diff --git a/Cargo.lock b/Cargo.lock
index aadac917b8..543db1ae36 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8918,6 +8918,7 @@ checksum = "57f6d249aad744e274e682777a50283a225a32705394ee6d5fcc01efa25e4055"
 dependencies = [
  "aws-lc-rs",
  "pem",
+ "ring",
  "rustls-pki-types",
  "time",
  "x509-parser",
@@ -13953,6 +13954,7 @@ dependencies = [
  "lazy_static",
  "nom 7.1.3",
  "oid-registry",
+ "ring",
  "rusticata-macros",
  "thiserror 2.0.18",
  "time",
diff --git a/crates/goose/Cargo.toml b/crates/goose/Cargo.toml
index 419e8349db..3db210b884 100644
--- a/crates/goose/Cargo.toml
+++ b/crates/goose/Cargo.toml
@@ -47,6 +47,7 @@ rustls-tls = [
     "dep:axum-server",
     "dep:aws-lc-rs",
     "axum-server/tls-rustls",
+    "rcgen/aws_lc_rs",
     "reqwest/rustls",
     "rmcp/reqwest",
     "smithy-transport-reqwest?/rustls",
@@ -62,6 +63,9 @@ native-tls = [
     "dep:axum-server",
     "dep:openssl",
     "axum-server/tls-openssl",
+    # rcgen requires a crypto backend; ring is used here because aws-lc-rs is
+    # reserved for the rustls-tls path and openssl does not provide this interface.
+    "rcgen/ring",
     "reqwest/native-tls",
     "rmcp/reqwest-native-tls",
     "smithy-transport-reqwest?/native-tls",
@@ -208,7 +212,7 @@ process-wrap = { version = "9", default-features = false, features = ["std"] }
 nostr = { version = "0.44", default-features = false, features = ["nip44", "std"], optional = true }
 nostr-sdk = { version = "0.44", default-features = false, features = ["nip44"], optional = true }
 rustls = { workspace = true, optional = true }
-rcgen = { version = "0.14", default-features = false, features = ["aws_lc_rs", "crypto", "pem"], optional = true }
+rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem"], optional = true }
 axum-server = { version = "0.8", default-features = false, optional = true }
 aws-lc-rs = { version = "1.17", default-features = false, optional = true }
 openssl = { version = "0.10.66", default-features = false, optional = true }