diff --git a/Cargo.lock b/Cargo.lock
index 339fc33d13..e10214d8a5 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -675,20 +675,15 @@ dependencies = [
  "aws-smithy-runtime-api",
  "aws-smithy-types",
  "bytes",
- "crypto-bigint 0.5.5",
  "form_urlencoded",
  "hex",
  "hmac",
  "http 0.2.12",
  "http 1.4.0",
- "p256 0.11.1",
  "percent-encoding",
- "ring",
  "sha2",
- "subtle",
  "time",
  "tracing",
- "zeroize",
 ]
 
 [[package]]
@@ -1047,12 +1042,6 @@ dependencies = [
  "nix 0.23.2",
 ]
 
-[[package]]
-name = "base16ct"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "349a06037c7bf932dd7e7d1f653678b2038b9ad46a74102f1fc7bd7872678cce"
-
 [[package]]
 name = "base16ct"
 version = "0.2.0"
@@ -2258,18 +2247,6 @@ version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "460fbee9c2c2f33933d720630a6a0bac33ba7053db5344fac858d4b8952d77d5"
 
-[[package]]
-name = "crypto-bigint"
-version = "0.4.9"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ef2b4b23cddf68b89b8f8069890e8c270d54e2d5fe1b143820234805e4cb17ef"
-dependencies = [
- "generic-array 0.14.9",
- "rand_core 0.6.4",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "crypto-bigint"
 version = "0.5.5"
@@ -2510,16 +2487,6 @@ dependencies = [
  "uuid",
 ]
 
-[[package]]
-name = "der"
-version = "0.6.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f1a467a65c5e759bce6e65eaf91cc29f466cdc57cb65777bd646872a8a1fd4de"
-dependencies = [
- "const-oid",
- "zeroize",
-]
-
 [[package]]
 name = "der"
 version = "0.7.10"
@@ -2757,30 +2724,18 @@ version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
-[[package]]
-name = "ecdsa"
-version = "0.14.8"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "413301934810f597c1d19ca71c8710e99a3f1ba28a0d2ebc01551a2daeea3c5c"
-dependencies = [
- "der 0.6.1",
- "elliptic-curve 0.12.3",
- "rfc6979 0.3.1",
- "signature 1.6.4",
-]
-
 [[package]]
 name = "ecdsa"
 version = "0.16.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
 dependencies = [
- "der 0.7.10",
+ "der",
  "digest",
- "elliptic-curve 0.13.8",
- "rfc6979 0.4.0",
- "signature 2.2.0",
- "spki 0.7.3",
+ "elliptic-curve",
+ "rfc6979",
+ "signature",
+ "spki",
 ]
 
 [[package]]
@@ -2789,8 +2744,8 @@ version = "2.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "115531babc129696a58c64a4fef0a8bf9e9698629fb97e9e40767d235cfbcd53"
 dependencies = [
- "pkcs8 0.10.2",
- "signature 2.2.0",
+ "pkcs8",
+ "signature",
 ]
 
 [[package]]
@@ -2828,43 +2783,23 @@ dependencies = [
  "serde",
 ]
 
