diff --git a/Cargo.lock b/Cargo.lock
index 81f14dd684..788ebcc136 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -561,6 +561,34 @@ version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ace50bade8e6234aa140d9a2f552bbee1db4d353f69b8217bc503490fc1a9f26"
 
+[[package]]
+name = "aws-lc-rs"
+version = "1.10.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "cdd82dba44d209fddb11c190e0a94b78651f95299598e472215667417a03ff1d"
+dependencies = [
+ "aws-lc-sys",
+ "mirai-annotations",
+ "paste",
+ "untrusted 0.7.1",
+ "zeroize",
+]
+
+[[package]]
+name = "aws-lc-sys"
+version = "0.22.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "df7a4168111d7eb622a31b214057b8509c0a7e1794f44c546d742330dc793972"
+dependencies = [
+ "bindgen",
+ "cc",
+ "cmake",
+ "dunce",
+ "fs_extra",
+ "libc",
+ "paste",
+]
+
 [[package]]
 name = "backoff"
 version = "0.4.0"
@@ -889,7 +917,7 @@ dependencies = [
  "oxnet",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -1317,7 +1345,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -1332,7 +1360,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -1383,6 +1411,15 @@ dependencies = [
  "error-code",
 ]
 
+[[package]]
+name = "cmake"
+version = "0.1.51"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "fb1e43aa7fd152b1f968787f7dbcdeb306d1867ff373c69955211876c053f91a"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "cobs"
 version = "0.2.3"
@@ -1410,7 +1447,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -1741,7 +1778,7 @@ dependencies = [
  "crucible-workspace-hack",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -1800,7 +1837,7 @@ dependencies = [
  "crucible-workspace-hack",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -2020,7 +2057,7 @@ dependencies = [
  "oxnet",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "slog",
@@ -2336,7 +2373,7 @@ dependencies = [
  "hickory-proto",
  "hickory-resolver",
  "hickory-server",
- "http 1.1.0",
+ "http",
  "internal-dns-types",
  "omicron-common",
  "omicron-test-utils",
@@ -2378,11 +2415,11 @@ version = "0.1.0"
 dependencies = [
  "chrono",
  "expectorate",
- "http 1.1.0",
+ "http",
  "internal-dns-types",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "slog",
@@ -2421,7 +2458,7 @@ dependencies = [
  "anyhow",
  "chrono",
  "futures",
- "http 1.1.0",
+ "http",
  "omicron-workspace-hack",
  "omicron-zone-package",
  "progenitor",
@@ -2429,7 +2466,7 @@ dependencies = [
  "quote",
  "rand",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "rustfmt-wrapper",
  "schemars",
  "serde",
@@ -2456,9 +2493,9 @@ dependencies = [
  "form_urlencoded",
  "futures",
  "hostname 0.4.0",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "indexmap 2.6.0",
  "multer",
@@ -2527,6 +2564,12 @@ dependencies = [
  "thiserror",
 ]
 
+[[package]]
+name = "dunce"
+version = "1.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "92773504d58c093f6de2459af4af33faa518c13451eb8f2b5698ed3d36e7c813"
+
 [[package]]
 name = "dyn-clone"
 version = "1.0.17"
@@ -2651,7 +2694,7 @@ dependencies = [
  "dhcproto",
  "futures",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "humantime",
  "internet-checksum",
  "ispf",
@@ -2661,7 +2704,7 @@ dependencies = [
  "omicron-workspace-hack",
  "oxide-client",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "russh",
  "russh-keys",
  "serde",
@@ -3023,6 +3066,12 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "fs_extra"
+version = "1.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "42703706b716c37f96a77aea830392ad231f44c9e9a67872fa5548707e11b11c"
+
 [[package]]
 name = "funty"
 version = "2.0.0"
@@ -3171,7 +3220,7 @@ dependencies = [
  "gateway-messages",
  "omicron-common",
  "omicron-workspace-hack",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "slog",
@@ -3193,7 +3242,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -3430,25 +3479,6 @@ version = "0.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "92620684d99f750bae383ecb3be3748142d6095760afd5cbcf2261e9a279d780"
 
