diff --git a/CHANGELOG.md b/CHANGELOG.md
index f2126ab39..788724177 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,7 @@ major series.
 
 ## 4.x series
 
+* Make `digest` an optional feature
 * Migrate documentation to docs.rs hosted
 * Fix backend documentation generation
 * Deprecate `EdwardsPoint::hash_from_bytes` and rename it `EdwardsPoint::nonspect_map_to_curve`
diff --git a/Cargo.toml b/Cargo.toml
index c621a192a..3553c468b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -44,7 +44,7 @@ harness = false
 [dependencies]
 cfg-if = "1"
 rand_core = { version = "0.6", default-features = false }
-digest = { version = "0.10", default-features = false }
+digest = { version = "0.10", default-features = false, optional = true }
 subtle = { version = "^2.2.1", default-features = false }
 serde = { version = "1.0", default-features = false, optional = true, features = ["derive"] }
 # The original packed_simd package was orphaned, see
@@ -58,6 +58,7 @@ nightly = ["subtle/nightly"]
 default = ["std"]
 std = ["alloc", "subtle/std", "rand_core/std"]
 alloc = ["zeroize/alloc"]
+digest = ["dep:digest"]
 
 # fiat-crypto backend with formally-verified field arithmetic
 fiat_backend = ["fiat-crypto"]
diff --git a/src/edwards.rs b/src/edwards.rs
index 8dcdc2db9..a74d546b0 100644
--- a/src/edwards.rs
+++ b/src/edwards.rs
@@ -101,7 +101,9 @@ use core::ops::{Add, Neg, Sub};
 use core::ops::{AddAssign, SubAssign};
 use core::ops::{Mul, MulAssign};
 
+#[cfg(feature = "digest")]
 use digest::{generic_array::typenum::U64, Digest};
+
 use subtle::Choice;
 use subtle::ConditionallyNegatable;
 use subtle::ConditionallySelectable;
@@ -534,6 +536,7 @@ impl EdwardsPoint {
         CompressedEdwardsY(s)
     }
 
+    #[cfg(feature = "digest")]
     /// Maps the digest of the input bytes to the curve. This is NOT a hash-to-curve function, as
     /// it produces points with a non-uniform distribution. Rather, it performs something that
     /// resembles (but is not) half of the
@@ -1683,7 +1686,7 @@ mod test {
     //     https://github.com/signalapp/libsignal-protocol-c/ //
     ////////////////////////////////////////////////////////////
 
-    #[cfg(feature = "alloc")]
+    #[cfg(all(feature = "alloc", feature = "digest"))]
     fn test_vectors() -> Vec<Vec<&'static str>> {
         vec![
             vec![
@@ -1731,7 +1734,7 @@ mod test {
 
     #[test]
     #[allow(deprecated)]
-    #[cfg(feature = "alloc")]
+    #[cfg(all(feature = "alloc", feature = "digest"))]
     fn elligator_signal_test_vectors() {
         for vector in test_vectors().iter() {
             let input = hex::decode(vector[0]).unwrap();
diff --git a/src/lib.rs b/src/lib.rs
index e831b4f78..46688c9d3 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -36,6 +36,7 @@ extern crate alloc;
 #[macro_use]
 extern crate std;
 
+#[cfg(feature = "digest")]
 pub use digest;
 
 // Internal macros. Must come first!
diff --git a/src/ristretto.rs b/src/ristretto.rs
index d4beec10a..80c23b97a 100644
--- a/src/ristretto.rs
+++ b/src/ristretto.rs
@@ -167,7 +167,9 @@ use core::ops::{Mul, MulAssign};
 
 use rand_core::{CryptoRng, RngCore};
 
+#[cfg(feature = "digest")]
 use digest::generic_array::typenum::U64;
+#[cfg(feature = "digest")]
 use digest::Digest;
 
 use crate::constants;
@@ -685,6 +687,7 @@ impl RistrettoPoint {
         RistrettoPoint::from_uniform_bytes(&uniform_bytes)
     }
 
+    #[cfg(feature = "digest")]
     /// Hash a slice of bytes into a `RistrettoPoint`.
     ///
     /// Takes a type parameter `D`, which is any `Digest` producing 64
@@ -722,6 +725,7 @@ impl RistrettoPoint {
         RistrettoPoint::from_hash(hash)
     }
 
+    #[cfg(feature = "digest")]
     /// Construct a `RistrettoPoint` from an existing `Digest` instance.
     ///
     /// Use this instead of `hash_from_bytes` if it is more convenient
diff --git a/src/scalar.rs b/src/scalar.rs
index 4b3a7bd0e..d3d128012 100644
--- a/src/scalar.rs
+++ b/src/scalar.rs
@@ -81,32 +81,9 @@
 //! assert!(a == two);
 //! ```
 //!
-//! There is also a constructor that reduces a \\(512\\)-bit integer,
-//! [`Scalar::from_bytes_mod_order_wide`](struct.Scalar.html#method.from_bytes_mod_order_wide).
-//!
-//! To construct a `Scalar` as the hash of some input data, use
-//! [`Scalar::hash_from_bytes`](struct.Scalar.html#method.hash_from_bytes),
-//! which takes a buffer, or
-//! [`Scalar::from_hash`](struct.Scalar.html#method.from_hash),
-//! which allows an IUF API.
-//!
-//! ```
-//! # fn main() {
-//! use sha2::{Digest, Sha512};
-//! use curve25519_dalek::scalar::Scalar;
-//!
-//! // Hashing a single byte slice
-//! let a = Scalar::hash_from_bytes::<Sha512>(b"Abolish ICE");
-//!
-//! // Streaming data into a hash object
-//! let mut hasher = Sha512::default();
-//! hasher.update(b"Abolish ");
-//! hasher.update(b"ICE");
-//! let a2 = Scalar::from_hash(hasher);
-//!
-//! assert_eq!(a, a2);
-//! # }
-//! ```
+//! See also `Scalar::hash_from_bytes` and `Scalar::from_hash` that
+//! reduces a \\(512\\)-bit integer, if the optional `digest` feature
+//! has been enabled.
 //!
 //! Finally, to create a `Scalar` with a specific bit-pattern
 //! (e.g., for compatibility with X/Ed25519
@@ -154,7 +131,9 @@ use cfg_if::cfg_if;
 
 use rand_core::{CryptoRng, RngCore};
 
+#[cfg(feature = "digest")]
 use digest::generic_array::typenum::U64;
+#[cfg(feature = "digest")]
 use digest::Digest;
 
 use subtle::Choice;
@@ -591,6 +570,7 @@ impl Scalar {
         Scalar::from_bytes_mod_order_wide(&scalar_bytes)
     }
 
+    #[cfg(feature = "digest")]
     /// Hash a slice of bytes into a scalar.
     ///
     /// Takes a type parameter `D`, which is any `Digest` producing 64
@@ -620,6 +600,7 @@ impl Scalar {
         Scalar::from_hash(hash)
     }
 
+    #[cfg(feature = "digest")]
     /// Construct a scalar from an existing `Digest` instance.
     ///
     /// Use this instead of `hash_from_bytes` if it is more convenient