diff --git a/Cargo.lock b/Cargo.lock
index 156a2f613..3886738f4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -295,7 +295,7 @@ dependencies = [
  "rustls 0.24.0-dev.2",
  "rustls-aws-lc-rs",
  "rustls-ring",
- "rustls-webpki 0.104.0-alpha.7",
+ "rustls-webpki 0.104.0-alpha.8",
  "tracing-subscriber",
 ]
 
@@ -1781,7 +1781,7 @@ dependencies = [
  "rcgen",
  "rustls-pki-types",
  "rustls-test",
- "rustls-webpki 0.104.0-alpha.7",
+ "rustls-webpki 0.104.0-alpha.8",
  "subtle",
  "time",
  "tracing",
@@ -1953,7 +1953,7 @@ dependencies = [
  "rustls-pki-types",
  "rustls-ring",
  "rustls-util",
- "rustls-webpki 0.104.0-alpha.7",
+ "rustls-webpki 0.104.0-alpha.8",
  "tracing",
  "webpki-roots",
  "x509-parser",
@@ -1981,9 +1981,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.104.0-alpha.7"
+version = "0.104.0-alpha.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bea702cca24d344fc70973022bf7eb920c224e318466eb49784272337dd24b1a"
+checksum = "e4f05eb03bb89c8b88908947d1add6fbe564e58db7b686dbda59691aaec0e450"
 dependencies = [
  "rustls-pki-types",
  "untrusted 0.9.0",
diff --git a/Cargo.toml b/Cargo.toml
index efbf1ef65..4ef7a492b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -87,7 +87,7 @@ tikv-jemallocator = "0.7"
 tokio = { version = "1.34", features = ["io-util", "macros", "net", "rt"] }
 tracing = { version = "0.1", default-features = false }
 tracing-subscriber = { version = "0.3", default-features = false, features = ["ansi", "env-filter", "fmt", "std"] }
-webpki = { package = "rustls-webpki", version = "=0.104.0-alpha.7", features = [
+webpki = { package = "rustls-webpki", version = "=0.104.0-alpha.8", features = [
   "alloc",
 ], default-features = false }
 webpki-roots = "1"
diff --git a/fuzz/Cargo.lock b/fuzz/Cargo.lock
index 2437c0e98..10936e43d 100644
--- a/fuzz/Cargo.lock
+++ b/fuzz/Cargo.lock
@@ -120,9 +120,9 @@ dependencies = [
 
 [[package]]
 name = "rustls-webpki"
-version = "0.104.0-alpha.7"
+version = "0.104.0-alpha.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bea702cca24d344fc70973022bf7eb920c224e318466eb49784272337dd24b1a"
+checksum = "e4f05eb03bb89c8b88908947d1add6fbe564e58db7b686dbda59691aaec0e450"
 dependencies = [
  "rustls-pki-types",
  "untrusted",
diff --git a/rustls/src/webpki/client_verifier.rs b/rustls/src/webpki/client_verifier.rs
index 1af822c71..63f8f29b3 100644
--- a/rustls/src/webpki/client_verifier.rs
+++ b/rustls/src/webpki/client_verifier.rs
@@ -2,7 +2,7 @@ use alloc::vec::Vec;
 
 use pki_types::CertificateRevocationListDer;
 use webpki::{
-    CertRevocationList, ExpirationPolicy, ExtendedKeyUsage, RevocationCheckDepth,
+    CertRevocationList, ExpirationPolicy, ExtendedKeyUsage, PathBuilder, RevocationCheckDepth,
     UnknownStatusPolicy,
 };
 
@@ -313,7 +313,7 @@ impl WebPkiClientVerifier {
         Self {
             roots,
             root_hint_subjects,
-            eku_validator: ExtendedKeyUsage::client_auth(),
+            eku_validator: ExtendedKeyUsage::CLIENT_AUTH,
             crls,
             revocation_check_depth,
             unknown_revocation_policy,
@@ -353,18 +353,16 @@ impl ClientVerifier for WebPkiClientVerifier {
             )
         };
 
-        cert.0
-            .verify_for_usage(
-                self.supported_algs.all,
-                &self.roots.roots,
-                &certificates.intermediates,
-                identity.now,
-                &self.eku_validator,
-                revocation,
-                None,
-            )
-            .map_err(pki_error)
-            .map(|_| VerifiedIdentity::assertion(identity.identity.clone()))
+        PathBuilder::new(
+            &certificates.intermediates,
+            revocation,
+            &self.eku_validator,
+            self.supported_algs.all,
+            &self.roots.roots,
+        )
+        .build(&cert.0, identity.now)
+        .map_err(pki_error)
+        .map(|_| VerifiedIdentity::assertion(identity.identity.clone()))
     }
 
     fn verify_tls12_signature(
diff --git a/rustls/src/webpki/verify.rs b/rustls/src/webpki/verify.rs
index 67eca519b..2f8c6d541 100644
--- a/rustls/src/webpki/verify.rs
+++ b/rustls/src/webpki/verify.rs
@@ -1,7 +1,7 @@
 use pki_types::{
     CertificateDer, ServerName, SignatureVerificationAlgorithm, SubjectPublicKeyInfoDer, UnixTime,
 };
-use webpki::ExtendedKeyUsage;
+use webpki::{ExtendedKeyUsage, PathBuilder};
 
 use super::anchors::RootCertStore;
 use super::pki_error;
@@ -186,15 +186,14 @@ pub(crate) fn verify_identity_signed_by_trust_anchor_impl(
     now: UnixTime,
     supported_algs: &[&dyn SignatureVerificationAlgorithm],
 ) -> Result<(), Error> {
-    let result = cert.0.verify_for_usage(
+    let result = PathBuilder::new(
+        intermediates,
+        revocation,
+        &ExtendedKeyUsage::SERVER_AUTH,
         supported_algs,
         &roots.roots,
-        intermediates,
-        now,
-        &ExtendedKeyUsage::server_auth(),
-        revocation,
-        None,
-    );
+    )
+    .build(&cert.0, now);
     match result {
         Ok(_) => Ok(()),
         Err(e) => Err(pki_error(e)),