diff --git a/headroom/utils.py b/headroom/utils.py
index 8840b4046..b9d94f604 100644
--- a/headroom/utils.py
+++ b/headroom/utils.py
@@ -23,7 +23,7 @@ def generate_request_id() -> str:
 def compute_hash(data: str | bytes) -> str:
     """Compute SHA256 hash, returning hex string."""
     if isinstance(data, str):
-        data = data.encode("utf-8")
+        data = data.encode("utf-8", errors="surrogatepass")
     return hashlib.sha256(data).hexdigest()
 
 
diff --git a/tests/test_compression_store.py b/tests/test_compression_store.py
index 6e77f650a..2e2f4b5a2 100644
--- a/tests/test_compression_store.py
+++ b/tests/test_compression_store.py
@@ -1249,10 +1249,10 @@ class TestHashCollisionDetection:
         # Should not have collision warning
         assert "Hash collision detected" not in caplog.text
 
-    def test_hash_uses_sha256_truncated(self, store: CompressionStore):
-        """Hash is SHA256 truncated to 24 characters."""
+    def test_hash_uses_md5_truncated(self, store: CompressionStore):
+        """Hash is MD5 truncated to 24 characters (fast, non-crypto)."""
         content = "test content"
-        expected_hash = hashlib.sha256(content.encode()).hexdigest()[:24]
+        expected_hash = hashlib.md5(content.encode()).hexdigest()[:24]
 
         hash_key = store.store(original=content, compressed="[]")