diff --git a/Cargo.lock b/Cargo.lock
index dd559af..8eb8555 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4145,6 +4145,7 @@ version = "0.23.34"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6a9586e9ee2b4f8fab52a0048ca7334d7024eef48e2cb9407e3497bb7cab7fa7"
 dependencies = [
+ "aws-lc-rs",
  "log",
  "once_cell",
  "ring",
@@ -4218,6 +4219,7 @@ version = "0.103.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
 dependencies = [
+ "aws-lc-rs",
  "ring",
  "rustls-pki-types",
  "untrusted 0.9.0",
diff --git a/Cargo.toml b/Cargo.toml
index d6dcfc7..d9f1bb7 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -13,7 +13,9 @@ keywords = ["attested-TLS", "CVM", "TDX"]
 [dependencies]
 attested-tls = { path = "attested-tls", default-features = false }
 tokio = { version = "1.48.0", features = ["full"] }
-tokio-rustls = { version = "0.26.4", default-features = false }
+tokio-rustls = { version = "0.26.4", default-features = false, features = [
+  "aws_lc_rs",
+] }
 x509-parser = { version = "0.18.0", features = ["verify"] }
 thiserror = "2.0.17"
 clap = { version = "4.5.51", features = ["derive", "env"] }
diff --git a/attested-tls/src/test_helpers.rs b/attested-tls/src/test_helpers.rs
index 9b218a3..10db286 100644
--- a/attested-tls/src/test_helpers.rs
+++ b/attested-tls/src/test_helpers.rs
@@ -14,6 +14,8 @@ pub use attestation::measurements::mock_dcap_measurements;
 pub fn generate_certificate_chain(
     ip: IpAddr,
 ) -> (Vec<CertificateDer<'static>>, PrivateKeyDer<'static>) {
+    let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();
+
     let mut params = rcgen::CertificateParams::new(vec![]).unwrap();
     params.subject_alt_names.push(rcgen::SanType::IpAddress(ip));
     params
diff --git a/src/main.rs b/src/main.rs
index 05eb64d..449fe69 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -174,6 +174,10 @@ enum CliCommand {
 
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
+    tokio_rustls::rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .map_err(|_| anyhow!("Failed to install the default rustls crypto provider"))?;
+
     let cli = Cli::parse();
 
     ensure!(
diff --git a/src/self_signed.rs b/src/self_signed.rs
index e41e826..309803f 100644
--- a/src/self_signed.rs
+++ b/src/self_signed.rs
@@ -210,6 +210,8 @@ mod tests {
 
     #[tokio::test]
     async fn self_signed_server_attestation() {
+        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+
         let cert_and_key = generate_self_signed_cert("127.0.0.1".parse().unwrap()).unwrap();
 
         let server_config = rustls::ServerConfig::builder()
diff --git a/src/test_helpers.rs b/src/test_helpers.rs
index 0ebde29..cb6e79c 100644
--- a/src/test_helpers.rs
+++ b/src/test_helpers.rs
@@ -22,6 +22,8 @@ pub use attested_tls::attestation::measurements::mock_dcap_measurements;
 pub fn generate_certificate_chain(
     ip: IpAddr,
 ) -> (Vec<CertificateDer<'static>>, PrivateKeyDer<'static>) {
+    let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();
+
     let mut params = rcgen::CertificateParams::new(vec![]).unwrap();
     params.subject_alt_names.push(rcgen::SanType::IpAddress(ip));
     params