diff --git a/Modules/sha256module.c b/Modules/sha256module.c
index 1daa7fabbd19f4..630e4bf03bbe96 100644
--- a/Modules/sha256module.c
+++ b/Modules/sha256module.c
@@ -124,7 +124,9 @@ static void update_256(Hacl_Streaming_SHA2_state_sha2_256 *state, uint8_t *buf,
     len -= UINT32_MAX;
     buf += UINT32_MAX;
   }
-  Hacl_Streaming_SHA2_update_256(state, buf, len);
+  /* Cast to uint32_t is safe: upon exiting the loop, len <= UINT32_MAX, and
+   * therefore fits in a uint32_t */
+  Hacl_Streaming_SHA2_update_256(state, buf, (uint32_t) len);
 }