I'd just as soon pick sha2 as my pbkdf2 hash instead of bolting it on after the fact. That said, I'm not sure what's problematic. Expanding the key with sha2 results in the attacker needing to perform exactly as much work as you. There's no shortcut and no "problem".