-[[package]]
-name = "h2"
-version = "0.3.26"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "81fe527a889e1532da5c525686d96d4c2e74cdd345badf8dfef9f6b39dd5f5e8"
-dependencies = [
- "bytes",
- "fnv",
- "futures-core",
- "futures-sink",
- "futures-util",
- "http 0.2.12",
- "indexmap 2.6.0",
- "slab",
- "tokio",
- "tokio-util",
- "tracing",
-]
-
 [[package]]
 name = "h2"
 version = "0.4.6"
@@ -3460,7 +3490,7 @@ dependencies = [
  "fnv",
  "futures-core",
  "futures-sink",
- "http 1.1.0",
+ "http",
  "indexmap 2.6.0",
  "slab",
  "tokio",
@@ -3550,7 +3580,7 @@ dependencies = [
  "base64 0.21.7",
  "bytes",
  "headers-core",
- "http 1.1.0",
+ "http",
  "httpdate",
  "mime",
  "sha1",
@@ -3562,7 +3592,7 @@ version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "54b4a22553d4242c49fddb9ba998a99962b5cc6f22cb5a3482bec22522403ce4"
 dependencies = [
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -3784,17 +3814,6 @@ dependencies = [
  "windows",
 ]
 
-[[package]]
-name = "http"
-version = "0.2.12"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "601cbb57e577e2f5ef5be8e7b83f0f63994f25aa94d673e54a92d5c516d101f1"
-dependencies = [
- "bytes",
- "fnv",
- "itoa",
-]
-
 [[package]]
 name = "http"
 version = "1.1.0"
@@ -3806,17 +3825,6 @@ dependencies = [
  "itoa",
 ]
 
-[[package]]
-name = "http-body"
-version = "0.4.6"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7ceab25649e9960c0311ea418d17bee82c0dcec1bd053b5f9a66e265a693bed2"
-dependencies = [
- "bytes",
- "http 0.2.12",
- "pin-project-lite",
-]
-
 [[package]]
 name = "http-body"
 version = "1.0.1"
@@ -3824,7 +3832,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1efedce1fb8e6913f23e0c92de8e62cd5b772a67e7b3946df930a62566c93184"
 dependencies = [
  "bytes",
- "http 1.1.0",
+ "http",
 ]
 
 [[package]]
@@ -3835,8 +3843,8 @@ checksum = "793429d76616a256bcb62c2a2ec2bed781c8307e797e2598c50010f2bee2544f"
 dependencies = [
  "bytes",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
+ "http",
+ "http-body",
  "pin-project-lite",
 ]
 
@@ -3875,9 +3883,9 @@ dependencies = [
  "futures-timer",
  "futures-util",
  "headers",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "lazy_static",
  "log",
@@ -3905,9 +3913,9 @@ dependencies = [
  "crossbeam-channel",
  "form_urlencoded",
  "futures",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "log",
  "once_cell",
@@ -3965,30 +3973,6 @@ version = "2.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
-[[package]]
-name = "hyper"
-version = "0.14.30"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a152ddd61dfaec7273fe8419ab357f33aee0d914c5f4efbf0d96fa749eea5ec9"
-dependencies = [
- "bytes",
- "futures-channel",
- "futures-core",
- "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
- "httparse",
- "httpdate",
- "itoa",
- "pin-project-lite",
- "socket2",
- "tokio",
- "tower-service",
- "tracing",
- "want",
-]
-
 [[package]]
 name = "hyper"
 version = "1.4.1"
@@ -3998,9 +3982,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "h2 0.4.6",
- "http 1.1.0",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "httparse",
  "httpdate",
  "itoa",
@@ -4017,8 +4001,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "a0bea761b46ae2b24eb4aef630d8d1c398157b6fc29e6350ecf090a0b70c952c"
 dependencies = [
  "futures-util",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-util",
  "log",
  "rustls 0.22.4",
@@ -4036,8 +4020,8 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08afdbb5c31130e3034af566421053ab03787c640246a446327f550d11bcb333"
 dependencies = [
  "futures-util",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-util",
  "rustls 0.23.14",
  "rustls-pki-types",
@@ -4054,10 +4038,10 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "bc4bce64c32578957926e75f832032f81ebb30bcee74f86c5848b13a69e547eb"
 dependencies = [
  "futures-util",
- "http 1.1.0",
+ "http",
  "http-range",
  "httpdate",
- "hyper 1.4.1",
+ "hyper",
  "mime_guess",
  "percent-encoding",
  "rand",
@@ -4074,7 +4058,7 @@ checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
 dependencies = [
  "bytes",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-util",
  "native-tls",
  "tokio",
@@ -4091,9 +4075,9 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
- "http 1.1.0",
- "http-body 1.0.1",
- "hyper 1.4.1",
+ "http",
+ "http-body",
+ "hyper",
  "pin-project-lite",
  "socket2",
  "tokio",
@@ -4200,7 +4184,7 @@ dependencies = [
  "crucible-smf",
  "dropshot",
  "futures",
- "http 1.1.0",
+ "http",
  "ipnetwork",
  "libc",
  "macaddr",
@@ -4328,7 +4312,7 @@ dependencies = [
  "futures",
  "hex",
  "hex-literal",
- "http 1.1.0",
+ "http",
  "illumos-utils",
  "installinator-client",
  "installinator-common",
@@ -4341,7 +4325,7 @@ dependencies = [
  "omicron-workspace-hack",
  "partial-io",
  "proptest",
- "reqwest 0.12.8",
+ "reqwest",
  "sha2",
  "sled-hardware",
  "sled-hardware-types",
@@ -4366,7 +4350,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "dropshot",
- "hyper 1.4.1",
+ "hyper",
  "installinator-common",
  "omicron-common",
  "omicron-workspace-hack",
@@ -4385,7 +4369,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -4459,7 +4443,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "qorb",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "sled",
@@ -4757,7 +4741,7 @@ dependencies = [
  "propolis-server-config",
  "rand",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "ron 0.7.1",
  "serde",
  "slog",
@@ -5149,7 +5133,7 @@ dependencies = [
  "chrono",
  "percent-encoding",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -5216,6 +5200,12 @@ dependencies = [
  "windows-sys 0.52.0",
 ]
 