-[[package]]
-name = "elliptic-curve"
-version = "0.12.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e7bb888ab5300a19b8e5bceef25ac745ad065f3c9f7efc6de1b91958110891d3"
-dependencies = [
- "base16ct 0.1.1",
- "crypto-bigint 0.4.9",
- "der 0.6.1",
- "digest",
- "ff 0.12.1",
- "generic-array 0.14.9",
- "group 0.12.1",
- "pkcs8 0.9.0",
- "rand_core 0.6.4",
- "sec1 0.3.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "elliptic-curve"
 version = "0.13.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
 dependencies = [
- "base16ct 0.2.0",
- "crypto-bigint 0.5.5",
+ "base16ct",
+ "crypto-bigint",
  "digest",
- "ff 0.13.1",
+ "ff",
  "generic-array 0.14.9",
- "group 0.13.0",
+ "group",
  "hkdf",
  "pem-rfc7468",
- "pkcs8 0.10.2",
+ "pkcs8",
  "rand_core 0.6.4",
- "sec1 0.7.3",
+ "sec1",
  "subtle",
  "zeroize",
 ]
@@ -3068,16 +3003,6 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "ff"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d013fc25338cc558c5c2cfbad646908fb23591e2404481826742b651c9af7160"
-dependencies = [
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "ff"
 version = "0.13.1"
@@ -3213,21 +3138,6 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
-[[package]]
-name = "foreign-types"
-version = "0.3.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
-dependencies = [
- "foreign-types-shared",
-]
-
-[[package]]
-name = "foreign-types-shared"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
-
 [[package]]
 name = "form_urlencoded"
 version = "1.2.2"
@@ -3715,9 +3625,6 @@ dependencies = [
  "lenient_bool",
  "log",
  "minijinja",
- "native-tls",
- "openssl",
- "openssl-sys",
  "phf 0.11.3",
  "portable-pty",
  "pretty_assertions",
@@ -3730,6 +3637,7 @@ dependencies = [
  "reqwest 0.13.2",
  "reqwest-middleware",
  "reqwest-retry",
+ "rustls 0.23.37",
  "semver",
  "serde",
  "serde_derive",
@@ -3749,7 +3657,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.25.0",
+ "tokio-tungstenite",
  "toml 0.9.12+spec-1.1.0",
  "toml_edit 0.23.10+spec-1.0.0",
  "tracing",
@@ -3946,7 +3854,7 @@ dependencies = [
  "thiserror 2.0.18",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.25.0",
+ "tokio-tungstenite",
  "tokio-util",
  "tonic 0.14.5",
  "tonic-tracing-opentelemetry",
@@ -3984,8 +3892,6 @@ dependencies = [
  "assert2",
  "async-trait",
  "async_zip",
- "aws-config",
- "aws-sdk-s3",
  "bigdecimal",
  "blake3",
  "bytes",
@@ -4262,7 +4168,7 @@ dependencies = [
  "testcontainers-modules",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.25.0",
+ "tokio-tungstenite",
  "tonic 0.14.5",
  "tracing",
  "tracing-core",
@@ -4356,7 +4262,7 @@ dependencies = [
  "testcontainers",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.25.0",
+ "tokio-tungstenite",
  "tokio-util",
  "tonic 0.14.5",
  "tonic-health",
@@ -4508,24 +4414,13 @@ dependencies = [
  "web-time",
 ]
 
-[[package]]
-name = "group"
-version = "0.12.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5dfbfb3a6cfbd390d5c9564ab283a0349b9b9fcd46a706c1eb10e0db70bfbac7"
-dependencies = [
- "ff 0.12.1",
- "rand_core 0.6.4",
- "subtle",
-]
-
 [[package]]
 name = "group"
 version = "0.13.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
 dependencies = [
- "ff 0.13.1",
+ "ff",
  "rand_core 0.6.4",
  "subtle",
 ]
@@ -5314,7 +5209,7 @@ dependencies = [
  "test-r",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.25.0",
+ "tokio-tungstenite",
  "tracing",
  "tracing-opentelemetry",
  "url",
@@ -6258,23 +6153,6 @@ version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1d87ecb2933e8aeadb3e3a02b828fed80a7528047e68b4f424523a0981a3a084"
 
-[[package]]
-name = "native-tls"
-version = "0.2.13"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0dab59f8e050d5df8e4dd87d9206fb6f65a483e20ac9fda365ade4fab353196c"
-dependencies = [
- "libc",
- "log",
- "openssl",
- "openssl-probe 0.1.6",
- "openssl-sys",
- "schannel",
- "security-framework 2.11.1",
- "security-framework-sys",
- "tempfile",
-]
-
 [[package]]
 name = "newline-converter"
 version = "0.3.0"
@@ -6608,7 +6486,7 @@ dependencies = [
  "itertools 0.10.5",
  "log",
  "oauth2",
- "p256 0.13.2",
+ "p256",
  "p384",
  "rand 0.8.5",
  "rsa",
@@ -6624,32 +6502,6 @@ dependencies = [
  "url",
 ]
 
-[[package]]
-name = "openssl"
-version = "0.10.73"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8505734d46c8ab1e19a1dce3aef597ad87dcb4c37e7188231769bd6bd51cebf8"
-dependencies = [
- "bitflags 2.11.1",
- "cfg-if",
- "foreign-types",
- "libc",
- "once_cell",
- "openssl-macros",
- "openssl-sys",
-]
-
-[[package]]
-name = "openssl-macros"
-version = "0.1.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
-dependencies = [
- "proc-macro2",
- "quote",
- "syn 2.0.119",
-]
-
 [[package]]
 name = "openssl-probe"
 version = "0.1.6"
@@ -6662,18 +6514,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
-[[package]]
-name = "openssl-sys"
-version = "0.9.109"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90096e2e47630d78b7d1c20952dc621f957103f8bc2c8359ec81290d75238571"
-dependencies = [
- "cc",
- "libc",
- "pkg-config",
- "vcpkg",
-]
-
 [[package]]
 name = "opentelemetry"
 version = "0.29.1"
@@ -6840,25 +6680,14 @@ version = "4.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d211803b9b6b570f68772237e415a029d5a50c65d382910b879fb19d3271f94d"
 
