diff --git a/hackage-security/ChangeLog.md b/hackage-security/ChangeLog.md
index f5028d69..90f43dcd 100644
--- a/hackage-security/ChangeLog.md
+++ b/hackage-security/ChangeLog.md
@@ -5,6 +5,7 @@ See also http://pvp.haskell.org/faq
 
 * Allow `tar-0.6`
 * Drop support for GHC < 7.8 in favor of `PatternSynonyms`
+* Drop flags `base48`, `mtl21`, `old-directory` and support for GHC 7.8, `mtl < 2.2` and `directory < 1.2`
 * Tested with GHC 7.10 - 9.8
 
 0.6.2.3
diff --git a/hackage-security/hackage-security.cabal b/hackage-security/hackage-security.cabal
index bb9ea521..d1e8f15e 100644
--- a/hackage-security/hackage-security.cabal
+++ b/hackage-security/hackage-security.cabal
@@ -51,10 +51,6 @@ source-repository head
   type: git
   location: https://github.com/haskell/hackage-security.git
 
-flag base48
-  description: Are we using @base@ 4.8 or later?
-  manual: False
-
 flag use-network-uri
   description: Are we using @network-uri@?
   manual: False
@@ -64,16 +60,6 @@ flag Cabal-syntax
   manual: False
   default: False
 
-flag old-directory
-  description: Use @directory@ < 1.2 and @old-time@
-  manual:      False
-  default:     False
-
-flag mtl21
-  description: Use @mtl@ < 2.2 and @mtl-compat@
-  manual:      False
-  default:     False
-
 flag lukko
   description: Use @lukko@ for file-locking, otherwise use @GHC.IO.Handle.Lock@
   manual:      True
@@ -126,17 +112,19 @@ library
                        Hackage.Security.Util.TypedEmbedded
                        MyPrelude
   -- We support ghc 7.4 (bundled with Cabal 1.14) and up
-  build-depends:       base              >= 4.7     && < 4.20,
+  build-depends:       base              >= 4.8     && < 4.20,
                          -- PatternSynonyms are only available since GHC 7.8 (base 4.7)
                        base16-bytestring >= 0.1.1   && < 1.1,
                        base64-bytestring >= 1.0     && < 1.3,
                        bytestring        >= 0.9     && < 0.13,
                        containers        >= 0.4     && < 0.8,
+                       cryptohash-sha256 >= 0.11    && < 0.12,
+                       directory         >= 1.2     && < 1.4,
                        ed25519           >= 0.0     && < 0.1,
                        filepath          >= 1.2     && < 1.5,
+                       mtl               >= 2.2     && < 2.4,
                        parsec            >= 3.1     && < 3.2,
                        pretty            >= 1.0     && < 1.2,
-                       cryptohash-sha256 >= 0.11    && < 0.12,
                        -- 0.4.2 introduces TarIndex, 0.4.4 introduces more
                        -- functionality, 0.5.0 changes type of serialise
                        tar               >= 0.5     && < 0.7,
@@ -146,17 +134,6 @@ library
                        zlib              >= 0.5     && < 0.7,
                        -- whatever versions are bundled with ghc:
                        ghc-prim
-  if flag(old-directory)
-    build-depends:     directory  >= 1.1.0.2 && < 1.2,
-                       old-time   >= 1 &&       < 1.2
-  else
-    build-depends:     directory  >= 1.2 && < 1.4
-
-  if flag(mtl21)
-    build-depends:     mtl        >= 2.1     && < 2.2,
-                       mtl-compat >= 0.2     && < 0.3
-  else
-    build-depends:     mtl        >= 2.2     && < 2.4
 
   if flag(lukko)
     build-depends:     lukko      >= 0.1     && < 0.2
@@ -194,10 +171,14 @@ library
                        TypeFamilies
                        TypeOperators
                        ViewPatterns
-  other-extensions:    BangPatterns
+  other-extensions:
+                       AllowAmbiguousTypes
+                       BangPatterns
                        CPP
                        OverlappingInstances
                        PackageImports
+                       RoleAnnotations
+                       StaticPointers
                        UndecidableInstances
 
   -- use the new stage1/cross-compile-friendly DeriveLift extension for GHC 8.0+
@@ -208,11 +189,6 @@ library
 
   ghc-options:         -Wall
 
-  if flag(base48)
-    build-depends: base >= 4.8
-  else
-    build-depends: base < 4.8, old-locale == 1.0.*
-
   -- The URI type got split out off the network package after version 2.5, and
   -- moved to a separate network-uri package. Since we don't need the rest of
   -- network here, it would suffice to rely only on network-uri:
@@ -252,13 +228,6 @@ library
   else
     build-depends: network     >= 2.5 && < 2.6
 
-  if impl(ghc >= 7.8)
-     other-extensions: RoleAnnotations
-
-  if impl(ghc >= 7.10)
-     other-extensions: AllowAmbiguousTypes
-                       StaticPointers
-
 test-suite TestSuite
   type:                exitcode-stdio-1.0
   main-is:             TestSuite.hs