diff --git a/Cargo.lock b/Cargo.lock
index 62c66cd..325b32d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -86,6 +86,17 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d468802bab17cbc0cc575e9b053f41e72aa36bfa6b7f55e3529ffa43161b97fa"
 
+[[package]]
+name = "binstall-tar"
+version = "0.4.39"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "01db907e07c37309ea816c183ffe548daaa66ef640a291408f232d6ca4089dbb"
+dependencies = [
+ "filetime",
+ "libc",
+ "xattr",
+]
+
 [[package]]
 name = "bitflags"
 version = "1.3.2"
@@ -250,6 +261,7 @@ version = "0.4.1"
 dependencies = [
  "anyhow",
  "assert_matches",
+ "binstall-tar",
  "blake3",
  "buck-resources",
  "dirs",
@@ -262,7 +274,6 @@ dependencies = [
  "serde_jsonrc",
  "sha2",
  "snapbox",
- "tar",
  "tempfile",
  "thiserror",
  "xz2",
@@ -621,17 +632,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "tar"
-version = "0.4.40"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b16afcea1f22891c49a00c751c7b63b2233284064f11a200fc624137c51e2ddb"
-dependencies = [
- "filetime",
- "libc",
- "xattr",
-]
-
 [[package]]
 name = "tempfile"
 version = "3.10.1"
@@ -857,9 +857,9 @@ checksum = "589f6da84c646204747d1270a2a5661ea66ed1cced2631d546fdfb155959f9ec"
 
 [[package]]
 name = "xattr"
-version = "1.0.1"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4686009f71ff3e5c4dbcf1a282d0a44db3f021ba69350cd42086b3e5f1c6985"
+checksum = "6d1526bbe5aaeb5eb06885f4d987bcdfa5e23187055de9b83fe00156a821fabc"
 dependencies = [
  "libc",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 8d7116f..b421ad4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,10 @@
 [package]
 name = "dotslash"
 version = "0.4.1"
-authors = ["Michael Bolin <bolinfest@gmail.com>", "Andres Suarez <zertosh@gmail.com>"]
+authors = [
+    "Michael Bolin <bolinfest@gmail.com>",
+    "Andres Suarez <zertosh@gmail.com>",
+]
 edition = "2021"
 rust-version = "1.75"
 description = "Command-line tool to facilitate fetching an executable, caching it, and then running it."
@@ -12,7 +15,13 @@ homepage = "https://dotslash-cli.com"
 repository = "https://github.com/facebook/dotslash"
 license = "MIT OR Apache-2.0"
 keywords = ["cli"]
-include = ["/LICENSE-APACHE", "/LICENSE-MIT", "/README.md", "/src/**", "/tests/**"]
+include = [
+    "/LICENSE-APACHE",
+    "/LICENSE-MIT",
+    "/README.md",
+    "/src/**",
+    "/tests/**",
+]
 
 [[test]]
 name = "dotslash_tests_rs"
@@ -24,12 +33,14 @@ blake3 = { version = "=1.5.0", features = ["traits-preview"] }
 dirs = "2.0"
 dunce = "1.0.2"
 filetime = "0.2.9"
-flate2 = { version = "1.0.33", features = ["rust_backend"], default-features = false }
+flate2 = { version = "1.0.33", features = [
+    "rust_backend",
+], default-features = false }
 fs2 = "0.4"
 serde = { version = "1.0.185", features = ["derive", "rc"] }
 serde_jsonrc = "0.1"
 sha2 = "0.10.6"
-tar = "0.4.40"
+binstall-tar = "0.4.39"
 tempfile = "3.8"
 thiserror = "1.0.49"
 xz2 = { version = "0.1.7", features = ["static"] }
@@ -39,7 +50,10 @@ zstd = { version = "0.13", features = ["experimental", "zstdmt"] }
 [dev-dependencies]
 assert_matches = "1.5"
 buck-resources = "1"
-snapbox = { version = "0.4.16", features = ["color-auto", "diff"], default-features = false }
+snapbox = { version = "0.4.16", features = [
+    "color-auto",
+    "diff",
+], default-features = false }
 
 [target.'cfg(target_os = "linux")'.dependencies]
 nix = "0.25"
diff --git a/src/decompress.rs b/src/decompress.rs
index d18632c..46d7458 100644
--- a/src/decompress.rs
+++ b/src/decompress.rs
@@ -45,15 +45,18 @@ pub fn untar(tar_file: &Path, destination_dir: &Path, is_tar_gz: bool) -> io::Re
     let file = fs_ctx::file_open(tar_file)?;
     if is_tar_gz {
         let decoder = flate2::read::GzDecoder::new(file);
-        let archive = tar::Archive::new(decoder);
+        let archive = binstall_tar::Archive::new(decoder);
         unpack(archive, &destination_dir)
     } else {
-        let archive = tar::Archive::new(file);
+        let archive = binstall_tar::Archive::new(file);
         unpack(archive, &destination_dir)
     }
 }
 
-pub fn unpack<R: Read>(mut archive: tar::Archive<R>, destination_dir: &Path) -> io::Result<()> {
+pub fn unpack<R: Read>(
+    mut archive: binstall_tar::Archive<R>,
+    destination_dir: &Path,
+) -> io::Result<()> {
     archive.set_preserve_permissions(true);
     archive.set_preserve_mtime(true);
     archive.unpack(destination_dir)
diff --git a/src/download.rs b/src/download.rs
index b565ee0..56d1777 100644
--- a/src/download.rs
+++ b/src/download.rs
@@ -16,10 +16,10 @@ use std::path::PathBuf;
 
 use anyhow::format_err;
 use anyhow::Context as _;
+use binstall_tar::Archive;
 use serde_jsonrc::value::Value;
 use sha2::Digest as _;
 use sha2::Sha256;
-use tar::Archive;
 use xz2::read::XzDecoder;
 use zstd::stream::read::Decoder;