diff --git a/Cargo.lock b/Cargo.lock
index 3b60dc4579..1ba3e0e1ef 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1046,6 +1046,7 @@ dependencies = [
  "futures-util",
  "hex",
  "nostr",
+ "rustls",
  "serde_json",
  "thiserror 2.0.18",
  "tokio",
diff --git a/crates/buzz-pairing-cli/Cargo.toml b/crates/buzz-pairing-cli/Cargo.toml
index 58fefe32d9..4a4bee7d41 100644
--- a/crates/buzz-pairing-cli/Cargo.toml
+++ b/crates/buzz-pairing-cli/Cargo.toml
@@ -23,3 +23,7 @@ hex = { workspace = true }
 clap = { version = "4", features = ["derive", "env"] }
 thiserror = { workspace = true }
 zeroize = { workspace = true }
+
+# Explicit provider selection is required when workspace feature unification
+# compiles both rustls providers into the standalone pairing binary.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
diff --git a/crates/buzz-pairing-cli/src/main.rs b/crates/buzz-pairing-cli/src/main.rs
index 1eb9d215f9..adbaffa43f 100644
--- a/crates/buzz-pairing-cli/src/main.rs
+++ b/crates/buzz-pairing-cli/src/main.rs
@@ -96,6 +96,10 @@ enum CliError {
 
 #[tokio::main]
 async fn main() {
+    // Workspace feature unification can compile both rustls providers. Choose
+    // one before the first WSS connection so rustls does not panic at runtime.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     let cli = Cli::parse();
     if let Err(e) = run(cli.command).await {
         eprintln!("error: {e}");