diff --git a/rust/tls/Cargo.toml b/rust/tls/Cargo.toml
new file mode 100644
index 0000000..4b903a2
--- /dev/null
+++ b/rust/tls/Cargo.toml
@@ -0,0 +1,14 @@
+[package]
+name = "tls"
+version = "0.1.0"
+edition = "2024"
+description = "Shared AWS-LC TLS provider initialization"
+license = "MIT"
+publish = false
+
+[dependencies]
+anyhow.workspace = true
+rustls.workspace = true
+
+[lints]
+workspace = true
diff --git a/rust/tls/src/lib.rs b/rust/tls/src/lib.rs
new file mode 100644
index 0000000..d78c391
--- /dev/null
+++ b/rust/tls/src/lib.rs
@@ -0,0 +1,16 @@
+//! Shared TLS configuration for workspace applications.
+
+use anyhow::{Result, anyhow};
+
+/// Install AWS-LC as the process-wide default TLS crypto provider.
+///
+/// Call once at startup, before creating HTTP clients.
+///
+/// # Errors
+///
+/// Returns an error if a TLS crypto provider has already been initialized.
+pub fn install_tls_provider() -> Result<()> {
+    rustls::crypto::aws_lc_rs::default_provider()
+        .install_default()
+        .map_err(|_| anyhow!("TLS crypto provider was already initialized"))
+}
diff --git a/rust/van_weather/Cargo.toml b/rust/van_weather/Cargo.toml
index 0f06717..e5e7d1a 100644
--- a/rust/van_weather/Cargo.toml
+++ b/rust/van_weather/Cargo.toml
@@ -12,9 +12,10 @@ clap = { workspace = true, features = ["derive", "env"] }
 env_logger.workspace = true
 log.workspace = true
 num-traits = "0.2"
-reqwest = { version = "0.12", default-features = false, features = ["blocking", "json", "rustls-tls"] }
+reqwest = { workspace = true, features = ["blocking", "json"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json.workspace = true
+tls.workspace = true
 
 [lints]
 workspace = true
diff --git a/rust/van_weather/src/main.rs b/rust/van_weather/src/main.rs
index 0c83068..ea9949b 100644
--- a/rust/van_weather/src/main.rs
+++ b/rust/van_weather/src/main.rs
@@ -13,6 +13,7 @@ use reqwest::{
 };
 use serde::Deserialize;
 use serde_json::{Value, json};
+use tls::install_tls_provider;
 
 const LAT_ENTITY: &str = "sensor.van_last_known_latitude";
 const LON_ENTITY: &str = "sensor.van_last_known_longitude";
@@ -159,6 +160,7 @@ fn main() -> Result<()> {
     } = Args::parse();
     env_logger::Builder::from_env(env_logger::Env::default().default_filter_or(log_level.as_str()))
         .init();
+    install_tls_provider()?;
 
     let ha_url = ha_url.trim_end_matches('/').to_owned();
     let ha_host = Url::parse(&ha_url)
@@ -494,6 +496,14 @@ fn percent(value: Option<f64>) -> i64 {
 mod tests {
     use super::*;
 
+    #[test]
+    fn builds_http_clients_with_aws_lc() -> Result<()> {
+        install_tls_provider()?;
+        build_client("home-assistant.example", Some("test-token"))?;
+        build_client(PIRATE_WEATHER_HOST, None)?;
+        Ok(())
+    }
+
     #[test]
     fn maps_conditions_for_home_assistant() {
         assert_eq!(condition(Some("clear-day")), "sunny");