+[[package]]
+name = "mirai-annotations"
+version = "1.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c9be0862c1b3f26a88803c4a49de6889c10e608b3ee9344e6ef5b45fb37ad3d1"
+
 [[package]]
 name = "mockall"
 version = "0.13.0"
@@ -5251,7 +5241,7 @@ dependencies = [
  "bytes",
  "encoding_rs",
  "futures-util",
- "http 1.1.0",
+ "http",
  "httparse",
  "memchr",
  "mime",
@@ -5348,8 +5338,8 @@ dependencies = [
  "dropshot",
  "futures",
  "headers",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "newtype_derive",
  "nexus-db-fixed-data",
  "nexus-db-model",
@@ -5388,7 +5378,7 @@ dependencies = [
  "oxnet",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -5579,8 +5569,8 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "dropshot",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "ipnetwork",
  "nexus-types",
  "omicron-common",
@@ -5627,7 +5617,7 @@ dependencies = [
  "omicron-uuid-kinds",
  "omicron-workspace-hack",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "serde_json",
  "sled-agent-client",
  "slog",
@@ -5685,7 +5675,7 @@ dependencies = [
  "omicron-common",
  "omicron-workspace-hack",
  "oxnet",
- "reqwest 0.12.8",
+ "reqwest",
  "sled-agent-client",
  "slog",
  "uuid",
@@ -5729,7 +5719,7 @@ dependencies = [
  "omicron-workspace-hack",
  "oxnet",
  "pq-sys",
- "reqwest 0.12.8",
+ "reqwest",
  "sled-agent-client",
  "slog",
  "slog-error-chain",
@@ -5869,9 +5859,9 @@ dependencies = [
  "gateway-test-utils",
  "headers",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "illumos-utils",
  "internal-dns-resolver",
  "internal-dns-types",
@@ -5927,7 +5917,7 @@ dependencies = [
  "dropshot",
  "futures",
  "gateway-client",
- "http 1.1.0",
+ "http",
  "humantime",
  "internal-dns-types",
  "ipnetwork",
@@ -6267,7 +6257,7 @@ dependencies = [
  "clickward",
  "dropshot",
  "expectorate",
- "http 1.1.0",
+ "http",
  "illumos-utils",
  "nexus-test-utils",
  "omicron-common",
@@ -6306,7 +6296,7 @@ dependencies = [
  "csv",
  "dropshot",
  "expectorate",
- "http 1.1.0",
+ "http",
  "illumos-utils",
  "nexus-test-utils",
  "omicron-common",
@@ -6350,7 +6340,7 @@ dependencies = [
  "expectorate",
  "futures",
  "hex",
- "http 1.1.0",
+ "http",
  "ipnetwork",
  "libc",
  "macaddr",
@@ -6364,7 +6354,7 @@ dependencies = [
  "proptest",
  "rand",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "semver 1.0.23",
  "serde",
@@ -6391,7 +6381,7 @@ dependencies = [
  "omicron-common",
  "omicron-workspace-hack",
  "progenitor-client",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "sled-hardware-types",
  "slog",
@@ -6455,8 +6445,8 @@ dependencies = [
  "gateway-test-utils",
  "gateway-types",
  "hex",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "illumos-utils",
  "ipcc",
  "omicron-common",
@@ -6509,7 +6499,7 @@ dependencies = [
  "omicron-test-utils",
  "omicron-workspace-hack",
  "pq-sys",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "slog",
  "slog-error-chain",
@@ -6575,11 +6565,11 @@ dependencies = [
  "headers",
  "hex",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
  "httptest",
  "hubtools",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls 0.26.0",
  "illumos-utils",
  "internal-dns-resolver",
@@ -6642,7 +6632,7 @@ dependencies = [
  "rcgen",
  "ref-cast",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "rustls 0.22.4",
  "rustls-pemfile 2.2.0",
@@ -6700,7 +6690,7 @@ dependencies = [
  "gateway-client",
  "gateway-messages",
  "gateway-test-utils",
- "http 1.1.0",
+ "http",
  "humantime",
  "indicatif",
  "internal-dns-resolver",
@@ -6762,7 +6752,7 @@ dependencies = [
