diff --git a/Cargo.lock b/Cargo.lock
index d24e95220d..c34aef5dba 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -143,7 +143,6 @@ dependencies = [
  "mermaid-rs-renderer",
  "objc2",
  "objc2-foundation",
- "sqlx",
  "thiserror 2.0.18",
  "tokio",
  "typst",
@@ -237,6 +236,7 @@ dependencies = [
  "rand 0.9.4",
  "rayon",
  "reqwest",
+ "rustls",
  "schemars",
  "serde",
  "serde_json",
@@ -246,6 +246,7 @@ dependencies = [
  "tokio",
  "url",
  "v_htmlescape",
+ "webpki-roots",
  "y-octo",
 ]
 
@@ -6225,7 +6226,6 @@ dependencies = [
  "memchr",
  "once_cell",
  "percent-encoding",
- "rustls",
  "serde",
  "serde_json",
  "sha2",
@@ -6235,7 +6235,6 @@ dependencies = [
  "tokio-stream",
  "tracing",
  "url",
- "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -8048,7 +8047,7 @@ dependencies = [
  "rustls-pki-types",
  "ureq-proto",
  "utf8-zero",
- "webpki-roots 1.0.6",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -8410,15 +8409,6 @@ dependencies = [
  "rustls-pki-types",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.26.11"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "521bc38abb08001b01866da9f51eb7c5d647a19260e00054a8c7fd5f9e57f7a9"
-dependencies = [
- "webpki-roots 1.0.6",
-]
-
 [[package]]
 name = "webpki-roots"
 version = "1.0.6"
diff --git a/Cargo.toml b/Cargo.toml
index fc9e9160f1..fa6e72b4fe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -110,7 +110,6 @@ resolver = "3"
     "migrate",
     "runtime-tokio",
     "sqlite",
-    "tls-rustls",
   ] }
   strum_macros = "0.27.0"
   symphonia = { version = "0.5", features = ["all", "opt-simd"] }
diff --git a/packages/backend/native/Cargo.toml b/packages/backend/native/Cargo.toml
index 0431dbdfeb..9cf1a0194d 100644
--- a/packages/backend/native/Cargo.toml
+++ b/packages/backend/native/Cargo.toml
@@ -9,13 +9,13 @@ version      = "1.0.0"
 crate-type = ["cdylib"]
 
 [dependencies]
+aes-gcm = { workspace = true }
 affine_common = { workspace = true, features = [
   "doc-loader",
   "hashcash",
   "napi",
   "ydoc-loader",
 ] }
-aes-gcm = { workspace = true }
 anyhow = { workspace = true }
 base64-simd = { workspace = true }
 chrono = { workspace = true }
@@ -38,6 +38,7 @@ reqwest = { version = "0.13.3", default-features = false, features = [
   "blocking",
   "rustls",
 ] }
+rustls = "0.23"
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
@@ -46,6 +47,7 @@ sha3 = { workspace = true }
 tiktoken-rs = { workspace = true }
 url = { workspace = true }
 v_htmlescape = { workspace = true }
+webpki-roots = "1"
 y-octo = { workspace = true, features = ["large_refs"] }
 
 [target.'cfg(not(target_os = "linux"))'.dependencies]
diff --git a/packages/backend/native/src/safe_fetch.rs b/packages/backend/native/src/safe_fetch.rs
index 668d102a93..b8389ea6d8 100644
--- a/packages/backend/native/src/safe_fetch.rs
+++ b/packages/backend/native/src/safe_fetch.rs
@@ -412,11 +412,25 @@ fn build_pinned_client(url: &Url, addrs: &[SocketAddr], timeout: Duration) -> An
     .timeout(timeout)
     .no_proxy()
     .redirect(reqwest::redirect::Policy::none())
+    .tls_backend_preconfigured(webpki_tls_config()?)
     .resolve_to_addrs(host, addrs)
     .build()
     .context("failed to build http client")
 }
 
