ctx,
-            )
-            .await?
+            group_decrypt(usmc.contents()?, sender_key_store, &remote_address)
+                .await?
         },
         msg_type => {
             return Err(SignalProtocolError::InvalidMessage(
diff --git a/libsignal-service/src/groups_v2/manager.rs b/libsignal-service/src/groups_v2/manager.rs
index 169b06865..fdafcf614 100644
--- a/libsignal-service/src/groups_v2/manager.rs
+++ b/libsignal-service/src/groups_v2/manager.rs
@@ -196,9 +196,9 @@ impl<S: PushService, C: CredentialsCache> GroupsManager<S, C> {
     ) -> Result<HttpAuth, ServiceError> {
         let auth_credential = self
             .server_public_params
-            .receive_auth_credential_with_pni(
-                self.service_ids.aci.into_bytes(),
-                self.service_ids.pni.into_bytes(),
+            .receive_auth_credential_with_pni_as_aci(
+                self.service_ids.aci(),
+                self.service_ids.pni(),
                 today,
                 credential_response,
             )
diff --git a/libsignal-service/src/groups_v2/operations.rs b/libsignal-service/src/groups_v2/operations.rs
index e4e400436..a7384594e 100644
--- a/libsignal-service/src/groups_v2/operations.rs
+++ b/libsignal-service/src/groups_v2/operations.rs
@@ -1,8 +1,8 @@
 use std::convert::TryInto;
 
 use bytes::Bytes;
+use libsignal_protocol::{Aci, ServiceId};
 use prost::Message;
-use uuid::Uuid;
 use zkgroup::{
     groups::GroupSecretParams,
     profiles::{AnyProfileKeyCredentialPresentation, ProfileKey},
@@ -39,6 +39,8 @@ pub enum GroupDecodingError {
     WrongBlob,
     #[error("wrong enum value")]
     WrongEnumValue,
+    #[error("wrong service ID type: should be ACI")]
+    NotAci,
 }
 
 impl From<zkgroup::ZkGroupDeserializationFailure> for GroupDecodingError {
@@ -54,54 +56,67 @@ impl From<zkgroup::ZkGroupVerificationFailure> for GroupDecodingError {
 }
 
 impl GroupOperations {
-    fn decrypt_uuid(&self, uuid: &[u8]) -> Result<Uuid, GroupDecodingError> {
-        let bytes = self
+    fn decrypt_aci(
+        &self,
+        ciphertext: &[u8],
+    ) -> Result<Aci, GroupDecodingError> {
+        match self
             .group_secret_params
-            .decrypt_uuid(bincode::deserialize(uuid)?)?;
-        Ok(Uuid::from_bytes(bytes))
+            .decrypt_service_id(bincode::deserialize(ciphertext)?)?
+        {
+            ServiceId::Aci(aci) => Ok(aci),
+            ServiceId::Pni(_pni) => Err(GroupDecodingError::NotAci),
+        }
     }
 
     fn decrypt_profile_key(
         &self,
         encrypted_profile_key: &[u8],
-        decrypted_uuid: &Uuid,
+        decrypted_aci: libsignal_protocol::Aci,
     ) -> Result<ProfileKey, GroupDecodingError> {
         Ok(self.group_secret_params.decrypt_profile_key(
             bincode::deserialize(encrypted_profile_key)?,
-            *decrypted_uuid.as_bytes(),
+            decrypted_aci,
         )?)
     }
 
     fn decrypt_profile_key_presentation(
         &self,
         presentation: &[u8],
-    ) -> Result<(Uuid, ProfileKey), GroupDecodingError> {
+    ) -> Result<(Aci, ProfileKey), GroupDecodingError> {
         let profile_key_credential_presentation =
             AnyProfileKeyCredentialPresentation::new(presentation)?;
-        let uuid = Uuid::from_bytes(self.group_secret_params.decrypt_uuid(
+
+        match self.group_secret_params.decrypt_service_id(
             profile_key_credential_presentation.get_uuid_ciphertext(),
-        )?);
-        let profile_key = self.group_secret_params.decrypt_profile_key(
-            profile_key_credential_presentation.get_profile_key_ciphertext(),
-            *uuid.as_bytes(),
-        )?;
-        Ok((uuid, profile_key))
+        )? {
+            ServiceId::Aci(aci) => {
+                let profile_key =
+                    self.group_secret_params.decrypt_profile_key(
+                        profile_key_credential_presentation
+                            .get_profile_key_ciphertext(),
+                        aci,
+                    )?;
+                Ok((aci, profile_key))
+            },
+            _ => Err(GroupDecodingError::NotAci),
+        }
     }
 
