From 0b80e4862267383ba7a628670a5ef9f9b056a9df Mon Sep 17 00:00:00 2001
From: Gabriel Kaszewski <gabrielkaszewski@gmail.com>
Date: Mon, 26 Oct 2026 03:52:49 +0100
Subject: [PATCH] k-ap 0.5.1; reqwest ring-only, sqlx no tls; bootstrap
 installs ring provider

---
 Cargo.lock                                   | 306 ++-----------------
 Cargo.toml                                   |   4 +-
 crates/adapters/activitypub/Cargo.toml       |   2 +-
 crates/adapters/sqlite-federation/Cargo.toml |   2 +-
 crates/bootstrap/Cargo.toml                  |   2 +
 crates/bootstrap/src/lib.rs                  |   2 +
 crates/bootstrap/src/server.rs               |   1 +
 crates/bootstrap/src/tls.rs                  |  34 +++
 crates/bootstrap/src/worker.rs               |   1 +
 crates/tui/Cargo.toml                        |   1 +
 crates/tui/src/client.rs                     |   2 +
 11 files changed, 75 insertions(+), 282 deletions(-)
 create mode 100644 crates/bootstrap/src/tls.rs

diff --git a/Cargo.lock b/Cargo.lock
index 16709e36..713c32e8 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -29,7 +29,6 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "20222f29f14358d3baeb0ffdec08f99bd0f56b6b59504f33556d97db720de748"
 dependencies = [
  "activitystreams-kinds",
- "actix-web",
  "async-trait",
  "axum",
  "base64",
@@ -41,8 +40,7 @@ dependencies = [
  "enum_delegate",
  "futures",
  "futures-core",
- "http 0.2.12",
- "http 1.4.0",
+ "http",
  "http-signature-normalization",
  "http-signature-normalization-reqwest",
  "httpdate",
@@ -74,154 +72,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "actix-codec"
-version = "0.5.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f7b0a21988c1bf877cf4759ef5ddaac04c1c9fe808c9142ecb78ba97d97a28a"
-dependencies = [
- "bitflags 2.11.1",
- "bytes",
- "futures-core",
- "futures-sink",
- "memchr",
- "pin-project-lite",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "actix-http"
-version = "3.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "93acb4a42f64936f9b8cae4a433b237599dd6eb6ed06124eb67132ef8cc90662"
-dependencies = [
- "actix-codec",
- "actix-rt",
- "actix-service",
- "actix-utils",
- "bitflags 2.11.1",
- "bytes",
- "bytestring",
- "derive_more",
- "encoding_rs",
- "foldhash 0.1.5",
- "futures-core",
- "http 0.2.12",
- "httparse",
- "httpdate",
- "itoa",
- "language-tags",
- "mime",
- "percent-encoding",
- "pin-project-lite",
- "smallvec",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
-[[package]]
-name = "actix-router"
-version = "0.5.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "14f8c75c51892f18d9c46150c5ac7beb81c95f78c8b83a634d49f4ca32551fe7"
-dependencies = [
- "bytestring",
- "cfg-if",
- "http 0.2.12",
- "regex-lite",
- "serde",
- "tracing",
-]
-
-[[package]]
-name = "actix-rt"
-version = "2.11.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92589714878ca59a7626ea19734f0e07a6a875197eec751bb5d3f99e64998c63"
-dependencies = [
- "futures-core",
- "tokio",
-]
-
-[[package]]
-name = "actix-server"
-version = "2.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a65064ea4a457eaf07f2fba30b4c695bf43b721790e9530d26cb6f9019ff7502"
-dependencies = [
- "actix-rt",
- "actix-service",
- "actix-utils",
- "futures-core",
- "futures-util",
- "mio",
- "socket2 0.5.10",
- "tokio",
- "tracing",
-]
-
-[[package]]
-name = "actix-service"
-version = "2.0.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9e46f36bf0e5af44bdc4bdb36fbbd421aa98c79a9bce724e1edeb3894e10dc7f"
-dependencies = [
- "futures-core",
- "pin-project-lite",
-]
-
-[[package]]
-name = "actix-utils"
-version = "3.0.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88a1dcdff1466e3c2488e1cb5c36a71822750ad43839937f85d2f4d9f8b705d8"
-dependencies = [
- "local-waker",
- "pin-project-lite",
-]
-
-[[package]]
-name = "actix-web"
-version = "4.13.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ff87453bc3b56e9b2b23c1cc0b1be8797184accf51d2abe0f8a33ec275d316bf"
-dependencies = [
- "actix-codec",
- "actix-http",
- "actix-router",
- "actix-rt",
- "actix-server",
- "actix-service",
- "actix-utils",
- "bytes",
- "bytestring",
- "cfg-if",
- "derive_more",
- "encoding_rs",
- "foldhash 0.1.5",
- "futures-core",
- "futures-util",
- "impl-more",
- "itoa",
- "language-tags",
- "log",
- "mime",
- "once_cell",
- "pin-project-lite",
- "regex-lite",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "smallvec",
- "socket2 0.6.3",
- "time",
- "tracing",
- "url",
-]
-
 [[package]]
 name = "adler2"
 version = "2.0.1"
@@ -701,28 +551,6 @@ dependencies = [
  "arrayvec",
 ]
 