-[[package]]
-name = "p256"
-version = "0.11.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51f44edd08f51e2ade572f141051021c5af22677e42b7dd28a88155151c33594"
-dependencies = [
- "ecdsa 0.14.8",
- "elliptic-curve 0.12.3",
- "sha2",
-]
-
 [[package]]
 name = "p256"
 version = "0.13.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c9863ad85fa8f4460f9c48cb909d38a0d689dba1f6f6988a5e3e0d31071bcd4b"
 dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
+ "ecdsa",
+ "elliptic-curve",
  "primeorder",
  "sha2",
 ]
@@ -6869,8 +6698,8 @@ version = "0.13.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "fe42f1670a52a47d448f14b6a5c61dd78fce51856e68edaa38f7ae3a46b8d6b6"
 dependencies = [
- "ecdsa 0.16.9",
- "elliptic-curve 0.13.8",
+ "ecdsa",
+ "elliptic-curve",
  "primeorder",
  "sha2",
 ]
@@ -7166,19 +6995,9 @@ version = "0.7.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c8ffb9f10fa047879315e6625af03c164b16962a5368d724ed16323b68ace47f"
 dependencies = [
- "der 0.7.10",
- "pkcs8 0.10.2",
- "spki 0.7.3",
-]
-
-[[package]]
-name = "pkcs8"
-version = "0.9.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9eca2c590a5f85da82668fa685c09ce2888b9430e83299debf1f34b65fd4a4ba"
-dependencies = [
- "der 0.6.1",
- "spki 0.6.0",
+ "der",
+ "pkcs8",
+ "spki",
 ]
 
 [[package]]
@@ -7187,8 +7006,8 @@ version = "0.10.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f950b2377845cebe5cf8b5165cb3cc1a5e0fa5cfa3e1f7f55707d8fd82e0a7b7"
 dependencies = [
- "der 0.7.10",
- "spki 0.7.3",
+ "der",
+ "spki",
 ]
 
 [[package]]
@@ -7274,7 +7093,7 @@ dependencies = [
  "time",
  "tokio",
  "tokio-stream",
- "tokio-tungstenite 0.27.0",
+ "tokio-tungstenite",
  "tokio-util",
  "tower 0.4.13",
  "tracing",
@@ -7482,7 +7301,7 @@ version = "0.13.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "353e1ca18966c16d9deb1c69278edbc5f194139612772bd9537af60ac231e1e6"
 dependencies = [
- "elliptic-curve 0.13.8",
+ "elliptic-curve",
 ]
 
 [[package]]
@@ -8371,17 +8190,6 @@ dependencies = [
  "rand 0.9.2",
 ]
 
-[[package]]
-name = "rfc6979"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7743f17af12fa0b03b803ba12cd6a8d9483a587e89c69445e3909655c0b9fabb"
-dependencies = [
- "crypto-bigint 0.4.9",
- "hmac",
- "zeroize",
-]
-
 [[package]]
 name = "rfc6979"
 version = "0.4.0"
@@ -8520,10 +8328,10 @@ dependencies = [
  "num-integer",
  "num-traits",
  "pkcs1",
- "pkcs8 0.10.2",
+ "pkcs8",
  "rand_core 0.6.4",
- "signature 2.2.0",
- "spki 0.7.3",
+ "signature",
+ "spki",
  "subtle",
  "zeroize",
 ]
@@ -8891,30 +8699,16 @@ dependencies = [
  "syn 2.0.119",
 ]
 
-[[package]]
-name = "sec1"
-version = "0.3.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3be24c1842290c45df0a7bf069e0c268a747ad05a192f2fd7dcfdbc1cba40928"
-dependencies = [
- "base16ct 0.1.1",
- "der 0.6.1",
- "generic-array 0.14.9",
- "pkcs8 0.9.0",
- "subtle",
- "zeroize",
-]
-
 [[package]]
 name = "sec1"
 version = "0.7.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
 dependencies = [
- "base16ct 0.2.0",
- "der 0.7.10",
+ "base16ct",
+ "der",
  "generic-array 0.14.9",
- "pkcs8 0.10.2",
+ "pkcs8",
  "subtle",
  "zeroize",
 ]
@@ -9259,16 +9053,6 @@ dependencies = [
  "libc",
 ]
 
-[[package]]
-name = "signature"
-version = "1.6.4"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "74233d3b3b2f6d4b006dc19dee745e73e2a6bfb6f93607cd3b02bd5b00797d7c"
-dependencies = [
- "digest",
- "rand_core 0.6.4",
-]
-
 [[package]]
 name = "signature"
 version = "2.2.0"
@@ -9414,16 +9198,6 @@ dependencies = [
  "lock_api",
 ]
 
