diff --git a/src/packager/packager.js b/src/packager/packager.js
index f195b8d..317e710 100644
--- a/src/packager/packager.js
+++ b/src/packager/packager.js
@@ -1,5 +1,5 @@
 import {EventTarget, CustomEvent} from '../common/event-target';
-import createChecksumWorker from '../build/p4-worker-loader!./sha256'
+import sha256 from './sha256';
 import escapeXML from '../common/escape-xml';
 import largeAssets from './large-assets';
 import request from '../common/request';
@@ -29,13 +29,6 @@ const removeUnnecessaryEmptyLines = (string) => string.split('\n')
   })
   .join('\n');
 
-const sha256 = async (buffer) => {
-  const {worker, terminate} = createChecksumWorker();
-  const hash = await worker.sha256(buffer);
-  terminate();
-  return hash;
-};
-
 const getJSZip = async () => (await import(/* webpackChunkName: "jszip" */ 'jszip')).default;
 
 const setFileFast = (zip, path, data) => {
diff --git a/src/packager/sha256.js b/src/packager/sha256.js
index caaa0ce..0a89e23 100644
--- a/src/packager/sha256.js
+++ b/src/packager/sha256.js
@@ -1,5 +1,15 @@
-import shajs from 'sha.js';
+const sha256 = async (arrayBuffer) => {
+  // Use the browser's builtin SHA-256 if possible.
+  // This API might not exist if we're not a secure context or in versions of Node that aren't even that old,
+  // so we also have a pure JS fallback.
+  if (typeof crypto === 'object' && crypto.subtle && crypto.subtle.digest) {
+    const rawData = await crypto.subtle.digest('SHA-256', arrayBuffer);
+    return Array.from(new Uint8Array(rawData)).map(b => b.toString(16).padStart(2, '0')).join('');
+  }
 
-export const sha256 = (buffer) => {
-  return shajs('sha256').update(new Uint8Array(buffer)).digest('hex');
+  const shajs = await import(/* webpackChunkName: "shajs" */ 'sha.js');
+  // Note: this will block the main thread for a while.
+  return shajs.default('sha256').update(new Uint8Array(arrayBuffer)).digest('hex');
 };
+
+export default sha256;