-[[package]]
-name = "aws-lc-rs"
-version = "1.17.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
-dependencies = [
- "aws-lc-sys",
- "zeroize",
-]
-
-[[package]]
-name = "aws-lc-sys"
-version = "0.41.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
-dependencies = [
- "cc",
- "cmake",
- "dunce",
- "fs_extra",
-]
-
 [[package]]
 name = "axum"
 version = "0.8.9"
@@ -734,7 +562,7 @@ dependencies = [
  "bytes",
  "form_urlencoded",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -766,7 +594,7 @@ checksum = "08c78f31d7b1291f7ee735c1c6780ccde7785daae9a9206026862dab7d8792d1"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "mime",
@@ -787,7 +615,7 @@ dependencies = [
  "dashmap",
  "forwarded-header-value",
  "governor",
- "http 1.4.0",
+ "http",
  "ipnet",
  "nonzero_ext",
  "pin-project-lite",
@@ -928,7 +756,9 @@ dependencies = [
  "nats",
  "object-storage",
  "poster-fetcher",
+ "reqwest 0.13.3",
  "rss 0.1.0",
+ "rustls",
  "serde_json",
  "sqlite",
  "sqlite-federation",
@@ -980,15 +810,6 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "bytestring"
-version = "1.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86566c496f2f47d9b8147a4c8b02ffdb69c919fe0c2b2e7195d22cbba0e635c9"
-dependencies = [
- "bytes",
-]
-
 [[package]]
 name = "calamine"
 version = "0.35.0"
@@ -1114,15 +935,6 @@ dependencies = [
  "inout",
 ]
 
-[[package]]
-name = "cmake"
-version = "0.1.58"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c0f78a02292a74a88ac736019ab962ece0bc380e3f977bf72e376c5d78ff0678"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "codepage"
 version = "0.1.2"
@@ -1592,7 +1404,6 @@ dependencies = [
  "quote",
  "rustc_version",
  "syn 2.0.117",
- "unicode-xid",
 ]
 
 [[package]]
@@ -1695,12 +1506,6 @@ dependencies = [
  "dtoa",
 ]
 
-[[package]]
-name = "dunce"
-version = "1.0.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
-
 [[package]]
 name = "dyn-clone"
 version = "1.0.20"
@@ -2059,12 +1864,6 @@ dependencies = [
  "thiserror 1.0.69",
 ]
 
-[[package]]
-name = "fs_extra"
-version = "1.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
-
 [[package]]
 name = "futf"
 version = "0.1.5"
@@ -2281,7 +2080,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.4.0",
+ "http",
  "indexmap",
  "slab",
  "tokio",
@@ -2388,17 +2187,6 @@ dependencies = [
  "match_token",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.4.0"
@@ -2444,7 +2232,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.4.0",
+ "http",
 ]
 
 [[package]]
@@ -2455,7 +2243,7 @@ checksum = "b021d93e26becf5dc7e1b75b1bed1fd93124b374ceb73f43d4d4eafec896a64a"
 dependencies = [
  "bytes",
  "futures-core",
- "http 1.4.0",
+ "http",
  "http-body",
  "pin-project-lite",
 ]
@@ -2520,7 +2308,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "h2",
- "http 1.4.0",
+ "http",
  "http-body",
  "httparse",
  "httpdate",
@@ -2537,7 +2325,7 @@ version = "0.27.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "33ca68d021ef39cf6463ab54c1d0f5daf03377b70561305bb89a8f83aab66e0f"
 dependencies = [
- "http 1.4.0",
+ "http",
  "hyper",
  "hyper-util",
  "rustls",
@@ -2557,14 +2345,14 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
  "hyper",
  "ipnet",
  "libc",
  "percent-encoding",
  "pin-project-lite",
- "socket2 0.6.3",
+ "socket2",
  "system-configuration",
  "tokio",
  "tower-service",
@@ -2761,12 +2549,6 @@ version = "1.12.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "40fac9d56ed6437b198fddba683305e8e2d651aa42647f00f5ae542e7f5c94a2"
 
