diff --git a/Cargo.lock b/Cargo.lock
index ae298c6fef..15b190f8ae 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1346,6 +1346,7 @@ dependencies = [
  "futures-util",
  "hex",
  "nostr 0.44.7",
+ "rustls",
  "serde_json",
  "thiserror 2.0.18",
  "tokio",
diff --git a/crates/buzz-pairing-cli/Cargo.toml b/crates/buzz-pairing-cli/Cargo.toml
index 58fefe32d9..d5ca12185a 100644
--- a/crates/buzz-pairing-cli/Cargo.toml
+++ b/crates/buzz-pairing-cli/Cargo.toml
@@ -23,3 +23,10 @@ hex = { workspace = true }
 clap = { version = "4", features = ["derive", "env"] }
 thiserror = { workspace = true }
 zeroize = { workspace = true }
+
+# Explicit rustls dep with ring provider — required to install the process-level
+# CryptoProvider at startup. Without this, `buzz-pair` panics on any `wss://`
+# relay (including the default `wss://relay.damus.io`) when a multi-package
+# release build unifies both ring and aws-lc-rs features. See crates/buzz-cli.
+rustls = { version = "0.23", default-features = false, features = ["ring", "std"] }
+
diff --git a/crates/buzz-pairing-cli/src/main.rs b/crates/buzz-pairing-cli/src/main.rs
index 1eb9d215f9..ca14ecebe9 100644
--- a/crates/buzz-pairing-cli/src/main.rs
+++ b/crates/buzz-pairing-cli/src/main.rs
@@ -96,6 +96,14 @@ enum CliError {
 
 #[tokio::main]
 async fn main() {
+    // Install ring as the process-level rustls CryptoProvider before any WSS
+    // connection. The documented default relay is `wss://relay.damus.io`, and a
+    // multi-package release build unifies both ring and aws-lc-rs across the
+    // workspace, so rustls cannot auto-select a provider. Without this,
+    // `buzz-pair source` panics at rustls crypto/mod.rs after printing the QR.
+    // The `let _ =` swallow is intentional: a second install returns Err.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+
     let cli = Cli::parse();
     if let Err(e) = run(cli.command).await {
         eprintln!("error: {e}");