diff --git a/Cargo.toml b/Cargo.toml
index 87e705b7..a1994964 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,7 +45,7 @@ itertools = "0.12"
 log = "0.4"
 percent-encoding = "2"
 rustls = { version = "^0.23", optional = true, features = ["ring"] }
-rustls-pemfile = { version = "1.0.1", optional = true }
+rustls-pemfile = { version = "2.0.0", optional = true }
 seahash = "4"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
diff --git a/src/service_account.rs b/src/service_account.rs
index 116259a3..e8b7fbef 100644
--- a/src/service_account.rs
+++ b/src/service_account.rs
@@ -38,18 +38,15 @@ fn append_base64<T: AsRef<[u8]> + ?Sized>(s: &T, out: &mut String) {
 
 /// Decode a PKCS8 formatted RSA key.
 fn decode_rsa_key(pem_pkcs8: &str) -> Result<PrivateKeyDer, io::Error> {
-    let private_keys = rustls_pemfile::pkcs8_private_keys(&mut pem_pkcs8.as_bytes());
+    let private_key = rustls_pemfile::pkcs8_private_keys(&mut pem_pkcs8.as_bytes()).next();
 
-    match private_keys {
-        Ok(mut keys) if !keys.is_empty() => {
-            keys.truncate(1);
-            Ok(PrivateKeyDer::Pkcs8(keys.remove(0).into()))
-        }
-        Ok(_) => Err(io::Error::new(
+    match private_key {
+        Some(Ok(key)) => Ok(PrivateKeyDer::Pkcs8(key.into())),
+        None => Err(io::Error::new(
             io::ErrorKind::InvalidInput,
             "Not enough private keys in PEM",
         )),
-        Err(_) => Err(io::Error::new(
+        Some(Err(_)) => Err(io::Error::new(
             io::ErrorKind::InvalidInput,
             "Error reading key from PEM",
         )),