diff --git a/crates/tranquil-oauth/Cargo.toml b/crates/tranquil-oauth/Cargo.toml
index cb12b9e..5194281 100644
--- a/crates/tranquil-oauth/Cargo.toml
+++ b/crates/tranquil-oauth/Cargo.toml
@@ -23,3 +23,6 @@ sha2 = { workspace = true }
 tokio = { workspace = true }
 tracing = { workspace = true }
 uuid = { workspace = true }
+
+[features]
+native-tls-roots = []
diff --git a/crates/tranquil-oauth/src/client.rs b/crates/tranquil-oauth/src/client.rs
index 7b81778..1e84e73 100644
--- a/crates/tranquil-oauth/src/client.rs
+++ b/crates/tranquil-oauth/src/client.rs
@@ -78,18 +78,21 @@ impl ClientMetadataCache {
         Self {
             cache: Arc::new(RwLock::new(HashMap::new())),
             jwks_cache: Arc::new(RwLock::new(HashMap::new())),
-            http_client: Client::builder()
-                .timeout(std::time::Duration::from_secs(30))
-                .connect_timeout(std::time::Duration::from_secs(10))
-                .pool_max_idle_per_host(10)
-                .pool_idle_timeout(std::time::Duration::from_secs(90))
-                .user_agent(concat!(
-                    "Tranquil-PDS/",
-                    env!("CARGO_PKG_VERSION"),
-                    " (ATProto; +https://tangled.org/tranquil.farm/tranquil-pds)"
-                ))
-                .build()
-                .unwrap_or_else(|_| Client::new()),
+            http_client: {
+                let builder = Client::builder()
+                    .timeout(std::time::Duration::from_secs(30))
+                    .connect_timeout(std::time::Duration::from_secs(10))
+                    .pool_max_idle_per_host(10)
+                    .pool_idle_timeout(std::time::Duration::from_secs(90))
+                    .user_agent(concat!(
+                        "Tranquil-PDS/",
+                        env!("CARGO_PKG_VERSION"),
+                        " (ATProto; +https://tangled.org/tranquil.farm/tranquil-pds)"
+                    ));
+                #[cfg(feature = "native-tls-roots")]
+                let builder = builder.danger_accept_invalid_certs(true);
+                builder.build().unwrap_or_else(|_| Client::new())
+            },
             cache_ttl_secs,
         }
     }
diff --git a/crates/tranquil-pds/Cargo.toml b/crates/tranquil-pds/Cargo.toml
index 912ec53..f9dea76 100644
--- a/crates/tranquil-pds/Cargo.toml
+++ b/crates/tranquil-pds/Cargo.toml
@@ -91,6 +91,7 @@ s3-storage = ["tranquil-storage/s3", "dep:aws-config", "dep:aws-sdk-s3"]
 s3 = ["s3-storage"]
 valkey = ["tranquil-cache/valkey", "dep:redis"]
 frontend = []
+native-tls-roots = ["tranquil-oauth/native-tls-roots"]
 
 [dev-dependencies]
 ciborium = { workspace = true }
diff --git a/crates/tranquil-server/Cargo.toml b/crates/tranquil-server/Cargo.toml
index 4db89a5..40cf0f3 100644
--- a/crates/tranquil-server/Cargo.toml
+++ b/crates/tranquil-server/Cargo.toml
@@ -27,3 +27,4 @@ default = ["frontend", "s3", "valkey"]
 frontend = ["tranquil-pds/frontend"]
 s3 = ["tranquil-pds/s3"]
 valkey = ["tranquil-pds/valkey"]
+native-tls-roots = ["tranquil-pds/native-tls-roots"]