diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b023904..55e5cf4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,9 +15,10 @@ jobs:
     strategy:
       matrix:
         include:
-          - target: x86_64-unknown-linux-gnu
+          - target: x86_64-unknown-linux-musl
             os: ubuntu-latest
-          - target: aarch64-unknown-linux-gnu
+            cross: true
+          - target: aarch64-unknown-linux-musl
             os: ubuntu-latest
             cross: true
           - target: aarch64-apple-darwin
@@ -34,17 +35,10 @@ jobs:
         if: matrix.cross
         run: cargo install cross --git https://github.com/cross-rs/cross
 
-      - name: Install OpenSSL (native Linux)
-        if: runner.os == 'Linux' && !matrix.cross
-        run: sudo apt-get update && sudo apt-get install -y libssl-dev pkg-config
-
       - name: Build
         run: |
           if [ "${{ matrix.cross }}" = "true" ]; then
-            OPENSSL_STATIC=1 \
-            OPENSSL_INCLUDE_DIR=/usr/include/aarch64-linux-gnu \
-            OPENSSL_LIB_DIR=/usr/lib/aarch64-linux-gnu \
-            cross build --release --target ${{ matrix.target }}
+            cross build --release --target ${{ matrix.target }} --features vendored-openssl
           else
             cargo build --release --target ${{ matrix.target }}
           fi
diff --git a/Cargo.lock b/Cargo.lock
index 9ea2a30..049ef95 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -286,6 +286,7 @@ dependencies = [
  "assert_cmd",
  "clap",
  "git2",
+ "openssl-sys",
  "predicates",
  "serde",
  "serde_json",
@@ -565,6 +566,15 @@ version = "0.1.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d05e27ee213611ffe7d6348b942e8f942b37114c00cc03cec254295a4a17852e"
 
+[[package]]
+name = "openssl-src"
+version = "300.5.5+3.5.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "3f1787d533e03597a7934fd0a765f0d28e94ecc5fb7789f8053b1e699a56f709"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.112"
@@ -573,6 +583,7 @@ checksum = "57d55af3b3e226502be1526dfdba67ab0e9c96fc293004e79576b2b9edb0dbdb"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 2d035f5..e17a6fe 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -5,13 +5,17 @@ edition = "2024"
 description = "Git hunk sifter for code agents"
 license = "MIT"
 
+[features]
+vendored-openssl = ["openssl-sys"]
+
 [dependencies]
-git2       = "0.19"
-clap       = { version = "4", features = ["derive"] }
-serde      = { version = "1", features = ["derive"] }
-serde_json = "1"
-anyhow     = "1"
-similar    = { version = "2", features = ["text"] }
+git2        = "0.19"
+openssl-sys = { version = "0.9", features = ["vendored"], optional = true }
+clap        = { version = "4", features = ["derive"] }
+serde       = { version = "1", features = ["derive"] }
+serde_json  = "1"
+anyhow      = "1"
+similar     = { version = "2", features = ["text"] }
 
 [dev-dependencies]
 assert_cmd = "2"
diff --git a/Cross.toml b/Cross.toml
index fb8217a..bc12457 100644
--- a/Cross.toml
+++ b/Cross.toml
@@ -1,11 +1,3 @@
-[target.aarch64-unknown-linux-gnu]
-pre-build = [
-    "dpkg --add-architecture arm64",
-    "apt-get update && apt-get install -y libssl-dev:arm64"
-]
+[target.x86_64-unknown-linux-musl]
 
-[target.aarch64-unknown-linux-gnu.env]
-passthrough = [
-    "OPENSSL_INCLUDE_DIR",
-    "OPENSSL_LIB_DIR",
-]
+[target.aarch64-unknown-linux-musl]