diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock
index 9feecbee01..cba984613f 100644
--- a/desktop/src-tauri/Cargo.lock
+++ b/desktop/src-tauri/Cargo.lock
@@ -10921,11 +10921,11 @@ dependencies = [
  "futures-util",
  "log",
  "rustls",
+ "rustls-native-certs",
  "rustls-pki-types",
  "tokio",
  "tokio-rustls",
  "tungstenite 0.29.0",
- "webpki-roots 0.26.11",
 ]
 
 [[package]]
diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml
index fd58f27878..16f8b2f700 100644
--- a/desktop/src-tauri/Cargo.toml
+++ b/desktop/src-tauri/Cargo.toml
@@ -77,7 +77,9 @@ infer = "0.19"
 hex = "0.4"
 ed25519-dalek = "=3.0.0-rc.0"
 tokio = { version = "1", features = ["fs", "sync", "rt", "macros", "time", "net", "io-util"] }
-tokio-tungstenite = { version = "0.29", features = ["rustls-tls-webpki-roots"] }
+# Match reqwest's platform trust behavior so native WebSockets can reach
+# relays secured by an OS-trusted private CA.
+tokio-tungstenite = { version = "0.29", features = ["rustls-tls-native-roots"] }
 tokio-util = { version = "0.7", features = ["rt"] }
 bytes = "1"
 futures-util = "0.3"
diff --git a/desktop/src-tauri/src/native_websocket.rs b/desktop/src-tauri/src/native_websocket.rs
index 128f2df79d..e714f0a75d 100644
--- a/desktop/src-tauri/src/native_websocket.rs
+++ b/desktop/src-tauri/src/native_websocket.rs
@@ -349,6 +349,22 @@ mod tests {
         Channel::new(|_: InvokeResponseBody| Ok(()))
     }
 
+    #[tokio::test]
+    #[ignore = "requires BUZZ_TEST_WSS_URL and network access"]
+    async fn configured_wss_trusts_native_platform_roots() {
+        install_crypto_provider();
+        let url = std::env::var("BUZZ_TEST_WSS_URL")
+            .expect("BUZZ_TEST_WSS_URL must name the WSS endpoint to verify");
+
+        tokio::time::timeout(
+            CONNECT_TIMEOUT,
+            tokio_tungstenite::connect_async(url.as_str()),
+        )
+        .await
+        .expect("configured WSS endpoint should complete before the connection timeout")
+        .expect("configured WSS endpoint should trust the platform certificate store");
+    }
+
     #[tokio::test]
     async fn secure_websocket_reaches_tls_without_panicking() {
         install_crypto_provider();