-[[package]]
-name = "spki"
-version = "0.6.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67cf02bbac7a337dc36e4f5a693db6c21e7863f45070f7064577eb4367a3212b"
-dependencies = [
- "base64ct",
- "der 0.6.1",
-]
-
 [[package]]
 name = "spki"
 version = "0.7.3"
@@ -9431,7 +9205,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d91ed6c858b01f942cd56b37a94b3e0a1798290327d1236e4d9cf4eaca44d29d"
 dependencies = [
  "base64ct",
- "der 0.7.10",
+ "der",
 ]
 
 [[package]]
@@ -10198,16 +9972,6 @@ dependencies = [
  "tokio-stream",
 ]
 
-[[package]]
-name = "tokio-native-tls"
-version = "0.3.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
-dependencies = [
- "native-tls",
- "tokio",
-]
-
 [[package]]
 name = "tokio-rustls"
 version = "0.24.1"
@@ -10240,20 +10004,6 @@ dependencies = [
  "tokio-util",
 ]
 
-[[package]]
-name = "tokio-tungstenite"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28562dd8aea311048ed1ab9372a6b9a59977e1b308afb87c985c1f2b3206938"
-dependencies = [
- "futures-util",
- "log",
- "native-tls",
- "tokio",
- "tokio-native-tls",
- "tungstenite 0.25.0",
-]
-
 [[package]]
 name = "tokio-tungstenite"
 version = "0.27.0"
@@ -10262,8 +10012,12 @@ checksum = "489a59b6730eda1b0171fcfda8b121f4bee2b35cba8645ca35c5f7ba3eb736c1"
 dependencies = [
  "futures-util",
  "log",
+ "rustls 0.23.37",
+ "rustls-pki-types",
  "tokio",
- "tungstenite 0.27.0",
+ "tokio-rustls 0.26.4",
+ "tungstenite",
+ "webpki-roots 0.26.11",
 ]
 
 [[package]]
@@ -10877,25 +10631,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tungstenite"
-version = "0.25.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "326eb16466ed89221beef69dbc94f517ee888bae959895472133924a25f7070e"
-dependencies = [
- "byteorder",
- "bytes",
- "data-encoding",
- "http 1.4.0",
- "httparse",
- "log",
- "native-tls",
- "rand 0.8.5",
- "sha1",
- "thiserror 2.0.18",
- "utf-8",
-]
-
 [[package]]
 name = "tungstenite"
 version = "0.27.0"
@@ -10908,6 +10643,8 @@ dependencies = [
  "httparse",
  "log",
  "rand 0.9.2",
+ "rustls 0.23.37",
+ "rustls-pki-types",
  "sha1",
  "thiserror 2.0.18",
  "utf-8",
diff --git a/Cargo.toml b/Cargo.toml
index 95676aa6ec..982e7ee93e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -65,7 +65,7 @@ async-trait = "0.1.87"
 async_zip = { version = "0.0.17", features = ["tokio", "tokio-fs", "deflate"] }
 auditable-serde = "0.8.0"
 aws-config = "1.5.10"
-aws-sdk-s3 = "1.65.0"
+aws-sdk-s3 = { version = "1.65.0", default-features = false, features = ["default-https-client", "rt-tokio", "rustls"] }
 backtrace-on-stack-overflow = "0.3.0"
 axum = { version = "0.8", features = ["multipart"] }
 axum-jrpc = "0.9.0"
@@ -167,7 +167,6 @@ mimalloc = "0.1.52"
 minijinja = "2.7.0"
 
