diff --git a/src/k8-client/Cargo.toml b/src/k8-client/Cargo.toml
index 4740792..00e57cc 100644
--- a/src/k8-client/Cargo.toml
+++ b/src/k8-client/Cargo.toml
@@ -25,28 +25,28 @@ async-lock = { version = "3.3.0", optional = true }
 cfg-if = "1.0"
 tracing = "0.1.19"
 bytes = "1.6.0"
-base64 = { version="0.13.0" }
-futures-util = { version="0.3.21", features=["io"] }
-rand = { version="0.8.3" }
-rustls = { version="0.23.11", optional = true }
-hyper = { version="0.14.28", features=["client", "http1", "http2", "stream"] }
-http = { version="0.2.9" }
-tokio = { version="1.37.0" }
+base64 = { version = "0.22.1" }
+futures-util = { version = "0.3.21", features = ["io"] }
+rand = { version = "0.8.3" }
+rustls = { version = "0.23.11", optional = true }
+hyper = { version = "0.14.28", features = ["client", "http1", "http2", "stream"] }
+http = { version = "0.2.9" }
+tokio = { version = "1.37.0" }
 pin-utils = "0.1.0"
-serde = { version="1.0.136", features=['derive'] }
+serde = { version = "1.0.136", features = ['derive'] }
 serde_json = "1.0.40"
 serde_qs = "0.13.0"
 serde_yaml = { workspace = true, optional = true }
 async-trait = "0.1.52"
-fluvio-future = { workspace = true, features=["net", "task"] }
-k8-metadata-client = { version="7.0.0", path="../k8-metadata-client" }
-k8-diff = { version="0.1.0", path="../k8-diff" }
-k8-config = { version="2.3.0", path="../k8-config" }
-k8-types = { version="0.8.5", path="../k8-types", features=["core", "batch"] }
+fluvio-future = { workspace = true, features = ["net", "task"] }
+k8-metadata-client = { version = "7.0.0", path = "../k8-metadata-client" }
+k8-diff = { version = "0.1.0", path = "../k8-diff" }
+k8-config = { version = "2.3.0", path = "../k8-config" }
+k8-types = { version = "0.8.5", path = "../k8-types", features = ["core", "batch"] }
 
 [dev-dependencies]
 rand = "0.8.3"
 once_cell = "1.19.0"
 async-trait = "0.1.52"
 
-fluvio-future = { workspace = true, features=["fixture", "timer"] }
+fluvio-future = { workspace = true, features = ["fixture", "timer"] }
diff --git a/src/k8-client/src/cert.rs b/src/k8-client/src/cert.rs
index a0ef59e..308418d 100644
--- a/src/k8-client/src/cert.rs
+++ b/src/k8-client/src/cert.rs
@@ -135,7 +135,7 @@ where
     ) -> Result<(B, Option<String>)> {
         use std::process::Command;
 
-        use base64::decode;
+        use base64::prelude::{Engine, BASE64_STANDARD};
 
         use k8_types::core::plugin::ExecCredentialSpec;
         use k8_types::K8Obj;
@@ -152,7 +152,7 @@ where
 
         let builder = if let Some(ca_data) = &current_cluster.cluster.certificate_authority_data {
             debug!("detected in-line cluster CA certs");
-            let pem_bytes = decode(ca_data).unwrap();
+            let pem_bytes = BASE64_STANDARD.decode(ca_data).unwrap();
             builder.load_ca_cert_with_data(pem_bytes)?
         } else {
             // let not inline, then must must ref to file
@@ -195,16 +195,19 @@ where
             Ok((builder, Some(token)))
         } else if let Some(client_cert_data) = &current_user.user.client_certificate_data {
             debug!("detected in-line cluster CA certs");
-            let client_cert_pem_bytes = decode(client_cert_data).context("base64 decoding err")?;
-
-            let client_key_pem_bytes = decode(
-                current_user
-                    .user
-                    .client_key_data
-                    .as_ref()
-                    .ok_or_else(|| anyhow!("current user must have client key data"))?,
-            )
-            .context("base64 decoding err")?;
+            let client_cert_pem_bytes = BASE64_STANDARD
+                .decode(client_cert_data)
+                .context("base64 decoding err")?;
+
+            let client_key_pem_bytes = BASE64_STANDARD
+                .decode(
+                    current_user
+                        .user
+                        .client_key_data
+                        .as_ref()
+                        .ok_or_else(|| anyhow!("current user must have client key data"))?,
+                )
+                .context("base64 decoding err")?;
 
             Ok((
                 builder.load_client_certificate_with_data(