diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index e21191a0..5bd950f1 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -25,6 +25,18 @@ Release history
 ^^^^^^^^^^^^^^^
     ..  This extra heading level keeps the ToC from becoming unmanageably long
 
+vNext
+-----
+
+*Unreleased changes*
+
+Breaking changes
+~~~~~~~~~~~~~~~~
+
+* **Postal:** Require Python 3.9 or later for Postal tracking webhook support.
+  (Postal's signature verification uses the "cryptography" package, which is no
+  longer reliably installable with Python 3.8.)
+
 
 v12.0
 -----
diff --git a/pyproject.toml b/pyproject.toml
index b4f67861..23326dde 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -83,8 +83,10 @@ sparkpost = []
 unisender-go = []
 postal = [
     # Postal requires cryptography for verifying webhooks.
-    # Cryptography's wheels are broken on darwin-arm64 before Python 3.9.
-    "cryptography; sys_platform != 'darwin' or platform_machine != 'arm64' or python_version >= '3.9'"
+    # Cryptography's wheels are broken on darwin-arm64 before Python 3.9,
+    # and unbuildable on PyPy 3.8 due to PyO3 limitations. Since cpython 3.8
+    # has also passed EOL, just require Python 3.9+ with Postal.
+    "cryptography; python_version >= '3.9'"
 ]
 
 [project.urls]