diff --git a/.github/workflows/ssh-key.yml b/.github/workflows/ssh-key.yml
index 5829969..2709d75 100644
--- a/.github/workflows/ssh-key.yml
+++ b/.github/workflows/ssh-key.yml
@@ -72,7 +72,7 @@ jobs:
           toolchain: ${{ matrix.rust }}
           target: ${{ matrix.target }}
       - uses: RustCrypto/actions/cargo-hack-install@master
-      - run: cargo hack build --target ${{ matrix.target }} --feature-powerset --exclude-features default,dsa,ed25519,getrandom,p256,p384,p521,rsa,tdes,std --release
+      - run: cargo hack build --target ${{ matrix.target }} --feature-powerset --exclude-features default,dsa,ed25519,getrandom,p256,p384,p521,rsa,tdes,std,ppk --release
       - run: cargo build --target ${{ matrix.target }} --no-default-features --features alloc,crypto,dsa,encryption,tdes --release
 
   test:
@@ -88,7 +88,7 @@ jobs:
         with:
           toolchain: ${{ matrix.rust }}
       - uses: RustCrypto/actions/cargo-hack-install@master
-      - run: cargo hack test --feature-powerset --exclude-features default,dsa,ed25519,getrandom,p256,p384,p521,rsa,tdes,std --release
+      - run: cargo hack test --feature-powerset --exclude-features default,dsa,ed25519,getrandom,p256,p384,p521,rsa,tdes,std,ppk --release
       - run: cargo test --release
       - run: cargo test --release --features getrandom
       - run: cargo test --release --features std
diff --git a/ssh-key/Cargo.toml b/ssh-key/Cargo.toml
index bd60a16..cf6d492 100644
--- a/ssh-key/Cargo.toml
+++ b/ssh-key/Cargo.toml
@@ -31,7 +31,7 @@ bcrypt-pbkdf = { version = "=0.11.0-pre.1", optional = true, default-features =
 bigint = { package = "num-bigint-dig", version = "0.8", optional = true, default-features = false }
 dsa = { version = "=0.7.0-pre.1", optional = true, default-features = false }
 ed25519-dalek = { version = "=2.2.0-pre", optional = true, default-features = false }
-hex = { version = "0.4", optional = true }
+hex = { version = "0.4", optional = true, default-features = false, features = ["alloc"] }
 hmac = { version = "=0.13.0-pre.4", optional = true }
 home = { version = "0.5", optional = true }
 p256 = { version = "=0.14.0-pre.1", optional = true, default-features = false, features = ["ecdsa"] }
diff --git a/ssh-key/src/ppk.rs b/ssh-key/src/ppk.rs
index e3dda1b..8a135d1 100644
--- a/ssh-key/src/ppk.rs
+++ b/ssh-key/src/ppk.rs
@@ -403,6 +403,7 @@ fn decode_private_key_as(
             )?))
         }
 
+        #[cfg(feature = "rsa")]
         (Algorithm::Rsa { .. }, KeyData::Rsa(pk)) => {
             use crate::private::{RsaKeypair, RsaPrivateKey};
 
diff --git a/ssh-key/tests/private_key.rs b/ssh-key/tests/private_key.rs
index 98293d8..09a350d 100644
--- a/ssh-key/tests/private_key.rs
+++ b/ssh-key/tests/private_key.rs
@@ -173,6 +173,7 @@ fn decode_ecdsa_p256_ppk_encrypted() {
     );
 }
 
+#[cfg(feature = "p256")]
 fn validate_ecdsa_p256(key: PrivateKey) {
     assert_eq!(
         Algorithm::Ecdsa {
@@ -360,6 +361,7 @@ fn decode_rsa_3072_ppk_encrypted() {
     );
 }
 
+#[cfg(feature = "rsa")]
 fn validate_rsa_3072(key: PrivateKey) {
     assert_eq!(Algorithm::Rsa { hash: None }, key.algorithm());
     assert_eq!(Cipher::None, key.cipher());