diff --git a/Cargo.lock b/Cargo.lock
index 0b9e8577ec..eae38064cb 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -899,6 +899,7 @@ dependencies = [
  "nostr",
  "rand 0.10.1",
  "reqwest 0.13.4",
+ "rustls",
  "serde",
  "serde_json",
  "sha2 0.11.0",
diff --git a/crates/buzz-cli/Cargo.toml b/crates/buzz-cli/Cargo.toml
index a12260b526..188b8440dd 100644
--- a/crates/buzz-cli/Cargo.toml
+++ b/crates/buzz-cli/Cargo.toml
@@ -19,6 +19,9 @@ path = "src/main.rs"
 # CLI argument parsing — derive macros + env var support (BUZZ_API_TOKEN auto-wired)
 clap = { version = "4", features = ["derive", "env"] }
 
+# Explicit rustls dep so the CLI can install the ring CryptoProvider at startup
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+
 # HTTP client — async REST calls to the relay
 reqwest = { workspace = true, features = ["json"] }
 
diff --git a/crates/buzz-cli/src/lib.rs b/crates/buzz-cli/src/lib.rs
index d5c6b6f9ab..eac85f04c0 100644
--- a/crates/buzz-cli/src/lib.rs
+++ b/crates/buzz-cli/src/lib.rs
@@ -25,6 +25,11 @@ where
     I: IntoIterator<Item = S>,
     S: Into<std::ffi::OsString> + Clone,
 {
+    // Install the ring CryptoProvider for rustls. The workspace enables more
+    // than one rustls crypto backend, so rustls cannot auto-select a
+    // process-level provider and panics on the first TLS-capable connection
+    // without this.
+    let _ = rustls::crypto::ring::default_provider().install_default();
     let cli = match Cli::try_parse_from(args) {
         Ok(cli) => cli,
         Err(e) => {