 nanoid = "0.4.0"
-native-tls = "=0.2.13"
 nondestructive = "0.0.26"
 nonempty-collections = "1.2.1"
 nonzero_ext = "0.3.0"
@@ -176,8 +175,6 @@ num-traits = "0.2.19"
 once_cell = "1.21.0"
 openapiv3 = "=2.0.0"
 openidconnect = "4.0.1"
-openssl = "=0.10.73"
-openssl-sys = "=0.9.109"
 opentelemetry = "0.30.0"
 opentelemetry-otlp = { version = "0.30.0" }
 opentelemetry-prometheus-text-exporter = "=0.2.0"
@@ -237,7 +234,7 @@ shell-words = "1.1.0"
 shlex = "1.3.0"
 similar = "2.7.0"
 spdx = "0.10.8"
-sqlx = { version = "0.8", features = ["runtime-tokio", "tls-rustls", "sqlite", "postgres", "mysql", "uuid", "migrate", "chrono", "json", "bigdecimal", "mac_address", "bit-vec", "ipnetwork", ] }
+sqlx = { version = "0.8", default-features = false, features = ["runtime-tokio", "tls-rustls", "sqlite", "postgres", "mysql", "uuid", "migrate", "derive", "chrono", "json", "bigdecimal", "mac_address", "bit-vec", "ipnetwork", ] }
 sqlx-core = { version = "0.8" }
 strip-ansi-escapes = "0.2.0"
 strum = "0.27.1"
@@ -260,7 +257,7 @@ tokio-metrics = { version = "0.5.0", features = ["metrics-rs-integration"] }
 tokio-postgres = "0.7.13"
 tokio-rustls = { version = "0.26.2" }
 tokio-stream = { version = "0.1", features = ["sync"] }
-tokio-tungstenite = { version = "0.25.0", features = ["native-tls"] }
+tokio-tungstenite = { version = "0.27.0", features = ["rustls-tls-webpki-roots"] }
 tokio-util = "0.7.13"
 toml = "0.9.5"
 toml_edit = "0.23.3"
@@ -327,6 +324,11 @@ wasmtime-wizer = { git = "https://github.com/golemcloud/wasmtime.git", branch =
 
 [profile.dev]
 panic = "abort"
+debug = "line-tables-only"
+
+[profile.full-debug]
+inherits = "dev"
+debug = "full"
 
 # Build the Cranelift/regalloc codegen crates (the ones Wasmtime runs to compile
 # wasm -> native) at opt-level 3 even in debug builds. A debug-built Cranelift is
diff --git a/Makefile.toml b/Makefile.toml
index 5f00c3c7c1..e273126436 100644
--- a/Makefile.toml
+++ b/Makefile.toml
@@ -261,6 +261,12 @@ private = true
 condition = { env_not_set = ["CI"] }
 run_task = [{ name = ["build-registry-service"] }]
 
+[tasks.build-shard-manager-kubernetes]
+private = true
+dependencies = ["build-bins-non-ci"]
+command = "cargo"
+args = ["build", "-p", "golem-shard-manager", "--features", "kubernetes"]
+
 [tasks.build-release-full]
 dependencies = [
     "wit",
@@ -273,6 +279,8 @@ args = [
     "--release",
     "--exclude",
     "integration-tests",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-release]
@@ -302,6 +310,8 @@ args = [
     "integration-tests",
     "--exclude",
     "golem",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-release-override-linux-amd64]
@@ -318,6 +328,8 @@ args = [
     "integration-tests",
     "--exclude",
     "golem",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-release-override-linux-arm64]
@@ -335,6 +347,8 @@ args = [
     "integration-tests",
     "--exclude",
     "golem",
+    "--features",
+    "golem-shard-manager/kubernetes",
 ]
 
 [tasks.build-sdk-ts]
@@ -1124,7 +1138,7 @@ script = { file = "./local-run/start.sh" }
 
 [tasks.generate-configs]
 description = "Generates default and example config files"
-dependencies = ["build-bins-non-ci"]
+dependencies = ["build-shard-manager-kubernetes"]
 
 script = '''
 export RUST_BACKTRACE=1
diff --git a/cli/golem-cli/Cargo.toml b/cli/golem-cli/Cargo.toml
index 1d863d5f9c..25e1d9eee9 100644
--- a/cli/golem-cli/Cargo.toml
+++ b/cli/golem-cli/Cargo.toml
@@ -67,7 +67,6 @@ itertools = { workspace = true }
 jsonschema = { workspace = true }
 lenient_bool = { workspace = true }
 minijinja = { workspace = true }
-native-tls = { workspace = true }
 phf = { workspace = true }
 portable-pty = { workspace = true }
 prettyplease = { workspace = true }
@@ -77,6 +76,7 @@ regex = { workspace = true }
 reqwest = { workspace = true }
 reqwest-middleware = { workspace = true }
 reqwest-retry = { workspace = true }
+rustls = { workspace = true }
 serde = { workspace = true }
 serde_derive = { workspace = true }
 serde_json = { workspace = true }
@@ -120,10 +120,6 @@ wasmtime-wasi = { workspace = true }
 wit-component = { workspace = true }
 wit-parser = { workspace = true }
 
