diff --git a/unshackle/core/api/download_manager.py b/unshackle/core/api/download_manager.py
index 183c3203..0bcc416b 100644
--- a/unshackle/core/api/download_manager.py
+++ b/unshackle/core/api/download_manager.py
@@ -195,7 +195,9 @@ def _perform_download(
     if job_credential:
         import hashlib
 
-        cred_hash = hashlib.sha256(job_credential.encode("utf-8")).hexdigest()[:12]
+        cred_hash = hashlib.pbkdf2_hmac("sha256", job_credential.encode("utf-8"), b"unshackle-job-ns", 100_000).hex()[
+            :12
+        ]
         config.directories.cache = config.directories.cache / "_jobs" / cred_hash
 
     # Convert string parameters to enums (API receives strings, dl.result() expects enums)
diff --git a/unshackle/core/api/handlers.py b/unshackle/core/api/handlers.py
index 1f18e518..c21b0008 100644
--- a/unshackle/core/api/handlers.py
+++ b/unshackle/core/api/handlers.py
@@ -1289,7 +1289,7 @@ async def session_create_handler(data: Dict[str, Any], request: Optional[web.Req
 
         session_id = str(uuid_mod.uuid4())
         api_key = request.headers.get("X-Secret-Key", "anonymous") if request else "anonymous"
-        api_key_hash = hashlib.sha256(api_key.encode()).hexdigest()[:12]
+        api_key_hash = hashlib.pbkdf2_hmac("sha256", api_key.encode(), b"unshackle-session-ns", 100_000).hex()[:12]
         session_cache_tag = f"_sessions/{api_key_hash}/{session_id}/{normalized_service}"
 
         service_instance, cookies, credential = _create_service_instance(