     fn decrypt_member(
         &self,
         member: EncryptedMember,
     ) -> Result<Member, GroupDecodingError> {
-        let (uuid, profile_key) = if member.presentation.is_empty() {
-            let uuid = self.decrypt_uuid(&member.user_id)?;
+        let (aci, profile_key) = if member.presentation.is_empty() {
+            let aci = self.decrypt_aci(&member.user_id)?;
             let profile_key =
-                self.decrypt_profile_key(&member.profile_key, &uuid)?;
-            (uuid, profile_key)
+                self.decrypt_profile_key(&member.profile_key, aci)?;
+            (aci, profile_key)
         } else {
             self.decrypt_profile_key_presentation(&member.presentation)?
         };
         Ok(Member {
-            uuid,
+            uuid: aci.into(),
             profile_key,
             role: member.role.try_into()?,
             joined_at_revision: member.joined_at_revision,
@@ -114,14 +129,13 @@ impl GroupOperations {
     ) -> Result<PendingMember, GroupDecodingError> {
         let inner_member =
             member.member.ok_or(GroupDecodingError::WrongBlob)?;
-        // "Unknown" UUID with zeroes in case of errors, see: UuidUtil.java:16
-        let uuid = self.decrypt_uuid(&inner_member.user_id).unwrap_or_default();
-        let added_by_uuid = self.decrypt_uuid(&member.added_by_user_id)?;
+        let aci = self.decrypt_aci(&inner_member.user_id)?;
+        let added_by_uuid = self.decrypt_aci(&member.added_by_user_id)?;
 
         Ok(PendingMember {
-            uuid,
+            uuid: aci.into(),
             role: inner_member.role.try_into()?,
-            added_by_uuid,
+            added_by_uuid: added_by_uuid.into(),
             timestamp: member.timestamp,
         })
     }
@@ -130,17 +144,17 @@ impl GroupOperations {
         &self,
         member: proto::RequestingMember,
     ) -> Result<RequestingMember, GroupDecodingError> {
-        let (uuid, profile_key) = if member.presentation.is_empty() {
-            let uuid = self.decrypt_uuid(&member.user_id)?;
+        let (aci, profile_key) = if member.presentation.is_empty() {
+            let aci = self.decrypt_aci(&member.user_id)?;
             let profile_key =
-                self.decrypt_profile_key(&member.profile_key, &uuid)?;
-            (uuid, profile_key)
+                self.decrypt_profile_key(&member.profile_key, aci)?;
+            (aci, profile_key)
         } else {
             self.decrypt_profile_key_presentation(&member.presentation)?
         };
         Ok(RequestingMember {
             profile_key,
-            uuid,
+            uuid: aci.into(),
             timestamp: member.timestamp,
         })
     }
@@ -256,7 +270,7 @@ impl GroupOperations {
         let actions: proto::group_change::Actions =
             Message::decode(Bytes::from(group_change.actions))?;
 
-        let uuid = self.decrypt_uuid(&actions.source_uuid)?;
+        let aci = self.decrypt_aci(&actions.source_uuid)?;
 
         let new_members =
             actions.add_members.into_iter().filter_map(|m| m.added).map(
@@ -265,23 +279,26 @@ impl GroupOperations {
 
         let delete_members = actions.delete_members.into_iter().map(|c| {
             Ok(GroupChange::DeleteMember(
-                self.decrypt_uuid(&c.deleted_user_id)?,
+                self.decrypt_aci(&c.deleted_user_id)?.into(),
             ))
         });
 
         let modify_member_roles =
             actions.modify_member_roles.into_iter().map(|m| {
                 Ok(GroupChange::ModifyMemberRole {
-                    uuid: self.decrypt_uuid(&m.user_id)?,
+                    uuid: self.decrypt_aci(&m.user_id)?.into(),
                     role: m.role.try_into()?,
                 })
             });
 
         let modify_member_profile_keys =
             actions.modify_member_profile_keys.into_iter().map(|m| {
-                let (uuid, profile_key) =
+                let (aci, profile_key) =
                     self.decrypt_profile_key_presentation(&m.presentation)?;
-                Ok(GroupChange::ModifyMemberProfileKey { uuid, profile_key })
+                Ok(GroupChange::ModifyMemberProfileKey {
+                    uuid: aci.into(),
+                    profile_key,
+                })
             });
 
