diff --git a/Cargo.toml b/Cargo.toml
index 69be996..f57e288 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -93,13 +93,6 @@ bytes = "1.11.0"
 hyper-socks2 = "0.9.1"
 hyper-proxy2 = "0.1.0"
 hyper-tls = "0.6.0"
-## native-tls (via hyper-tls) uses OpenSSL on Linux/Android. Upstream Grim got a
-## vendored, statically-linked OpenSSL for free through arti's `static` feature;
-## dropping arti for Nym took that with it, breaking Android/cross builds (no
-## system OpenSSL for the target) and leaving desktop dynamically linked to
-## libssl. Restore the vendored build so every target is self-contained. Inert on
-## Windows/macOS, which use SChannel / Security.framework instead of OpenSSL.
-openssl = { version = "0.10", features = ["vendored"] }
 async-std = "1.13.2"
 uuid = { version = "0.8.2", features = ["v4"] }
 num-bigint = "0.4.6"
@@ -156,6 +149,18 @@ arboard = "3.2.0"
 rfd = "0.17.2"
 interprocess = { version = "2.2.1", features = ["tokio"] }
 
+## native-tls (via hyper-tls) uses OpenSSL only on Linux/Android. Upstream Grim
+## got a vendored, statically-linked OpenSSL for free through arti's `static`
+## feature; dropping arti for Nym took that with it, breaking Android/cross
+## builds (no system OpenSSL for the target) and leaving desktop dynamically
+## linked to libssl. Restore the vendored build for exactly those two targets so
+## each is self-contained. Windows (SChannel) and macOS (Security.framework)
+## don't use OpenSSL at all, so they must NOT pull it — building openssl-src
+## there is both pointless and fragile (the Windows MSVC runner's bash perl is
+## missing modules its Configure needs).
+[target.'cfg(any(target_os = "linux", target_os = "android"))'.dependencies]
+openssl = { version = "0.10", features = ["vendored"] }
+
 [target.'cfg(target_os = "android")'.dependencies]
 android_logger = "0.15.0"
 jni = "0.21.1"