diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f9407b7..56c6d7c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,6 +65,8 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
           echo "CARGO_TARGET_AARCH64_UNKNOWN_LINUX_GNU_LINKER=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+          echo "CC_aarch64_unknown_linux_gnu=aarch64-linux-gnu-gcc" >> "$GITHUB_ENV"
+          echo "AR_aarch64_unknown_linux_gnu=aarch64-linux-gnu-ar" >> "$GITHUB_ENV"
 
       - name: Build release binary
         run: cargo build --release --target ${{ matrix.target }} -p tinycloud-node
diff --git a/Cargo.lock b/Cargo.lock
index 7225bc3..8d9aad9 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -9250,6 +9250,7 @@ dependencies = [
  "hmac",
  "hyper 0.14.32",
  "lazy_static",
+ "native-tls",
  "opentelemetry",
  "opentelemetry-otlp",
  "opentelemetry_sdk",
diff --git a/tinycloud-node-server/Cargo.toml b/tinycloud-node-server/Cargo.toml
index d101eaa..db09365 100644
--- a/tinycloud-node-server/Cargo.toml
+++ b/tinycloud-node-server/Cargo.toml
@@ -52,6 +52,11 @@ tracing-log = "0.2"
 tracing-opentelemetry = "0.30"
 tracing-subscriber = { version = "0.3.20", features = ["env-filter", "json"] }
 
+[target.'cfg(all(target_os = "linux", target_arch = "aarch64"))'.dependencies]
+# Release builds cross-compile aarch64 Linux from x86_64 Linux. Vendoring
+# OpenSSL avoids needing target OpenSSL headers/libs in the runner image.
+native-tls = { version = "0.2.14", features = ["vendored"] }
+
 [dependencies.tinycloud-core]
 path = "../tinycloud-core/"
 default-features = false