  "omicron-zone-package",
  "petgraph",
  "rayon",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "semver 1.0.23",
  "serde",
@@ -6814,7 +6804,7 @@ dependencies = [
  "omicron-workspace-hack",
  "omicron-zone-package",
  "once_cell",
- "reqwest 0.12.8",
+ "reqwest",
  "semver 1.0.23",
  "serde",
  "sha2",
@@ -6868,8 +6858,8 @@ dependencies = [
  "glob",
  "guppy",
  "hex",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "hyper-staticfile",
  "illumos-utils",
  "installinator-common",
@@ -6902,7 +6892,7 @@ dependencies = [
  "propolis_api_types",
  "rand",
  "rcgen",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "semver 1.0.23",
  "serde",
@@ -6956,7 +6946,7 @@ dependencies = [
  "gethostname",
  "headers",
  "hex",
- "http 1.1.0",
+ "http",
  "libc",
  "libfalcon",
  "nexus-config",
@@ -6965,7 +6955,7 @@ dependencies = [
  "pem",
  "rcgen",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "rustls 0.22.4",
  "slog",
@@ -6996,6 +6986,7 @@ dependencies = [
  "ahash",
  "aho-corasick",
  "anyhow",
+ "aws-lc-rs",
  "base16ct",
  "base64 0.22.1",
  "base64ct",
@@ -7043,7 +7034,7 @@ dependencies = [
  "hex",
  "hickory-proto",
  "hmac",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls 0.27.3",
  "hyper-util",
  "indexmap 2.6.0",
@@ -7081,11 +7072,12 @@ dependencies = [
  "regex",
  "regex-automata",
  "regex-syntax 0.8.5",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.17.8",
  "rsa",
  "rustix",
  "rustls 0.23.14",
+ "rustls-webpki 0.102.8",
  "schemars",
  "scopeguard",
  "semver 1.0.23",
@@ -7141,7 +7133,7 @@ dependencies = [
  "futures",
  "futures-util",
  "hex",
- "reqwest 0.12.8",
+ "reqwest",
  "ring 0.16.20",
  "semver 1.0.23",
  "serde",
@@ -7365,13 +7357,13 @@ dependencies = [
  "chrono",
  "futures",
  "hickory-resolver",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "omicron-workspace-hack",
  "progenitor",
  "rand",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "thiserror",
@@ -7435,7 +7427,7 @@ dependencies = [
  "omicron-common",
  "omicron-workspace-hack",
  "progenitor",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "slog",
  "uuid",
@@ -7467,7 +7459,7 @@ dependencies = [
  "oximeter-client",
  "oximeter-db",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -7521,7 +7513,7 @@ dependencies = [
  "peg",
  "reedline",
  "regex",
- "reqwest 0.12.8",
+ "reqwest",
  "rustyline",
  "schemars",
  "serde",
@@ -7550,8 +7542,8 @@ dependencies = [
  "chrono",
  "dropshot",
  "futures",
- "http 1.1.0",
- "hyper 1.4.1",
+ "http",
+ "hyper",
  "kstat-rs",
  "libc",
  "omicron-workspace-hack",
@@ -8524,7 +8516,7 @@ dependencies = [
  "bytes",
  "futures-core",
  "percent-encoding",
- "reqwest 0.12.8",
+ "reqwest",
  "serde",
  "serde_json",
  "serde_urlencoded",
@@ -8537,7 +8529,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d85934a440963a69f9f04f48507ff6e7aa2952a5b2d8f96cc37fa3dd5c270f66"
 dependencies = [
  "heck 0.5.0",
- "http 1.1.0",
+ "http",
  "indexmap 2.6.0",
  "openapiv3",
  "proc-macro2",
@@ -8580,7 +8572,7 @@ dependencies = [
  "futures",
  "progenitor",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -8601,7 +8593,7 @@ dependencies = [
  "futures",
  "progenitor",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -8623,11 +8615,11 @@ dependencies = [
  "clap",
  "dropshot",
  "futures",
- "hyper 1.4.1",
+ "hyper",
  "progenitor",
  "propolis_types",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -9121,44 +9113,6 @@ version = "1.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ba39f3699c378cd8970968dcbff9c43159ea4cfbd88d43c00b22f2ef10a435d2"
 
