diff --git a/dstack/Cargo.lock b/dstack/Cargo.lock
index 31a97f389..9d27c2c6b 100644
--- a/dstack/Cargo.lock
+++ b/dstack/Cargo.lock
@@ -337,9 +337,9 @@ checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
-version = "1.17.0"
+version = "1.18.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5ec2f1fc3ec205783a5da9a7e6c1509cc69dedf09a1949e412c1e18469326d00"
+checksum = "faac5829c2b74c28f830747e7818ccfb684261b5f48a1118b1e2a13d36dfab13"
 dependencies = [
  "aws-lc-sys",
  "untrusted 0.7.1",
@@ -348,14 +348,15 @@ dependencies = [
 
 [[package]]
 name = "aws-lc-sys"
-version = "0.41.0"
+version = "0.46.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a2f9779ce85b93ab6170dd940ad0169b5766ff848247aff13bb788b832fe3f4"
+checksum = "f1622d8446a2d4b2ce0c7eefc73dd43a99779028d5ee5c2dd8073a658ba8a2bc"
 dependencies = [
  "cc",
  "cmake",
  "dunce",
  "fs_extra",
+ "pkg-config",
 ]
 
 [[package]]
@@ -5416,6 +5417,12 @@ dependencies = [
  "spki",
 ]
 
+[[package]]
+name = "pkg-config"
+version = "0.3.34"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6b464fbc74e149a392436b17d523f769e057cb6877f6a5c4618bc6f11800548"
+
 [[package]]
 name = "pki-fetch"
 version = "0.6.1"
@@ -6578,9 +6585,9 @@ checksum = "f87165f0995f63a9fbeea62b64d10b4d9d8e78ec6d7d51fb2125fda7bb36788f"
 
 [[package]]
 name = "rustls-webpki"
-version = "0.103.13"
+version = "0.103.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "61c429a8649f110dddef65e2a5ad240f747e85f7758a6bccc7e5777bd33f756e"
+checksum = "4443b1b6d39d7c663139942cc4558262562d2c84123bb6282ef177009ca8b281"
 dependencies = [
  "aws-lc-rs",
  "ring",
@@ -8673,9 +8680,9 @@ dependencies = [
 
 [[package]]
 name = "webpki-root-certs"
-version = "1.0.8"
+version = "1.0.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0d46a5a140e6f7afeccd8eae97eff335163939eac8b929834875168b29b3d267"
+checksum = "58ec80e73fd8baf57bf0d9615554c75348bda990d6d5bbeab964dd068319fecb"
 dependencies = [
  "rustls-pki-types",
 ]
diff --git a/dstack/Cargo.toml b/dstack/Cargo.toml
index 8877f6296..031855f4e 100644
--- a/dstack/Cargo.toml
+++ b/dstack/Cargo.toml
@@ -247,7 +247,7 @@ rsa = "0.9"
 ring = "0.17.14"
 rustls = "0.23.23"
 rustls-pki-types = "1.13.1"
-rustls-webpki = "0.103.10"
+rustls-webpki = "0.103.16"
 schnorrkel = "0.11.4"
 sha2 = { version = "0.10.8", default-features = false }
 sha3 = "0.10.8"
diff --git a/dstack/ra-rpc/tests/ratls_client_auth.rs b/dstack/ra-rpc/tests/ratls_client_auth.rs
index 9719c508c..3e60d10a1 100644
--- a/dstack/ra-rpc/tests/ratls_client_auth.rs
+++ b/dstack/ra-rpc/tests/ratls_client_auth.rs
@@ -181,9 +181,14 @@ async fn client_certs_are_authenticated_by_attestation_not_issuer() {
     let err = probe(port, Some(&no_attestation))
         .await
         .expect_err("cert without attestation must be rejected");
+    let err_text = format!("{err:#}");
+    // rustls usually surfaces HandshakeFailure. Under aws-lc-rs 1.18 the server
+    // may close the TCP connection instead, and reqwest then reports Canceled.
     assert!(
-        format!("{err:#}").contains("HandshakeFailure"),
-        "expected the handshake to be refused, got: {err:#}"
+        err_text.contains("HandshakeFailure")
+            || err_text.contains("Canceled")
+            || err_text.contains("connection was not ready"),
+        "expected the handshake to be refused, got: {err_text}"
     );
 
     // Anonymous connections still work, so unauthenticated RPCs stay reachable.