diff --git a/Cargo.toml b/Cargo.toml
index fb8758264..80409e0fc 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -73,6 +73,7 @@ secrecy = "0.10.2"
 serde = "1.0.130"
 serde_json = "1.0.68"
 serde_yaml = "0.9.19"
+serde-saphyr = "0.0.8"
 serde-value = "0.7.0"
 syn = "2.0.38"
 tame-oauth = "0.10.0"
diff --git a/deny.toml b/deny.toml
index a2f78fa2d..dd6836922 100644
--- a/deny.toml
+++ b/deny.toml
@@ -68,3 +68,11 @@ name = "getrandom"
 name = "wasi"
 [[bans.skip]]
 name = "zerocopy"
+
+# serde-saphyr 0.0.8 pulls in different versions of these three crates
+[[bans.skip]]
+name = "foldhash"
+[[bans.skip]]
+name = "hashbrown"
+[[bans.skip]]
+name = "smallvec"
diff --git a/kube-client/Cargo.toml b/kube-client/Cargo.toml
index be7e5c458..ec6445c4f 100644
--- a/kube-client/Cargo.toml
+++ b/kube-client/Cargo.toml
@@ -32,7 +32,7 @@ http-proxy = ["hyper-util/client-proxy"]
 unstable-client = []
 
 # private feature sets; do not use
-__non_core = ["tracing", "serde_yaml", "base64"]
+__non_core = ["tracing", "serde-saphyr", "base64"]
 
 [package.metadata.docs.rs]
 features = ["client", "rustls-tls", "openssl-tls", "ws", "oauth", "oidc", "jsonpatch", "admission", "k8s-openapi/latest", "socks5", "unstable-client", "http-proxy"]
@@ -47,7 +47,7 @@ base64 = { workspace = true, optional = true }
 chrono = { workspace = true, optional = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
-serde_yaml = { workspace = true, optional = true }
+serde-saphyr = { workspace = true, optional = true }
 http.workspace = true
 http-body = { workspace = true, optional = true }
 http-body-util = { workspace = true, optional = true }
diff --git a/kube-client/src/client/auth/mod.rs b/kube-client/src/client/auth/mod.rs
index abfe6b9f8..7cc58a4e1 100644
--- a/kube-client/src/client/auth/mod.rs
+++ b/kube-client/src/client/auth/mod.rs
@@ -675,7 +675,7 @@ mod test {
         "#
         );
 
-        let config: Kubeconfig = serde_yaml::from_str(&test_file).unwrap();
+        let config: Kubeconfig = serde_saphyr::from_str(&test_file).unwrap();
         let auth_info = config.auth_infos[0].auth_info.as_ref().unwrap();
         match Auth::try_from(auth_info).unwrap() {
             Auth::RefreshableToken(RefreshableToken::Exec(refreshable)) => {
diff --git a/kube-client/src/config/file_config.rs b/kube-client/src/config/file_config.rs
index 8a820f30e..376074cfe 100644
--- a/kube-client/src/config/file_config.rs
+++ b/kube-client/src/config/file_config.rs
@@ -399,7 +399,7 @@ impl Kubeconfig {
 
     /// Read a Config from an arbitrary YAML string
     ///
-    /// This is preferable to using serde_yaml::from_str() because it will correctly
+    /// This is preferable to using serde_saphyr::from_str() because it will correctly
     /// parse multi-document YAML text and merge them into a single `Kubeconfig`
     pub fn from_yaml(text: &str) -> Result<Kubeconfig, KubeconfigError> {
         kubeconfig_from_yaml(text)?
@@ -474,13 +474,7 @@ impl Kubeconfig {
 }
 
 fn kubeconfig_from_yaml(text: &str) -> Result<Vec<Kubeconfig>, KubeconfigError> {
-    let mut documents = vec![];
-    for doc in serde_yaml::Deserializer::from_str(text) {
-        let value = serde_yaml::Value::deserialize(doc).map_err(KubeconfigError::Parse)?;
-        let kubeconfig = serde_yaml::from_value(value).map_err(KubeconfigError::InvalidStructure)?;
-        documents.push(kubeconfig);
-    }
-    Ok(documents)
+    serde_saphyr::from_multiple(text).map_err(KubeconfigError::Parse)
 }
 
 #[allow(clippy::redundant_closure)]
@@ -934,7 +928,7 @@ users:
 username: user
 password: 
 "#;
-        let authinfo: AuthInfo = serde_yaml::from_str(authinfo_yaml).unwrap();
+        let authinfo: AuthInfo = serde_saphyr::from_str(authinfo_yaml).unwrap();
         assert_eq!(authinfo.username, Some("user".to_string()));
         assert!(authinfo.password.is_none());
     }
@@ -945,7 +939,7 @@ password:
 username: user
 password: kube_rs
 "#;
-        let authinfo: AuthInfo = serde_yaml::from_str(authinfo_yaml).unwrap();
+        let authinfo: AuthInfo = serde_saphyr::from_str(authinfo_yaml).unwrap();
         let authinfo_debug_output = format!("{authinfo:?}");
         let expected_output = "AuthInfo { \
         username: Some(\"user\"), \
diff --git a/kube-client/src/config/mod.rs b/kube-client/src/config/mod.rs
index 63560816b..138762000 100644
--- a/kube-client/src/config/mod.rs
+++ b/kube-client/src/config/mod.rs
@@ -63,11 +63,7 @@ pub enum KubeconfigError {
 
     /// Failed to parse kubeconfig YAML
     #[error("failed to parse kubeconfig YAML: {0}")]
-    Parse(#[source] serde_yaml::Error),
-
-    /// The structure of the parsed kubeconfig is invalid
-    #[error("the structure of the parsed kubeconfig is invalid: {0}")]
-    InvalidStructure(#[source] serde_yaml::Error),
+    Parse(#[source] serde_saphyr::Error),
 
     /// Cluster url is missing on selected cluster
     #[error("cluster url is missing on selected cluster")]