-[[package]]
-name = "reqwest"
-version = "0.11.27"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
-dependencies = [
- "base64 0.21.7",
- "bytes",
- "encoding_rs",
- "futures-core",
- "futures-util",
- "h2 0.3.26",
- "http 0.2.12",
- "http-body 0.4.6",
- "hyper 0.14.30",
- "ipnet",
- "js-sys",
- "log",
- "mime",
- "once_cell",
- "percent-encoding",
- "pin-project-lite",
- "serde",
- "serde_json",
- "serde_urlencoded",
- "sync_wrapper 0.1.2",
- "system-configuration 0.5.1",
- "tokio",
- "tokio-util",
- "tower-service",
- "url",
- "wasm-bindgen",
- "wasm-bindgen-futures",
- "wasm-streams",
- "web-sys",
- "winreg",
-]
-
 [[package]]
 name = "reqwest"
 version = "0.12.8"
@@ -9173,11 +9127,11 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2 0.4.6",
- "http 1.1.0",
- "http-body 1.0.1",
+ "h2",
+ "http",
+ "http-body",
  "http-body-util",
- "hyper 1.4.1",
+ "hyper",
  "hyper-rustls 0.27.3",
  "hyper-tls",
  "hyper-util",
@@ -9196,8 +9150,8 @@ dependencies = [
  "serde",
  "serde_json",
  "serde_urlencoded",
- "sync_wrapper 1.0.1",
- "system-configuration 0.6.1",
+ "sync_wrapper",
+ "system-configuration",
  "tokio",
  "tokio-native-tls",
  "tokio-rustls 0.26.0",
@@ -9581,6 +9535,7 @@ version = "0.23.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "415d9944693cb90382053259f89fbb077ea730ad7273047ec63b19bc9b160ba8"
 dependencies = [
+ "aws-lc-rs",
  "log",
  "once_cell",
  "ring 0.17.8",
@@ -9643,6 +9598,7 @@ version = "0.102.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "64ca1bc8749bd4cf37b5ce386cc146580777b4e8572c7b97baf22c83f444bee9"
 dependencies = [
+ "aws-lc-rs",
  "ring 0.17.8",
  "rustls-pki-types",
  "untrusted 0.9.0",
@@ -10295,7 +10251,7 @@ dependencies = [
  "oxnet",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -11009,12 +10965,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "sync_wrapper"
-version = "0.1.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2047c6ded9c721764247e62cd3b03c09ffc529b2ba5b10ec482ae507a4a70160"
-
 [[package]]
 name = "sync_wrapper"
 version = "1.0.1"
@@ -11024,17 +10974,6 @@ dependencies = [
  "futures-core",
 ]
 