-[target.'cfg(not(any(target_os = "windows", target_vendor = "apple")))'.dependencies]
-openssl = { workspace = true }
-openssl-sys = { workspace = true }
-
 [target.'cfg(windows)'.dependencies]
 windows-sys = { workspace = true }
 
diff --git a/cli/golem-cli/src/command_handler/agent/stream.rs b/cli/golem-cli/src/command_handler/agent/stream.rs
index 7e36a96244..18f4887ba9 100644
--- a/cli/golem-cli/src/command_handler/agent/stream.rs
+++ b/cli/golem-cli/src/command_handler/agent/stream.rs
@@ -24,7 +24,10 @@ use futures_util::{SinkExt, StreamExt, TryStreamExt, future, pin_mut};
 use golem_common::model::auth::TokenSecret;
 use golem_common::model::component::ComponentId;
 use golem_common::model::{AgentEvent, AgentId, IdempotencyKey, LogLevel, Timestamp};
-use native_tls::TlsConnector;
+use rustls::client::danger::{HandshakeSignatureValid, ServerCertVerified, ServerCertVerifier};
+use rustls::crypto::WebPkiSupportedAlgorithms;
+use rustls::pki_types::{CertificateDer, ServerName, UnixTime};
+use rustls::{DigitallySignedStruct, SignatureScheme};
 use std::sync::Arc;
 use std::sync::atomic::{AtomicBool, Ordering};
 use std::time::Duration;
@@ -41,6 +44,46 @@ use tracing::{debug, error, info, trace};
 use url::Url;
 use uuid::Uuid;
 
+#[derive(Debug)]
+struct InsecureServerCertVerifier {
+    signature_algorithms: WebPkiSupportedAlgorithms,
+}
+
+impl ServerCertVerifier for InsecureServerCertVerifier {
+    fn verify_server_cert(
+        &self,
+        _end_entity: &CertificateDer<'_>,
+        _intermediates: &[CertificateDer<'_>],
+        _server_name: &ServerName<'_>,
+        _ocsp_response: &[u8],
+        _now: UnixTime,
+    ) -> Result<ServerCertVerified, rustls::Error> {
+        Ok(ServerCertVerified::assertion())
+    }
+
+    fn verify_tls12_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &DigitallySignedStruct,
+    ) -> Result<HandshakeSignatureValid, rustls::Error> {
+        rustls::crypto::verify_tls12_signature(message, cert, dss, &self.signature_algorithms)
+    }
+
+    fn verify_tls13_signature(
+        &self,
+        message: &[u8],
+        cert: &CertificateDer<'_>,
+        dss: &DigitallySignedStruct,
+    ) -> Result<HandshakeSignatureValid, rustls::Error> {
+        rustls::crypto::verify_tls13_signature(message, cert, dss, &self.signature_algorithms)
+    }
+
+    fn supported_verify_schemes(&self) -> Vec<SignatureScheme> {
+        self.signature_algorithms.supported_schemes()
+    }
+}
+
 pub struct AgentConnection {
     request: Request,
     connector: Option<Connector>,
@@ -184,12 +227,16 @@ impl AgentConnection {
         }
 
         let connector = if allow_insecure {
-            Some(Connector::NativeTls(
-                TlsConnector::builder()
-                    .danger_accept_invalid_certs(true)
-                    .danger_accept_invalid_hostnames(true)
-                    .build()?,
-            ))
+            let provider = Arc::new(rustls::crypto::ring::default_provider());
+            let verifier = InsecureServerCertVerifier {
+                signature_algorithms: provider.signature_verification_algorithms,
+            };
+            let tls_config = rustls::ClientConfig::builder_with_provider(provider)
+                .with_safe_default_protocol_versions()?
+                .dangerous()
+                .with_custom_certificate_verifier(Arc::new(verifier))
+                .with_no_client_auth();
+            Some(Connector::Rustls(Arc::new(tls_config)))
         } else {
             None
         };
@@ -208,9 +255,7 @@ impl AgentConnection {
             interval.tick().await;
 
             let ping_result = write
-                .send(Message::Ping(
-                    Bytes::from(cnt.to_ne_bytes().to_vec()).into(),
-                ))
+                .send(Message::Ping(Bytes::from(cnt.to_ne_bytes().to_vec())))
                 .await
                 .context("Failed to send ping");
 
@@ -414,8 +459,7 @@ impl AgentConnection {
                 }
             }
             Message::Binary(data) => {
-                let parsed: serde_json::Result<AgentEvent> =
-                    serde_json::from_slice(data.as_slice());
+                let parsed: serde_json::Result<AgentEvent> = serde_json::from_slice(data.as_ref());
                 match parsed {
                     Ok(parsed) => Some(parsed),
                     Err(err) => {
diff --git a/golem-debugging-service/tests/debug_mode/debug_worker_executor.rs b/golem-debugging-service/tests/debug_mode/debug_worker_executor.rs
index edf2c3be8c..f8ed59b6da 100644
--- a/golem-debugging-service/tests/debug_mode/debug_worker_executor.rs
+++ b/golem-debugging-service/tests/debug_mode/debug_worker_executor.rs
@@ -12,7 +12,6 @@ use tokio::net::TcpStream;
 use tokio::task::JoinSet;
 use tokio_tungstenite::tungstenite::Message;
 use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-use tokio_tungstenite::tungstenite::protocol::frame::Utf8Payload;
 use tokio_tungstenite::{MaybeTlsStream, WebSocketStream, connect_async};
 
