diff --git a/crates/ctap2-proto/Cargo.toml b/crates/ctap2-proto/Cargo.toml
index 4e272c3..5139203 100644
--- a/crates/ctap2-proto/Cargo.toml
+++ b/crates/ctap2-proto/Cargo.toml
@@ -8,9 +8,8 @@ edition = "2021"
 [dependencies]
 fido-common = { path = "../fido-common" }
 bounded-integer = { version = "0.5.3", features = ["types", "std"] }
-bounded-vec = "0.7.1"
 coset = "0.3.3"
 serde = { version = "1.0", features = ["derive"], optional = true }
 
 [features]
-serde = ["dep:serde", "bounded-vec/serde", "fido-common/serde"]
+serde = ["dep:serde", "fido-common/serde"]
diff --git a/crates/ctap2-proto/src/authenticator/assertion/get.rs b/crates/ctap2-proto/src/authenticator/assertion/get.rs
index c25ddd9..095f2e6 100644
--- a/crates/ctap2-proto/src/authenticator/assertion/get.rs
+++ b/crates/ctap2-proto/src/authenticator/assertion/get.rs
@@ -1,6 +1,5 @@
 use crate::{authenticator::client_pin::AuthProtocolVersion, extensions};
 use crate::Sha256Hash;
-use bounded_vec::BoundedVec;
 use fido_common::credential::public_key;
 use std::{collections::BTreeMap, usize};
 
@@ -42,7 +41,8 @@ pub struct Request<'a> {
     /// > credential, as specified in `WebAuthn`... If this parameter is present
     /// > the authenticator MUST only generate a assertion using one of the
     /// > denoted credentials.
-    pub allow_list: Option<&'a BoundedVec<&'a public_key::Descriptor, 1, { usize::MAX }>>,
+    // Cannot be empty if present
+    pub allow_list: Option<&'a Vec<&'a public_key::Descriptor>>,
     /// > Parameters to influence authenticator operation. These parameters
     /// > might be authenticator specific.
     pub extensions: Option<&'a BTreeMap<extensions::Identifier, &'a [u8]>>,
diff --git a/crates/ctap2-proto/src/authenticator/device.rs b/crates/ctap2-proto/src/authenticator/device.rs
index 015fdb3..a2e085e 100644
--- a/crates/ctap2-proto/src/authenticator/device.rs
+++ b/crates/ctap2-proto/src/authenticator/device.rs
@@ -1,7 +1,6 @@
 use crate::authenticator::client_pin::AuthProtocolVersion;
 use crate::authenticator::Transport;
 use crate::extensions;
-use bounded_vec::BoundedVec;
 use fido_common::credential::public_key;
 use fido_common::registry;
 use std::collections::{BTreeMap, BTreeSet};
@@ -195,7 +194,8 @@ pub struct Info {
     pub max_message_size: Option<usize>,
     /// > List of supported PIN/UV auth protocols in order of decreasing
     /// > authenticator preference. MUST NOT contain duplicate values...
-    pub pin_uv_auth_protocols: Option<BoundedVec<AuthProtocolVersion, 1, { usize::MAX }>>,
+    // Cannot be empty if present
+    pub pin_uv_auth_protocols: Option<Vec<AuthProtocolVersion>>,
     /// > Maximum number of credentials supported in credentialID list at a time
     /// > by the authenticator.
     pub max_credential_count_in_list: Option<NonZeroUsize>,
@@ -206,7 +206,8 @@ pub struct Info {
     /// > List of supported algorithms for credential generation... The array is
     /// > ordered from most preferred to least preferred and MUST NOT include
     /// > duplicate entries...
-    pub algorithms: Option<BoundedVec<public_key::Parameters, 1, { usize::MAX }>>,
+    // Cannot be empty if present
+    pub algorithms: Option<Vec<public_key::Parameters>>,
     /// > The maximum size, in bytes, of the serialized large-blob array that
     /// > this authenticator can store. If the `authenticatorLargeBlobs` command
     /// > is supported, this MUST be specified. Otherwise it MUST NOT be.