-[[package]]
-name = "system-configuration"
-version = "0.5.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ba3a3adc5c275d719af8cb4272ea1c4a6d668a777f37e115f6d11ddbc1c8e0e7"
-dependencies = [
- "bitflags 1.3.2",
- "core-foundation",
- "system-configuration-sys 0.5.0",
-]
-
 [[package]]
 name = "system-configuration"
 version = "0.6.1"
@@ -11043,17 +10982,7 @@ checksum = "3c879d448e9d986b661742763247d3693ed13609438cf3d006f51f5368a5ba6b"
 dependencies = [
  "bitflags 2.6.0",
  "core-foundation",
- "system-configuration-sys 0.6.0",
-]
-
-[[package]]
-name = "system-configuration-sys"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a75fb188eb626b924683e3b95e3a48e63551fcfb51949de2f06a9d91dbee93c9"
-dependencies = [
- "core-foundation-sys",
- "libc",
+ "system-configuration-sys",
 ]
 
 [[package]]
@@ -11645,12 +11574,13 @@ checksum = "ea68304e134ecd095ac6c3574494fc62b909f416c4fca77e440530221e549d3d"
 
 [[package]]
 name = "tough"
-version = "0.17.1"
+version = "0.19.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8d7a87d51ca5a113542e1b9f5ee2b14b6864bf7f34d103740086fa9c3d57d3b"
+checksum = "d4f60327896014cd6f78d6a15ef07de21d21b1046efc86e8046ecd48e688fc12"
 dependencies = [
  "async-recursion",
  "async-trait",
+ "aws-lc-rs",
  "bytes",
  "chrono",
  "dyn-clone",
@@ -11662,8 +11592,8 @@ dependencies = [
  "olpc-cjson",
  "pem",
  "percent-encoding",
- "reqwest 0.11.27",
- "ring 0.17.8",
+ "reqwest",
+ "rustls 0.23.14",
  "serde",
  "serde_json",
  "serde_plain",
@@ -11672,7 +11602,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "typed-path",
- "untrusted 0.9.0",
+ "untrusted 0.7.1",
  "url",
  "walkdir",
 ]
@@ -11841,7 +11771,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http",
  "httparse",
  "log",
  "rand",
@@ -11860,7 +11790,7 @@ dependencies = [
  "byteorder",
  "bytes",
  "data-encoding",
- "http 1.1.0",
+ "http",
  "httparse",
  "log",
  "rand",
@@ -11882,9 +11812,9 @@ dependencies = [
 
 [[package]]
 name = "typed-path"
-version = "0.7.1"
+version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "668404597c2c687647f6f8934f97c280fd500db28557f52b07c56b92d3dc500a"
+checksum = "82205ffd44a9697e34fc145491aa47310f9871540bb7909eaa9365e0a9a46607"
 