 pub type DebugServiceClient = WebSocketStream<MaybeTlsStream<TcpStream>>;
@@ -55,9 +54,7 @@ impl DebugWorkerExecutorClient {
         let id = Id::Str(uuid.to_string());
 
         self.write_msg
-            .send(Message::Text(Utf8Payload::from(serde_json::to_string(
-                &jrpc_request,
-            )?)))
+            .send(Message::Text(serde_json::to_string(&jrpc_request)?.into()))
             .await?;
 
         Ok(id)
diff --git a/golem-registry-service/Cargo.toml b/golem-registry-service/Cargo.toml
index 95c20ae7cd..760e4361b5 100644
--- a/golem-registry-service/Cargo.toml
+++ b/golem-registry-service/Cargo.toml
@@ -27,8 +27,6 @@ anyhow = { workspace = true }
 applying = { workspace = true }
 async-trait = { workspace = true }
 async_zip = { workspace = true, features = ["tokio", "tokio-fs", "deflate"] }
-aws-config = { workspace = true }
-aws-sdk-s3 = { workspace = true }
 bigdecimal = { workspace = true }
 blake3 = { workspace = true }
 bytes = { workspace = true }
diff --git a/golem-shard-manager/Cargo.toml b/golem-shard-manager/Cargo.toml
index 90ed889542..f9f03b4940 100644
--- a/golem-shard-manager/Cargo.toml
+++ b/golem-shard-manager/Cargo.toml
@@ -65,5 +65,5 @@ uuid = { workspace = true }
 tempfile = { workspace = true }
 
 [features]
-default = ["kubernetes"]
+default = []
 kubernetes = ["dep:kube", "dep:k8s-openapi"]
diff --git a/golem-shard-manager/src/config.rs b/golem-shard-manager/src/config.rs
index 67111b46de..4ab3ba8b16 100644
--- a/golem-shard-manager/src/config.rs
+++ b/golem-shard-manager/src/config.rs
@@ -12,6 +12,7 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+#[cfg(feature = "kubernetes")]
 use crate::config::HealthCheckMode::K8s;
 use golem_common::SafeDisplay;
 use golem_common::config::{
@@ -121,19 +122,27 @@ impl Default for ShardManagerConfig {
 
 impl HasConfigExamples<ShardManagerConfig> for ShardManagerConfig {
     fn examples() -> Vec<ConfigExample<ShardManagerConfig>> {
-        vec![(
-            "with k8s healthcheck",
-            Self {
-                health_check: HealthCheckConfig {
-                    delay: Duration::from_secs(1),
-                    mode: K8s(HealthCheckK8sConfig {
-                        namespace: "namespace".to_string(),
-                    }),
-                    silent: false,
+        #[cfg(feature = "kubernetes")]
+        {
+            vec![(
+                "with k8s healthcheck",
+                Self {
+                    health_check: HealthCheckConfig {
+                        delay: Duration::from_secs(1),
+                        mode: K8s(HealthCheckK8sConfig {
+                            namespace: "namespace".to_string(),
+                        }),
+                        silent: false,
+                    },
+                    ..Self::default()
                 },
-                ..Self::default()
-            },
-        )]
+            )]
+        }
+
+        #[cfg(not(feature = "kubernetes"))]
+        {
+            Vec::new()
+        }
     }
 }
 
diff --git a/golem-shard-manager/src/lib.rs b/golem-shard-manager/src/lib.rs
index 60a1fa4551..a3d1d8dc82 100644
--- a/golem-shard-manager/src/lib.rs
+++ b/golem-shard-manager/src/lib.rs
@@ -20,7 +20,9 @@ mod registry_event_subscriber;
 pub(crate) mod sharding;
 
