diff --git a/Cargo.lock b/Cargo.lock
index 164f337..b07f93b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1299,7 +1299,7 @@ dependencies = [
  "bitflags 2.13.2",
  "core-foundation 0.10.1",
  "core-graphics-types 0.2.0",
- "foreign-types",
+ "foreign-types 0.5.0",
  "libc",
 ]
 
@@ -2445,6 +2445,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -2452,7 +2461,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
 dependencies = [
  "foreign-types-macros",
- "foreign-types-shared",
+ "foreign-types-shared 0.3.1",
 ]
 
 [[package]]
@@ -2466,6 +2475,12 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "foreign-types-shared"
 version = "0.3.1"
@@ -3499,6 +3514,22 @@ dependencies = [
  "webpki-roots 1.0.9",
 ]
 
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.21"
@@ -4436,7 +4467,7 @@ dependencies = [
  "bitflags 2.13.2",
  "block",
  "core-graphics-types 0.1.3",
- "foreign-types",
+ "foreign-types 0.5.0",
  "log",
  "objc",
  "paste",
@@ -4593,6 +4624,23 @@ dependencies = [
  "typenum",
 ]
 
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "ndk"
 version = "0.9.0"
@@ -5515,12 +5563,49 @@ dependencies = [
  "thiserror 2.0.21",
 ]
 
+[[package]]
+name = "openssl"
+version = "0.10.81"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "77823a27f0babb03091cb9ed9ef80af3b39dbc82f97e8fa530374b7dafd87a45"
+dependencies = [
+ "bitflags 2.13.2",
+ "cfg-if",
+ "foreign-types 0.3.2",
+ "libc",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.119",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-sys"
+version = "0.9.117"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -6562,10 +6647,12 @@ dependencies = [
  "http-body-util",
  "hyper",
  "hyper-rustls",
+ "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
  "mime",
+ "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -6576,6 +6663,7 @@ dependencies = [
  "serde_json",
  "sync_wrapper",
  "tokio",
+ "tokio-native-tls",
  "tokio-rustls",
  "tokio-util",
  "tower",
@@ -8645,6 +8733,16 @@ dependencies = [
  "syn 3.0.6",
 ]
 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rayon"
 version = "2.1.0"
@@ -9455,6 +9553,12 @@ dependencies = [
  "uuid 0.8.2",
 ]
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "vec_map"
 version = "0.8.2"
diff --git a/Cargo.toml b/Cargo.toml
index bfeaf77..6259e1a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -46,7 +46,7 @@ smbcloud-gresiq-sdk = "0.4.7"
 # The ACP crates (ed-mcp, ed-acp, ed-acp-tui, ed-acp-testkit) use these; ed-agent does not.
 agent-client-protocol = "2.2"
 rmcp = { version = "3.5", default-features = false }
-reqwest = { version = "0.13", default-features = false, features = ["rustls", "json", "stream"] }
+reqwest = { version = "0.13", default-features = false, features = ["json", "stream"] }
 ratatui = { version = "0.30.2", default-features = false, features = ["crossterm", "layout-cache", "unstable-rendered-line-info"] }
 crossterm = { version = "0.29", features = ["event-stream"] }
 tokio-util = "0.7"
diff --git a/crates/ed-acp/Cargo.toml b/crates/ed-acp/Cargo.toml
index f50b484..97f890a 100644
--- a/crates/ed-acp/Cargo.toml
+++ b/crates/ed-acp/Cargo.toml
@@ -24,7 +24,6 @@ async-trait.workspace = true
 tokio = { workspace = true, features = ["full"] }
 tokio-util.workspace = true
 futures.workspace = true
-reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 anyhow.workspace = true
@@ -34,6 +33,16 @@ uuid.workspace = true
 directories.workspace = true
 base64.workspace = true
 
+# reqwest 0.13's `rustls` feature is the aws-lc provider, whose C code doesn't build for
+# arm64_32 (`aws-lc-sys` takes it for a 64-bit limb target), and `ring` asserts 64-bit
+# pointers on aarch64. watchOS uses `native-tls`, which is Security.framework and needs no
+# rustls provider at all.
+[target.'cfg(not(target_os = "watchos"))'.dependencies]
+reqwest = { workspace = true, features = ["rustls"] }
+
+[target.'cfg(target_os = "watchos")'.dependencies]
+reqwest = { workspace = true, features = ["native-tls"] }
+
 [dev-dependencies]
 tokio = { version = "1", features = ["full"] }
 # Turn the `local` feature on for this crate's own tests.
diff --git a/crates/ed-mcp/Cargo.toml b/crates/ed-mcp/Cargo.toml
index 7a3ce14..00ffa8f 100644
--- a/crates/ed-mcp/Cargo.toml
+++ b/crates/ed-mcp/Cargo.toml
@@ -16,7 +16,7 @@ agent-client-protocol = { workspace = true, optional = true }
 ed-agent = { workspace = true, optional = true }
 async-trait = { workspace = true, optional = true }
 http = "1"
-rmcp = { workspace = true, features = ["client", "transport-streamable-http-client-reqwest", "reqwest"] }
+rmcp = { workspace = true, features = ["client", "transport-streamable-http-client-reqwest"] }
 tokio = { workspace = true, features = ["sync", "time", "process", "macros", "io-std", "io-util", "rt"] }
 tokio-util.workspace = true
 futures.workspace = true
@@ -24,6 +24,14 @@ serde_json.workspace = true
 anyhow.workspace = true
 tracing.workspace = true
 
+# rmcp's `reqwest` feature turns on reqwest's aws-lc provider, which doesn't build for
+# arm64_32; watchOS takes `reqwest-native-tls` (Security.framework) instead.
+[target.'cfg(not(target_os = "watchos"))'.dependencies]
+rmcp = { workspace = true, features = ["reqwest"] }
+
+[target.'cfg(target_os = "watchos")'.dependencies]
+rmcp = { workspace = true, features = ["reqwest-native-tls"] }
+
 # Spawning an MCP server as a child process needs `exec`, which Apple hides on tvOS and
 # watchOS (`libc` has no `execv` there, so `nix` under `process-wrap` doesn't compile). The
 # stdio transport is everywhere else.
diff --git a/crates/ed-onde-account/Cargo.toml b/crates/ed-onde-account/Cargo.toml
index 76f551f..e9ec620 100644
--- a/crates/ed-onde-account/Cargo.toml
+++ b/crates/ed-onde-account/Cargo.toml
@@ -12,11 +12,20 @@ repository.workspace = true
 homepage.workspace = true
 
 [dependencies]
-reqwest.workspace = true
 serde.workspace = true
 serde_json.workspace = true
 thiserror.workspace = true
 
+# reqwest 0.13's `rustls` feature is the aws-lc provider, whose C code doesn't build for
+# arm64_32 (`aws-lc-sys` takes it for a 64-bit limb target), and `ring` asserts 64-bit
+# pointers on aarch64. watchOS uses `native-tls`, which is Security.framework and needs no
+# rustls provider at all.
+[target.'cfg(not(target_os = "watchos"))'.dependencies]
+reqwest = { workspace = true, features = ["rustls"] }
+
+[target.'cfg(target_os = "watchos")'.dependencies]
+reqwest = { workspace = true, features = ["native-tls"] }
+
 [dev-dependencies]
 axum = "0.8"
 tokio = { workspace = true, features = ["macros", "net", "rt-multi-thread"] }