diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e970c93a..c4a4877a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -272,7 +272,8 @@ jobs:
       - name: Install wheel for testing
         run: |
           source venv/bin/activate
-          pip install dist/c2pa_python-*.whl
+          # `[test]` extra pulls cryptography for the callback-signer tests.
+          pip install "$(ls dist/c2pa_python-*.whl)[test]"
 
       - name: Run unittest tests on installed wheel
         run: |
@@ -372,8 +373,8 @@ jobs:
           .\venv\Scripts\activate
           $wheel = Get-ChildItem -Path dist -Filter "c2pa_python-*.whl" | Select-Object -First 1
           if (-not $wheel) { Write-Error "No wheel file found in dist directory"; exit 1 }
-          pip install $wheel.FullName
-          pip install -r requirements.txt
+          # `[test]` extra pulls cryptography for the callback-signer tests.
+          pip install "$($wheel.FullName)[test]"
           pip install pytest
 
       - name: Run tests with pytest (venv)
@@ -453,7 +454,8 @@ jobs:
       - name: Install wheel for testing
         run: |
           source venv/bin/activate
-          pip install dist/c2pa_python-*.whl
+          # `[test]` extra pulls cryptography for the callback-signer tests.
+          pip install "$(ls dist/c2pa_python-*.whl)[test]"
 
       - name: Run unittest tests on installed wheel
         run: |
diff --git a/pyproject.toml b/pyproject.toml
index 7620ff9e..5e2a3714 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -23,10 +23,16 @@ maintainers = [
 urls = {homepage = "https://contentauthenticity.org", repository = "https://github.com/contentauth/c2pa-python"}
 dependencies = [
     "toml>=0.10.2",
-    "cryptography>=41.0.0",
     "requests>=2.0.0"
 ]
 
+# `cryptography` is only used by the tests/examples (callback signers), not by
+# the runtime bindings, so it is a test-only extra rather than an install dep.
+[project.optional-dependencies]
+test = [
+    "cryptography>=41.0.0"
+]
+
 [project.scripts]
 download-artifacts = "c2pa.build:download_artifacts"
 
diff --git a/requirements.txt b/requirements.txt
index 481efa9f..4cc52382 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,2 +1,2 @@
-# only used in the training example
-cryptography>=47.0.0
+# Runtime has no pure-Python pip dependencies (crypto lives in the native lib).
+# `cryptography` is a test-only extra: see pyproject.toml / requirements-dev.txt.