diff --git a/Cargo.lock b/Cargo.lock
index 9544a63b899..c07772fe232 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9893,6 +9893,7 @@ dependencies = [
  "futures-util",
  "log",
  "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
diff --git a/Cargo.toml b/Cargo.toml
index d6ee839f1b0..58244b3d88b 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -125,7 +125,11 @@ moka    = { version = "0.12", features = ["sync"] }
 futures-util = "0.3"
 
 # WebSocket client (test client)
-tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
+# Both root sources on purpose. Native roots let wss:// work where the OS trusts a
+# CA the Mozilla bundle does not (TLS-inspecting proxies), and honor SSL_CERT_FILE.
+# Keeping webpki roots means an empty native store is not fatal, so hosts without a
+# system trust store — minimal containers — behave as they do today.
+tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots", "rustls-tls-native-roots"] }
 url = "2"
 
 # Property-based testing (dev-only)
diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index 68b702431af..507c9360a0d 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -11227,6 +11227,7 @@ dependencies = [
  "futures-util",
  "log",
  "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index f41fa2d6e39..be64c9c8483 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -83,7 +83,8 @@ infer = "0.19"
 hex = "0.4"
 ed25519-dalek = "=3.0.0-rc.0"
 tokio = { version = "1", features = ["fs", "sync", "rt", "macros", "time", "net", "io-util"] }
-tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
+# Root sources kept in sync with the workspace manifest; see the comment there.
+tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots", "rustls-tls-native-roots"] }
 tokio-util = { version = "0.7", features = ["rt"] }
 bytes = "1"
 futures-util = "0.3"