diff --git a/packages/hiccup/package.json b/packages/hiccup/package.json
index e6f15faed6..dba9004b81 100644
--- a/packages/hiccup/package.json
+++ b/packages/hiccup/package.json
@@ -36,7 +36,8 @@
     "dependencies": {
         "@thi.ng/api": "^8.0.3",
         "@thi.ng/checks": "^3.0.3",
-        "@thi.ng/errors": "^2.0.3"
+        "@thi.ng/errors": "^2.0.3",
+        "@thi.ng/strings": "^3.0.3"
     },
     "devDependencies": {
         "@thi.ng/atom": "^5.0.3",
diff --git a/packages/hiccup/src/api.ts b/packages/hiccup/src/api.ts
index c656c2615b..6c1b951794 100644
--- a/packages/hiccup/src/api.ts
+++ b/packages/hiccup/src/api.ts
@@ -7,19 +7,8 @@ export const PROC_TAGS: { [id: string]: string } = {
     "!ATTLIST": ">\n",
 };
 
-/** @internal */
-export const ENTITIES: { [id: string]: string } = {
-    "&": "&",
-    "<": "&lt;",
-    ">": "&gt;",
-    '"': "&quot;",
-    "'": "&apos;",
-};
-
 /** @internal */
 export const RE_TAG = /^([^\s\.#]+)(?:#([^\s\.#]+))?(?:\.([^\s#]+))?$/;
-/** @internal */
-export const RE_ENTITY = new RegExp(`[${Object.keys(ENTITIES).join("")}]`, "g");
 
 /** @internal */
 export const COMMENT = "__COMMENT__";
diff --git a/packages/hiccup/src/escape.ts b/packages/hiccup/src/escape.ts
deleted file mode 100644
index 62214321b9..0000000000
--- a/packages/hiccup/src/escape.ts
+++ /dev/null
@@ -1,3 +0,0 @@
-import { ENTITIES, RE_ENTITY } from "./api.js";
-
-export const escape = (x: string) => x.replace(RE_ENTITY, (y) => ENTITIES[y]);
diff --git a/packages/hiccup/src/index.ts b/packages/hiccup/src/index.ts
index 94572cdbd4..de29625b5f 100644
--- a/packages/hiccup/src/index.ts
+++ b/packages/hiccup/src/index.ts
@@ -2,7 +2,6 @@ export * from "./api.js";
 export * from "./attribs.js";
 export * from "./css.js";
 export * from "./deref.js";
-export * from "./escape.js";
 export * from "./normalize.js";
 export * from "./prefix.js";
 export * from "./serialize.js";
diff --git a/packages/hiccup/src/serialize.ts b/packages/hiccup/src/serialize.ts
index ec91e90e2d..c91988c4e6 100644
--- a/packages/hiccup/src/serialize.ts
+++ b/packages/hiccup/src/serialize.ts
@@ -6,6 +6,7 @@ import { isNotStringAndIterable } from "@thi.ng/checks/is-not-string-iterable";
 import { isPlainObject } from "@thi.ng/checks/is-plain-object";
 import { isString } from "@thi.ng/checks/is-string";
 import { illegalArgs } from "@thi.ng/errors/illegal-arguments";
+import { escapeEntities } from "@thi.ng/strings/entities";
 import {
     ATTRIB_JOIN_DELIMS,
     CDATA,
@@ -16,7 +17,6 @@ import {
     VOID_TAGS,
 } from "./api.js";
 import { css } from "./css.js";
-import { escape } from "./escape.js";
 import { normalize } from "./normalize.js";
 import { formatPrefixes } from "./prefix.js";
 
@@ -179,7 +179,7 @@ const _serialize = (
         ? _serialize(tree.deref(), ctx, esc, span, keys, path)
         : isNotStringAndIterable(tree)
         ? serializeIter(tree, ctx, esc, span, keys, path)
-        : ((tree = esc ? escape(String(tree)) : String(tree)), span)
+        : ((tree = esc ? escapeEntities(String(tree)) : String(tree)), span)
         ? `<span${keys ? ` key="${path.join("-")}"` : ""}>${tree}</span>`
         : tree;
 
@@ -277,7 +277,7 @@ const attribPair = (a: string, v: any, esc: boolean) => {
             : isArray(v)
             ? v.join(ATTRIB_JOIN_DELIMS[a] || " ")
             : v.toString();
-    return v.length ? ` ${a}="${esc ? escape(v) : v}"` : null;
+    return v.length ? ` ${a}="${esc ? escapeEntities(v) : v}"` : null;
 };
 
 const serializeDataAttribs = (data: any, esc: boolean) => {
@@ -285,7 +285,7 @@ const serializeDataAttribs = (data: any, esc: boolean) => {
     for (let id in data) {
         let v = deref(data[id]);
         isFunction(v) && (v = v(data));
-        v != null && (res += ` data-${id}="${esc ? escape(v) : v}"`);
+        v != null && (res += ` data-${id}="${esc ? escapeEntities(v) : v}"`);
     }
     return res;
 };