diff --git a/config/initializers/cookie_rotator.rb b/config/initializers/cookie_rotator.rb
index 349c363f14..b829b1a90b 100644
--- a/config/initializers/cookie_rotator.rb
+++ b/config/initializers/cookie_rotator.rb
@@ -1,5 +1,10 @@
 # frozen_string_literal: true
 
+# TODO: Remove after 4.2.0
+Rails.application.configure do
+  config.active_support.key_generator_hash_digest_class = OpenSSL::Digest::SHA1
+end
+
 Rails.application.config.after_initialize do
   Rails.application.config.action_dispatch.cookies_rotations.tap do |cookies|
     authenticated_encrypted_cookie_salt = Rails.application.config.action_dispatch.authenticated_encrypted_cookie_salt
@@ -7,8 +12,9 @@ Rails.application.config.after_initialize do
 
     secret_key_base = Rails.application.secret_key_base
 
+    # TODO: Switch to SHA1 after 4.2.0
     key_generator = ActiveSupport::KeyGenerator.new(
-      secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA1
+      secret_key_base, iterations: 1000, hash_digest_class: OpenSSL::Digest::SHA256
     )
     key_len = ActiveSupport::MessageEncryptor.key_len