diff --git a/CHANGELOG.md b/CHANGELOG.md
index 56142bf..b8c059b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,11 @@ and this project adheres to Rust's notion of
 
 ## [Unreleased]
 ### Added
+- Support for `no-std` builds, via two new (default-enabled) feature flags:
+  - `alloc` enables the `pasta_curves::arithmetic::{CurveAffine, CurveExt}`
+    traits, as well as implementations of traits like `group::WnafGroup`.
+  - `sqrt-table` depends on `alloc`, and enables the large precomputed tables
+    (stored on the heap) that speed up square root computation.
 - `pasta_curves::arithmetic::SqrtRatio` trait, extending `ff::PrimeField` with
   square roots of ratios. This trait is likely to be moved into the `ff` crate
   in a future release (once we're satisfied with it).
diff --git a/Cargo.toml b/Cargo.toml
index b5f27ee..c906b3c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -48,7 +48,7 @@ rand = { version = "0.8", default-features = false }
 static_assertions = "1.1.0"
 subtle = { version = "2.3", default-features = false }
 
-# std dependencies
+# sqrt-table dependencies
 lazy_static = { version = "1.4.0", optional = true }
 
 [features]
diff --git a/src/curves.rs b/src/curves.rs
index 91c489c..7c16ead 100644
--- a/src/curves.rs
+++ b/src/curves.rs
@@ -474,7 +474,12 @@ macro_rules! new_curve_impl {
                 // multiplication, moving from most significant to least
                 // significant bit of the scalar.
                 //
-                // NOTE: We skip the leading bit because it's always unset.
+                // We don't use `PrimeFieldBits::.to_le_bits` here, because that would
+                // force users of this crate to depend on `bitvec` where they otherwise
+                // might not need to.
+                //
+                // NOTE: We skip the leading bit because it's always unset (we are turning
+                // the 32-byte repr into 256 bits, and $scalar::NUM_BITS = 255).
                 for bit in other
                     .to_repr()
                     .iter()
@@ -585,7 +590,12 @@ macro_rules! new_curve_impl {
                 // multiplication, moving from most significant to least
                 // significant bit of the scalar.
                 //
-                // NOTE: We skip the leading bit because it's always unset.
+                // We don't use `PrimeFieldBits::.to_le_bits` here, because that would
+                // force users of this crate to depend on `bitvec` where they otherwise
+                // might not need to.
+                //
+                // NOTE: We skip the leading bit because it's always unset (we are turning
+                // the 32-byte repr into 256 bits, and $scalar::NUM_BITS = 255).
                 for bit in other
                     .to_repr()
                     .iter()