It depends how motivated your attacker is. Could someone make a lot of money if they could get SHA-1 collisions with your application?