         let add_pending_members = actions
@@ -297,15 +314,18 @@ impl GroupOperations {
         let delete_pending_members =
             actions.delete_pending_members.into_iter().map(|m| {
                 Ok(GroupChange::DeletePendingMember(
-                    self.decrypt_uuid(&m.deleted_user_id)?,
+                    self.decrypt_aci(&m.deleted_user_id)?.into(),
                 ))
             });
 
         let promote_pending_members =
             actions.promote_pending_members.into_iter().map(|m| {
-                let (uuid, profile_key) =
+                let (aci, profile_key) =
                     self.decrypt_profile_key_presentation(&m.presentation)?;
-                Ok(GroupChange::PromotePendingMember { uuid, profile_key })
+                Ok(GroupChange::PromotePendingMember {
+                    uuid: aci.into(),
+                    profile_key,
+                })
             });
 
         let modify_title = actions
@@ -368,14 +388,14 @@ impl GroupOperations {
         let delete_requesting_members =
             actions.delete_requesting_members.into_iter().map(|m| {
                 Ok(GroupChange::DeleteRequestingMember(
-                    self.decrypt_uuid(&m.deleted_user_id)?,
+                    self.decrypt_aci(&m.deleted_user_id)?.into(),
                 ))
             });
 
         let promote_requesting_members =
             actions.promote_requesting_members.into_iter().map(|m| {
                 Ok(GroupChange::PromoteRequestingMember {
-                    uuid: self.decrypt_uuid(&m.user_id)?,
+                    uuid: self.decrypt_aci(&m.user_id)?.into(),
                     role: m.role.try_into()?,
                 })
             });
@@ -414,7 +434,7 @@ impl GroupOperations {
             .collect();
 
         Ok(GroupChanges {
-            editor: uuid,
+            editor: aci.into(),
             revision: actions.revision,
             changes: changes?,
         })
diff --git a/libsignal-service/src/profile_service.rs b/libsignal-service/src/profile_service.rs
index 43f9ac924..ae17e0fc7 100644
--- a/libsignal-service/src/profile_service.rs
+++ b/libsignal-service/src/profile_service.rs
@@ -21,9 +21,8 @@ impl ProfileService {
     ) -> Result<SignalServiceProfile, ServiceError> {
         let endpoint = match profile_key {
             Some(key) => {
-                let uid_bytes = address.uuid.as_bytes();
                 let version = bincode::serialize(
-                    &key.get_profile_key_version(*uid_bytes),
+                    &key.get_profile_key_version(address.aci()),
                 )?;
                 let version = std::str::from_utf8(&version)
                     .expect("hex encoded profile key version");
diff --git a/libsignal-service/src/provisioning/manager.rs b/libsignal-service/src/provisioning/manager.rs
index 4f8ef30d7..6f1fa3278 100644
--- a/libsignal-service/src/provisioning/manager.rs
+++ b/libsignal-service/src/provisioning/manager.rs
@@ -139,8 +139,8 @@ impl<P: PushService> LinkingManager<P> {
             .ws("/v1/websocket/provisioning/", &[], None, false)
             .await?;
 
-        let registration_id = csprng.gen_range(1, 256);
-        let pni_registration_id = csprng.gen_range(1, 256);
+        let registration_id = csprng.gen_range(1..256);
+        let pni_registration_id = csprng.gen_range(1..256);
 
         let provisioning_pipe = ProvisioningPipe::from_socket(ws)?;
         let provision_stream = provisioning_pipe.stream();
diff --git a/libsignal-service/src/provisioning/mod.rs b/libsignal-service/src/provisioning/mod.rs
index 347cea83a..7508c2c85 100644
--- a/libsignal-service/src/provisioning/mod.rs
+++ b/libsignal-service/src/provisioning/mod.rs
@@ -35,5 +35,5 @@ pub enum ProvisioningError {
 pub fn generate_registration_id<R: rand::Rng + rand::CryptoRng>(
     csprng: &mut R,
 ) -> u32 {
-    csprng.gen_range(1, 16380)
+    csprng.gen_range(1..16380)
 }
diff --git a/libsignal-service/src/push_service.rs b/libsignal-service/src/push_service.rs
index 28a23a6b8..095433d33 100644
--- a/libsignal-service/src/push_service.rs
+++ b/libsignal-service/src/push_service.rs
@@ -101,6 +101,16 @@ pub struct ServiceIds {
     pub pni: Uuid,
 }
 