-[[package]]
-name = "impl-more"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8a5a9a0ff0086c7a148acb942baaabeadf9504d10400b5a05645853729b9cd2"
-
 [[package]]
 name = "importer"
 version = "0.1.0"
@@ -2968,9 +2750,9 @@ dependencies = [
 
 [[package]]
 name = "k-ap"
-version = "0.5.0"
+version = "0.5.1"
 source = "sparse+https://git.gabrielkaszewski.dev/api/packages/GKaszewski/cargo/"
-checksum = "ab6066cccc6ae8aaa2f6262ac7d471e58930a04be3266a2e367d6bdd8aaaba29"
+checksum = "261f5d721fb582f029d892cbcf28de9fc3a39547149bc4b52e734b46842a6d4d"
 dependencies = [
  "activitypub_federation",
  "anyhow",
@@ -2981,6 +2763,7 @@ dependencies = [
  "futures",
  "paste",
  "reqwest 0.13.3",
+ "rustls",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -3017,12 +2800,6 @@ version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bf36173d4167ed999940f804952e6b08197cae5ad5d572eb4db150ce8ad5d58f"
 
-[[package]]
-name = "language-tags"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d4345964bb142484797b161f473a503a434de77149dd8c7427788c6e13379388"
-
 [[package]]
 name = "lazy_static"
 version = "1.5.0"
@@ -3120,12 +2897,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "11d3d7f243d5c5a8b9bb5d6dd2b1602c0cb0b9db1621bafc7ed66e35ff9fe092"
 
-[[package]]
-name = "local-waker"
-version = "0.1.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4d873d7c67ce09b42110d801813efbc9364414e356be9935700d368351657487"
-
 [[package]]
 name = "lock_api"
 version = "0.4.14"
@@ -3368,7 +3139,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-util",
- "http 1.4.0",
+ "http",
  "httparse",
  "memchr",
  "mime",
@@ -4102,7 +3873,7 @@ dependencies = [
  "quinn-udp",
  "rustc-hash",
  "rustls",
- "socket2 0.6.3",
+ "socket2",
  "thiserror 2.0.18",
  "tokio",
  "tracing",
@@ -4115,7 +3886,6 @@ version = "0.11.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "434b42fec591c96ef50e21e886936e66d3cc3f737104fdb9b737c40ffb94c098"
 dependencies = [
- "aws-lc-rs",
  "bytes",
  "getrandom 0.3.4",
  "lru-slab",
@@ -4140,7 +3910,7 @@ dependencies = [
  "cfg_aliases",
  "libc",
  "once_cell",
- "socket2 0.6.3",
+ "socket2",
  "tracing",
  "windows-sys 0.60.2",
 ]
@@ -4428,12 +4198,6 @@ dependencies = [
  "regex-syntax",
 ]
 
-[[package]]
-name = "regex-lite"
-version = "0.1.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cab834c73d247e67f4fae452806d17d3c7501756d98c8808d7c9c7aa7d18f973"
-
 [[package]]
 name = "regex-syntax"
 version = "0.8.10"
@@ -4451,7 +4215,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -4494,7 +4258,7 @@ dependencies = [
  "futures-core",
  "futures-util",
  "h2",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "hyper",
@@ -4505,7 +4269,6 @@ dependencies = [
  "mime",
  "percent-encoding",
  "pin-project-lite",
- "quinn",
  "rustls",
  "rustls-pki-types",
  "rustls-platform-verifier",
@@ -4534,7 +4297,7 @@ checksum = "07bc3f1384cffa4f274dad2d4ddd73aed32fed8f786d96c6be8aa4e5fd3c3b58"
 dependencies = [
  "anyhow",
  "async-trait",
- "http 1.4.0",
+ "http",
  "reqwest 0.13.3",
  "thiserror 2.0.18",
  "tower-service",
@@ -4668,7 +4431,7 @@ version = "0.23.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ef86cd5876211988985292b91c96a8f2d298df24e75989a43a3c73f2d4d8168b"
 dependencies = [
- "aws-lc-rs",
+ "log",
  "once_cell",
  "ring",
  "rustls-pki-types",
@@ -4732,7 +4495,6 @@ version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
- "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted",
@@ -5112,16 +4874,6 @@ dependencies = [
  "syn 2.0.117",
 ]
 
