diff --git a/Cargo.lock b/Cargo.lock
index 5e67885..e5c370a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -432,6 +432,7 @@ dependencies = [
  "tracing-subscriber",
  "typed-builder",
  "url",
+ "webpki-roots",
 ]
 
 [[package]]
@@ -2976,6 +2977,15 @@ dependencies = [
  "rustls-pki-types",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "1.0.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dcd9d09a39985f5344844e66b0c530a33843579125f23e21e9f0f220850f22a"
+dependencies = [
+ "rustls-pki-types",
+]
+
 [[package]]
 name = "widestring"
 version = "1.2.1"
diff --git a/Cargo.toml b/Cargo.toml
index 5c2704a..9c41469 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,3 +28,4 @@ tracing = "0.1.44"
 tracing-subscriber = { version = "0.3.23", features = ["env-filter"] }
 typed-builder = "0.23.2"
 url = "2.5.8"
+webpki-roots = "1.0.9"
diff --git a/src/server.rs b/src/server.rs
index a799d60..0c25567 100644
--- a/src/server.rs
+++ b/src/server.rs
@@ -15,6 +15,7 @@ use headers::authorization::Bearer;
 use mitsein::vec1::Vec1;
 use rand::Rng;
 use rand::RngExt;
+use reqwest::Certificate;
 use secrecy::ExposeSecret;
 use secrecy::SecretString;
 use serde::Deserialize;
@@ -367,7 +368,16 @@ async fn create_chat_completion(
             web_search_options,
         };
 
-        let client = reqwest::Client::new();
+        let client = reqwest::Client::builder()
+            .tls_certs_only(
+                webpki_roots::TLS_SERVER_ROOTS
+                    .iter()
+                    .filter_map(|trust_anchor| {
+                        Certificate::from_der(trust_anchor.subject.as_ref()).ok()
+                    }),
+            )
+            .build()
+            .expect("TODO");
 
         let mut upstream_request = client
             .post({