AI is transforming cryptoanalysis, dramatically reducing the time needed to uncover weaknesses in cryptographic algorithms. While the recent HAWK case demonstrates that the post-quantum evaluation process is working as intended, it also exposes a growing imbalance: attackers can exploit AI to accelerate discovery, while organizations still require years to replace cryptography across complex production environments. This article argues that crypto agility, though essential, is no longer sufficient on its own. For critical infrastructure, a true defense-in-depth strategy requires combining post-quantum cryptography (PQC) with quantum key distribution (QKD), adding an independent, physics-based layer of protection that reduces reliance on any single mathematical assumption.