-[[package]]
-name = "socket2"
-version = "0.5.10"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e22376abed350d73dd1cd119b57ffccad95b4e585a7cda43e286245ce23c0678"
-dependencies = [
- "libc",
- "windows-sys 0.52.0",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -5236,7 +4988,6 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls",
  "serde",
  "serde_json",
  "sha2",
@@ -5247,7 +4998,6 @@ dependencies = [
  "tracing",
  "url",
  "uuid",
- "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -5792,10 +5542,9 @@ dependencies = [
  "bytes",
  "libc",
  "mio",
- "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "socket2 0.6.3",
+ "socket2",
  "tokio-macros",
  "tracing",
  "windows-sys 0.61.2",
@@ -5856,7 +5605,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-sink",
- "http 1.4.0",
+ "http",
  "httparse",
  "rand 0.8.6",
  "ring",
@@ -5964,7 +5713,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "futures-util",
- "http 1.4.0",
+ "http",
  "http-body",
  "http-body-util",
  "http-range-header",
@@ -6084,6 +5833,7 @@ dependencies = [
  "keyring-core",
  "ratatui",
  "reqwest 0.13.3",
+ "rustls",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -6687,7 +6437,7 @@ version = "0.1.11"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22"
 dependencies = [
- "windows-sys 0.61.2",
+ "windows-sys 0.48.0",
 ]
 
 [[package]]
diff --git a/Cargo.toml b/Cargo.toml
index ead06304..ba324135 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -48,13 +48,13 @@ uuid = { version = "1.23.0", features = ["v4", "v5", "serde"] }
 chrono = { version = "0.4", features = ["serde"] }
 chrono-tz = "0.10"
 sqlx = { version = "0.8.6", features = [
-    "runtime-tokio-rustls",
+    "runtime-tokio",
     "sqlite",
     "uuid",
 ] }
 rand = "0.9"
 tempfile = "3"
-reqwest = { version = "0.13", features = ["json", "query"] }
+reqwest = { version = "0.13", default-features = false, features = ["json", "query", "charset", "http2", "system-proxy", "rustls-no-provider"] }
 sha2 = "0.10"
 hex = "0.4"
 object_store = { version = "0.11", features = ["aws"] }
diff --git a/crates/adapters/activitypub/Cargo.toml b/crates/adapters/activitypub/Cargo.toml
index 98e1ef85..f9b3ab46 100644
--- a/crates/adapters/activitypub/Cargo.toml
+++ b/crates/adapters/activitypub/Cargo.toml
@@ -5,7 +5,7 @@ edition.workspace = true
 
 [dependencies]
 config = { workspace = true }
-k-ap = { version = "0.5.0", registry = "gitea" }
+k-ap = { version = "0.5.1", registry = "gitea" }
 domain = { workspace = true }
 axum = { workspace = true }
 serde = { workspace = true }
diff --git a/crates/adapters/sqlite-federation/Cargo.toml b/crates/adapters/sqlite-federation/Cargo.toml
index 4ce7d6bd..9616e521 100644
--- a/crates/adapters/sqlite-federation/Cargo.toml
+++ b/crates/adapters/sqlite-federation/Cargo.toml
@@ -6,7 +6,7 @@ edition.workspace = true
 [dependencies]
 sqlx = { workspace = true }
 activitypub = { workspace = true }
-k-ap = { version = "0.5.0", registry = "gitea" }
+k-ap = { version = "0.5.1", registry = "gitea" }
 sqlite = { workspace = true }
 domain = { workspace = true }
 anyhow = { workspace = true }
diff --git a/crates/bootstrap/Cargo.toml b/crates/bootstrap/Cargo.toml
index 1f28bd74..98a07adb 100644
--- a/crates/bootstrap/Cargo.toml
+++ b/crates/bootstrap/Cargo.toml
@@ -37,12 +37,14 @@ tokio = { workspace = true }
 futures = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
 
 nats = { workspace = true, optional = true }
 activitypub = { workspace = true, optional = true }
 sqlite-federation = { workspace = true, optional = true }
 