+impl ServiceIds {
+    pub fn aci(&self) -> libsignal_protocol::Aci {
+        libsignal_protocol::Aci::from_uuid_bytes(self.aci.into_bytes())
+    }
+
+    pub fn pni(&self) -> libsignal_protocol::Pni {
+        libsignal_protocol::Pni::from_uuid_bytes(self.pni.into_bytes())
+    }
+}
+
 impl fmt::Display for ServiceIds {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         write!(f, "aci={} pni={}", self.aci, self.pni)
@@ -816,9 +826,9 @@ pub trait PushService: MaybeSend {
         profile_key: Option<zkgroup::profiles::ProfileKey>,
     ) -> Result<SignalServiceProfile, ServiceError> {
         let endpoint = if let Some(key) = profile_key {
-            let uid_bytes = address.uuid.as_bytes();
-            let version =
-                bincode::serialize(&key.get_profile_key_version(*uid_bytes))?;
+            let version = bincode::serialize(
+                &key.get_profile_key_version(address.aci()),
+            )?;
             let version = std::str::from_utf8(&version)
                 .expect("hex encoded profile key version");
             format!("/v1/profile/{}/{}", address.uuid, version)
diff --git a/libsignal-service/src/sender.rs b/libsignal-service/src/sender.rs
index 8d693e68f..eeb25ca7f 100644
--- a/libsignal-service/src/sender.rs
+++ b/libsignal-service/src/sender.rs
@@ -544,8 +544,8 @@ where
                             &mut self.protocol_store.clone(),
                             &mut self.protocol_store,
                             &pre_key,
+                            SystemTime::now(),
                             &mut self.csprng,
-                            None,
                         )
                         .await
                         .map_err(|e| {
@@ -719,12 +719,7 @@ where
                 device_id.into(),
             )
             .await?;
-            if self
-                .protocol_store
-                .load_session(&ppa, None)
-                .await?
-                .is_some()
-            {
+            if self.protocol_store.load_session(&ppa).await?.is_some() {
                 messages.push(
                     self.create_encrypted_message(
                         recipient,
@@ -760,7 +755,7 @@ where
 
         if self
             .protocol_store
-            .load_session(&recipient_address, None)
+            .load_session(&recipient_address)
             .await?
             .is_none()
         {
@@ -801,8 +796,8 @@ where
                     &mut self.protocol_store.clone(),
                     &mut self.protocol_store,
                     &pre_key_bundle,
+                    SystemTime::now(),
                     &mut self.csprng,
-                    None,
                 )
                 .await?;
             }
diff --git a/libsignal-service/src/service_address.rs b/libsignal-service/src/service_address.rs
index 8f3e3d95d..56121de67 100644
--- a/libsignal-service/src/service_address.rs
+++ b/libsignal-service/src/service_address.rs
@@ -25,6 +25,10 @@ impl ServiceAddress {
     ) -> ProtocolAddress {
         ProtocolAddress::new(self.uuid.to_string(), device_id.into())
     }
+
+    pub fn aci(&self) -> libsignal_protocol::Aci {
+        libsignal_protocol::Aci::from_uuid_bytes(self.uuid.into_bytes())
+    }
 }
 
 impl From<Uuid> for ServiceAddress {
diff --git a/libsignal-service/src/session_store.rs b/libsignal-service/src/session_store.rs
index e677c9df9..e203807c8 100644
--- a/libsignal-service/src/session_store.rs
+++ b/libsignal-service/src/session_store.rs
@@ -1,6 +1,4 @@
-use libsignal_protocol::{
-    Context, ProtocolAddress, SessionStore, SignalProtocolError,
-};
+use libsignal_protocol::{ProtocolAddress, SessionStore, SignalProtocolError};
 
 use crate::{push_service::DEFAULT_DEVICE_ID, ServiceAddress};
 
@@ -56,7 +54,6 @@ pub trait SessionStoreExt: SessionStore {
         &'s self,
         local_address: &'s ServiceAddress,
         address: &'s ServiceAddress,
-        context: Context,
     ) -> std::pin::Pin<
         Box<
             dyn std::future::Future<
@@ -75,11 +72,11 @@ pub trait SessionStoreExt: SessionStore {
             )
             .await?;
             let ident = self
-                .get_identity(&addr, context)
+                .get_identity(&addr)
                 .await?
                 .ok_or(SignalProtocolError::UntrustedIdentity(addr))?;
             let local = self
-                .get_identity_key_pair(context)
+                .get_identity_key_pair()
                 .await
                 .expect("valid local identity");
             let fp = libsignal_protocol::Fingerprint::new(