+fn webpki_tls_config() -> AnyResult<rustls::ClientConfig> {
+  let root_store = rustls::RootCertStore {
+    roots: webpki_roots::TLS_SERVER_ROOTS.to_vec(),
+  };
+  Ok(
+    rustls::ClientConfig::builder_with_provider(rustls::crypto::aws_lc_rs::default_provider().into())
+      .with_safe_default_protocol_versions()
+      .context("failed to build tls protocol config")?
+      .with_root_certificates(root_store)
+      .with_no_client_auth(),
+  )
+}
+
 fn build_headers(headers: Option<&HashMap<String, String>>) -> AnyResult<HeaderMap> {
   let mut out = HeaderMap::new();
   let Some(headers) = headers else {
@@ -623,6 +637,13 @@ mod tests {
     assert!(!is_blocked_ip("2002:0808:0808::1".parse().unwrap()));
   }
 
+  #[test]
+  fn builds_https_client_with_embedded_roots() {
+    let url = Url::parse("https://example.com/").unwrap();
+    let addrs = ["93.184.216.34:443".parse().unwrap()];
+    build_pinned_client(&url, &addrs, Duration::from_secs(1)).unwrap();
+  }
+
   #[test]
   fn inspects_png_dimensions_without_decode() {
     let png = base64_simd::STANDARD
diff --git a/packages/frontend/mobile-native/Cargo.toml b/packages/frontend/mobile-native/Cargo.toml
index ec13221304..2f89425017 100644
--- a/packages/frontend/mobile-native/Cargo.toml
+++ b/packages/frontend/mobile-native/Cargo.toml
@@ -22,7 +22,6 @@ affine_nbstore = { workspace = true }
 anyhow         = { workspace = true }
 base64-simd    = { workspace = true }
 chrono         = { workspace = true }
-sqlx           = { workspace = true }
 thiserror      = { workspace = true }
 tokio          = { workspace = true, features = ["rt-multi-thread"] }
 uniffi         = { workspace = true, features = ["cli", "tokio"] }
diff --git a/packages/frontend/native/Cargo.toml b/packages/frontend/native/Cargo.toml
index aca6463ae0..6497673902 100644
--- a/packages/frontend/native/Cargo.toml
+++ b/packages/frontend/native/Cargo.toml
@@ -21,7 +21,6 @@ sqlx = { workspace = true, default-features = false, features = [
   "migrate",
   "runtime-tokio",
   "sqlite",
-  "tls-rustls",
 ] }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
@@ -52,6 +51,5 @@ sqlx = { workspace = true, default-features = false, features = [
   "migrate",
   "runtime-tokio",
   "sqlite",
-  "tls-rustls",
 ] }
 tokio = { workspace = true, features = ["full"] }
diff --git a/packages/frontend/native/nbstore/Cargo.toml b/packages/frontend/native/nbstore/Cargo.toml
index 0d1ec79db5..df4ccf1136 100644
--- a/packages/frontend/native/nbstore/Cargo.toml
+++ b/packages/frontend/native/nbstore/Cargo.toml
@@ -28,7 +28,6 @@ sqlx = { workspace = true, default-features = false, features = [
   "migrate",
   "runtime-tokio",
   "sqlite",
-  "tls-rustls",
 ] }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["full"] }
@@ -48,7 +47,6 @@ sqlx = { workspace = true, default-features = false, features = [
   "migrate",
   "runtime-tokio",
   "sqlite",
-  "tls-rustls",
 ] }
 tokio = { workspace = true, features = ["full"] }
 
diff --git a/packages/frontend/native/sqlite_v1/Cargo.toml b/packages/frontend/native/sqlite_v1/Cargo.toml
index b9701cb308..a6f34d496d 100644
--- a/packages/frontend/native/sqlite_v1/Cargo.toml
+++ b/packages/frontend/native/sqlite_v1/Cargo.toml
@@ -19,7 +19,6 @@ sqlx = { workspace = true, default-features = false, features = [
   "migrate",
   "runtime-tokio",
   "sqlite",
-  "tls-rustls",
 ] }
 tokio = { workspace = true, features = ["full"] }
 
@@ -33,6 +32,5 @@ sqlx = { workspace = true, default-features = false, features = [
   "migrate",
   "runtime-tokio",
   "sqlite",
-  "tls-rustls",
 ] }
 tokio = { workspace = true, features = ["full"] }