 [dev-dependencies]
+reqwest = { workspace = true }
 chrono = { workspace = true }
 uuid = { workspace = true }
 serde_json = { workspace = true }
diff --git a/crates/bootstrap/src/lib.rs b/crates/bootstrap/src/lib.rs
index 150daf29..812adf63 100644
--- a/crates/bootstrap/src/lib.rs
+++ b/crates/bootstrap/src/lib.rs
@@ -13,11 +13,13 @@ mod follow_backfill_handler;
 pub mod outbox_relay;
 pub mod repositories;
 mod server;
+mod tls;
 mod tracing_setup;
 mod worker;
 
 pub use build::build_deps;
 pub use repositories::Repositories;
 pub use server::{ServerApp, build_server, build_server_on};
+pub use tls::install_crypto_provider;
 pub use tracing_setup::init_tracing;
 pub use worker::{WorkerApp, build_worker, build_worker_on};
diff --git a/crates/bootstrap/src/server.rs b/crates/bootstrap/src/server.rs
index c3f87a4b..ef678e69 100644
--- a/crates/bootstrap/src/server.rs
+++ b/crates/bootstrap/src/server.rs
@@ -54,6 +54,7 @@ async fn assemble(
     db: DatabaseOutput,
     instance: InstanceIdentity,
 ) -> anyhow::Result<axum::Router> {
+    crate::tls::install_crypto_provider();
     let app_config = AppSettings::from(config);
 
     let (auth_service, password_hasher) = database::build_auth_adapters(&config.auth)?;
diff --git a/crates/bootstrap/src/tls.rs b/crates/bootstrap/src/tls.rs
new file mode 100644
index 00000000..2801b666
--- /dev/null
+++ b/crates/bootstrap/src/tls.rs
@@ -0,0 +1,34 @@
+//! Process-wide rustls crypto provider.
+//!
+//! Every HTTPS client in the graph (reqwest, object_store, async-nats,
+//! k-ap) is built without a bundled provider so the binaries link `ring`
+//! only. rustls therefore needs one installed before the first client is
+//! built, or client construction panics.
+
+use std::sync::Once;
+
+/// Installs `ring` as the process default. Idempotent; a provider installed
+/// earlier by someone else is left in place.
+pub fn install_crypto_provider() {
+    static INSTALL: Once = Once::new();
+    INSTALL.call_once(|| {
+        let _ = rustls::crypto::ring::default_provider().install_default();
+    });
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    /// Runs alone in the lib test binary, so no other code (k-ap included)
+    /// has installed a provider first.
+    #[test]
+    fn https_client_builds_after_install() {
+        install_crypto_provider();
+        install_crypto_provider();
+        reqwest::Client::builder()
+            .build()
+            .expect("reqwest client builds");
+        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
+    }
+}
diff --git a/crates/bootstrap/src/worker.rs b/crates/bootstrap/src/worker.rs
index 5a89728a..af8b9203 100644
--- a/crates/bootstrap/src/worker.rs
+++ b/crates/bootstrap/src/worker.rs
@@ -99,6 +99,7 @@ async fn assemble(
     db: DatabaseOutput,
     #[cfg_attr(not(feature = "federation"), allow(unused_variables))] instance: InstanceIdentity,
 ) -> anyhow::Result<WorkerApp> {
+    crate::tls::install_crypto_provider();
     let metadata_client = metadata::create(&config.metadata)?;
     let poster_fetcher = poster_fetcher::create(&config.metadata)?;
     let object_storage = object_storage::create(&config.storage)?;
diff --git a/crates/tui/Cargo.toml b/crates/tui/Cargo.toml
index af761643..c078ca04 100644
--- a/crates/tui/Cargo.toml
+++ b/crates/tui/Cargo.toml
@@ -26,6 +26,7 @@ windows-native-keyring-store = { version = "1.0.0", optional = true }
 
 api-types = { workspace = true }
 reqwest = { workspace = true }
+rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12", "logging"] }
 serde = { workspace = true }
 serde_json = { workspace = true }
 tokio = { workspace = true }
diff --git a/crates/tui/src/client.rs b/crates/tui/src/client.rs
index 2c019248..1364bf14 100644
--- a/crates/tui/src/client.rs
+++ b/crates/tui/src/client.rs
@@ -46,6 +46,8 @@ pub struct ApiClient {
 
 impl ApiClient {
     pub fn new(url: &str) -> Self {
+        // reqwest is built without a bundled TLS provider; install ring first.
+        let _ = rustls::crypto::ring::default_provider().install_default();
         Self {
             base_url: std::sync::RwLock::new(url.to_string()),
             http: reqwest::Client::new(),