 [[package]]
 name = "typed-rng"
@@ -12513,7 +12443,7 @@ dependencies = [
  "owo-colors",
  "proptest",
  "ratatui",
- "reqwest 0.12.8",
+ "reqwest",
  "rpassword",
  "serde",
  "serde_json",
@@ -12612,10 +12542,10 @@ dependencies = [
  "gateway-test-utils",
  "hex",
  "hickory-resolver",
- "http 1.1.0",
+ "http",
  "http-body-util",
  "hubtools",
- "hyper 1.4.1",
+ "hyper",
  "illumos-utils",
  "installinator",
  "installinator-api",
@@ -12637,7 +12567,7 @@ dependencies = [
  "openapiv3",
  "oxnet",
  "rand",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -12693,7 +12623,7 @@ dependencies = [
  "omicron-workspace-hack",
  "progenitor",
  "regress 0.9.1",
- "reqwest 0.12.8",
+ "reqwest",
  "schemars",
  "serde",
  "serde_json",
@@ -13029,7 +12959,7 @@ dependencies = [
  "flate2",
  "futures",
  "omicron-workspace-hack",
- "reqwest 0.12.8",
+ "reqwest",
  "sha2",
  "slog",
  "slog-async",
diff --git a/Cargo.toml b/Cargo.toml
index 6168caee77..92f7240ca2 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -612,7 +612,7 @@ tokio-tungstenite = "0.23.1"
 tokio-util = { version = "0.7.12", features = ["io", "io-util"] }
 toml = "0.8.19"
 toml_edit = "0.22.22"
-tough = { version = "0.17.1", features = [ "http" ] }
+tough = { version = "0.19.0", features = [ "http" ] }
 trybuild = "1.0.100"
 tufaceous = { path = "tufaceous" }
 tufaceous-lib = { path = "tufaceous-lib" }
diff --git a/workspace-hack/Cargo.toml b/workspace-hack/Cargo.toml
index b3ab1d5ed5..27eca1b08e 100644
--- a/workspace-hack/Cargo.toml
+++ b/workspace-hack/Cargo.toml
@@ -20,6 +20,7 @@ workspace = true
 ahash = { version = "0.8.11" }
 aho-corasick = { version = "1.1.3" }
 anyhow = { version = "1.0.89", features = ["backtrace"] }
+aws-lc-rs = { version = "1.10.0", features = ["prebuilt-nasm"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 base64 = { version = "0.22.1" }
 base64ct = { version = "1.6.0", default-features = false, features = ["std"] }
@@ -99,6 +100,8 @@ regex-syntax = { version = "0.8.5" }
 reqwest = { version = "0.12.8", features = ["blocking", "cookies", "json", "rustls-tls", "stream"] }
 ring = { version = "0.17.8", features = ["std"] }
 rsa = { version = "0.9.6", features = ["serde", "sha2"] }
+rustls = { version = "0.23.14", features = ["ring"] }
+rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.21", features = ["bytes", "chrono", "uuid1"] }
 scopeguard = { version = "1.2.0" }
 semver = { version = "1.0.23", features = ["serde"] }
@@ -135,6 +138,7 @@ zeroize = { version = "1.8.1", features = ["std", "zeroize_derive"] }
 ahash = { version = "0.8.11" }
 aho-corasick = { version = "1.1.3" }
 anyhow = { version = "1.0.89", features = ["backtrace"] }
+aws-lc-rs = { version = "1.10.0", features = ["prebuilt-nasm"] }
 base16ct = { version = "0.2.0", default-features = false, features = ["alloc"] }
 base64 = { version = "0.22.1" }
 base64ct = { version = "1.6.0", default-features = false, features = ["std"] }
@@ -215,6 +219,8 @@ regex-syntax = { version = "0.8.5" }
 reqwest = { version = "0.12.8", features = ["blocking", "cookies", "json", "rustls-tls", "stream"] }
 ring = { version = "0.17.8", features = ["std"] }
 rsa = { version = "0.9.6", features = ["serde", "sha2"] }
+rustls = { version = "0.23.14", features = ["ring"] }
+rustls-webpki = { version = "0.102.8", default-features = false, features = ["aws_lc_rs", "ring", "std"] }
 schemars = { version = "0.8.21", features = ["bytes", "chrono", "uuid1"] }
 scopeguard = { version = "1.2.0" }
 semver = { version = "1.0.23", features = ["serde"] }
@@ -259,7 +265,6 @@ linux-raw-sys = { version = "0.4.14", default-features = false, features = ["elf
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-unknown-linux-gnu.build-dependencies]
@@ -271,7 +276,6 @@ linux-raw-sys = { version = "0.4.14", default-features = false, features = ["elf
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-apple-darwin.dependencies]
@@ -281,7 +285,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-apple-darwin.build-dependencies]
@@ -291,7 +294,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.aarch64-apple-darwin.dependencies]
@@ -301,7 +303,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.aarch64-apple-darwin.build-dependencies]
@@ -311,7 +312,6 @@ hyper-util = { version = "0.1.9", features = ["full"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 
 [target.x86_64-unknown-illumos.dependencies]
@@ -323,7 +323,6 @@ indicatif = { version = "0.17.8", features = ["rayon"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 toml_edit-cdcf2f9584511fe6 = { package = "toml_edit", version = "0.19.15", features = ["serde"] }
 
@@ -336,7 +335,6 @@ indicatif = { version = "0.17.8", features = ["rayon"] }
 mio = { version = "1.0.2", features = ["net", "os-ext"] }
 once_cell = { version = "1.20.2" }
 rustix = { version = "0.38.37", features = ["event", "fs", "net", "pipe", "process", "stdio", "system", "termios", "time"] }
-rustls = { version = "0.23.14", default-features = false, features = ["logging", "ring", "std", "tls12"] }
 tokio-rustls = { version = "0.26.0", default-features = false, features = ["logging", "ring", "tls12"] }
 toml_edit-cdcf2f9584511fe6 = { package = "toml_edit", version = "0.19.15", features = ["serde"] }