 use self::grpc::ShardManagerServiceImpl;
-use crate::config::{HealthCheckK8sConfig, HealthCheckMode};
+#[cfg(feature = "kubernetes")]
+use crate::config::HealthCheckK8sConfig;
+use crate::config::HealthCheckMode;
 use crate::quota::{DbQuotaRepo, GrpcResourceDefinitionFetcher, QuotaService};
 use crate::registry_event_subscriber::ShardManagerRegistryInvalidationHandler;
 use crate::sharding::healthcheck::GrpcHealthCheck;
diff --git a/golem-shard-manager/src/sharding/error.rs b/golem-shard-manager/src/sharding/error.rs
index 98f752f5ad..a089fb9b6e 100644
--- a/golem-shard-manager/src/sharding/error.rs
+++ b/golem-shard-manager/src/sharding/error.rs
@@ -70,16 +70,22 @@ pub enum HealthCheckError {
     GrpcTransportError(#[source] tonic::transport::Error),
     #[error("gRPC: {0}")]
     GrpcOther(&'static str),
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: connect error: {0}")]
     K8sConnectError(#[source] kube::Error),
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: pod not found")]
     K8sPodNotFound,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: pod terminated")]
     K8sPodTerminated,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: pod is not ready")]
     K8sPodNotReady,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: no pod status")]
     K8sNoPodStatus,
+    #[cfg(feature = "kubernetes")]
     #[error("K8s: no pod name")]
     K8sNoPodName,
 }
@@ -90,11 +96,17 @@ impl IsRetriableError for HealthCheckError {
             HealthCheckError::GrpcError(status) => status.is_retriable(),
             HealthCheckError::GrpcTransportError(_) => true,
             HealthCheckError::GrpcOther(_) => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sConnectError(_) => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sPodNotFound => false,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sPodTerminated => false,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sPodNotReady => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sNoPodStatus => true,
+            #[cfg(feature = "kubernetes")]
             HealthCheckError::K8sNoPodName => false,
         }
     }
diff --git a/golem-test-framework/Cargo.toml b/golem-test-framework/Cargo.toml
index ed976d2953..807d2c6586 100644
--- a/golem-test-framework/Cargo.toml
+++ b/golem-test-framework/Cargo.toml
@@ -50,7 +50,7 @@ testcontainers = { workspace = true }
 testcontainers-modules = { workspace = true }
 tokio = { workspace = true }
 tokio-stream = { workspace = true }
-tokio-tungstenite = { workspace = true, features = ["native-tls"] }
+tokio-tungstenite = { workspace = true }
 tonic = { workspace = true }
 tracing = { workspace = true }
 tracing-core = { workspace = true }
diff --git a/golem-test-framework/src/config/dsl_impl.rs b/golem-test-framework/src/config/dsl_impl.rs
index 8c0c65e070..a7a5623e7c 100644
--- a/golem-test-framework/src/config/dsl_impl.rs
+++ b/golem-test-framework/src/config/dsl_impl.rs
@@ -69,7 +69,6 @@ use tokio::fs::File;
 use tokio::net::TcpStream;
 use tokio_tungstenite::tungstenite::Message;
 use tokio_tungstenite::tungstenite::client::IntoClientRequest;
-use tokio_tungstenite::tungstenite::protocol::frame::Payload;
 use tokio_tungstenite::{Connector, MaybeTlsStream, WebSocketStream};
 use tracing::trace;
 use uuid::Uuid;
@@ -1114,7 +1113,7 @@ impl HttpWorkerLogEventStream {
             loop {
                 interval.tick().await;
                 match write
-                    .send(Message::Ping(Payload::from(PING_HELLO.as_bytes())))
+                    .send(Message::Ping(PING_HELLO.as_bytes().to_vec().into()))
                     .await
                 {
                     Ok(_) => {}
@@ -1142,7 +1141,7 @@ impl WorkerLogEventStream for HttpWorkerLogEventStream {
                     }
                     Message::Binary(payload) => {
                         return Ok(Some(
-                            serde_json::from_slice::<AgentEvent>(payload.as_slice())?
+                            serde_json::from_slice::<AgentEvent>(payload.as_ref())?
                                 .try_into()
                                 .map_err(|error: String| anyhow!(error))?,
                         ));
diff --git a/golem-worker-executor/src/durable_host/websocket/client.rs b/golem-worker-executor/src/durable_host/websocket/client.rs
index 27e54bc435..05f6f6b163 100644
--- a/golem-worker-executor/src/durable_host/websocket/client.rs
+++ b/golem-worker-executor/src/durable_host/websocket/client.rs
@@ -940,7 +940,7 @@ fn to_tungstenite_message(message: Message) -> tungstenite::Message {
 fn to_user_message(msg: tungstenite::Message) -> Result<Option<Message>, Error> {
     match msg {
         tungstenite::Message::Text(text) => Ok(Some(Message::Text(text.as_str().to_owned()))),
-        tungstenite::Message::Binary(data) => Ok(Some(Message::Binary(data.as_slice().to_vec()))),
+        tungstenite::Message::Binary(data) => Ok(Some(Message::Binary(data.as_ref().to_vec()))),
         tungstenite::Message::Close(frame) => {
             let (code, reason) = match frame {
                 Some(frame) => (frame.code.into(), frame.reason.to_string()),