diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2a44f93..7f4a6a3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -101,6 +101,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     if: ${{ !cancelled() }}
+    permissions:
+      contents: write
     steps:
       - uses: actions/download-artifact@v4
         with:
diff --git a/Cargo.toml b/Cargo.toml
index f467c62..ff0d188 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name = "eullm-agent"
-version = "0.1.2"
+version = "0.1.4"
 edition = "2021"
 license = "Apache-2.0"
 description = "EULLM Agent — autonomous ReAct agent with multi-provider LLM support"
@@ -16,16 +16,16 @@ clap = { version = "4", features = ["derive", "env"] }
 # Async runtime
 tokio = { version = "1", features = ["full"] }
 
-# HTTP
-reqwest = { version = "0.12", features = ["json"] }
+# HTTP — rustls-tls: pure Rust TLS, no system OpenSSL required on any platform
+reqwest = { version = "0.12", default-features = false, features = ["json", "rustls-tls"] }
 
 # Serialization
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_yaml = "0.9"
 
-# Telegram bot
-teloxide = { version = "0.12", features = ["macros"] }
+# Telegram bot — rustls: pure Rust TLS, mirrors reqwest above
+teloxide = { version = "0.12", default-features = false, features = ["macros", "rustls", "auto-send", "ctrlc_handler"] }
 
 # Error handling
 anyhow = "1"
@@ -37,11 +37,5 @@ async-trait = "0.1"
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 
-# Vendored OpenSSL: compiles from source, no system libssl required.
-# Required for cross-compilation to aarch64-unknown-linux-gnu (cross container
-# uses Ubuntu Xenial which only provides OpenSSL 1.0.2g, incompatible with
-# openssl-sys v0.9.x which requires >=1.1.0).
-openssl = { version = "0.10", features = ["vendored"] }
-
 [dev-dependencies]
 tokio-test = "0.4"
diff --git a/Cross.toml b/Cross.toml
index 1c0cf87..3806fce 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -1 +1,2 @@
+# Cross.toml — no pre-build hooks needed: rustls is pure Rust, no system OpenSSL required.
 [target.aarch64-unknown-linux-gnu]