diff --git a/Cargo.lock b/Cargo.lock
index c9ef8465..318718b6 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1070,6 +1070,7 @@ dependencies = [
  "aes-gcm-siv",
  "ahash",
  "arc-swap",
+ "aws-lc-rs",
  "base64 0.22.1",
  "bincode 2.0.1",
  "biscuit",
@@ -4075,6 +4076,7 @@ dependencies = [
 name = "mail-auth"
 version = "0.8.0"
 dependencies = [
+ "aws-lc-rs",
  "flate2",
  "hashify",
  "hickory-resolver",
@@ -4082,7 +4084,6 @@ dependencies = [
  "mail-parser",
  "quick-xml 0.39.2",
  "rand 0.8.5",
- "ring",
  "rkyv",
  "rsa",
  "rustls-pki-types",
@@ -7365,6 +7366,7 @@ version = "0.16.0"
 dependencies = [
  "ahash",
  "arc-swap",
+ "aws-lc-rs",
  "azure_core",
  "azure_storage",
  "azure_storage_blobs",
@@ -7394,7 +7396,6 @@ dependencies = [
  "regex",
  "registry",
  "reqwest 0.13.2",
- "ring",
  "rkyv",
  "roaring",
  "rocksdb",
@@ -7541,6 +7542,7 @@ version = "0.16.0"
 dependencies = [
  "ahash",
  "async-trait",
+ "aws-lc-rs",
  "base64 0.22.1",
  "biscuit",
  "bytes",
@@ -7584,7 +7586,6 @@ dependencies = [
  "rayon",
  "registry",
  "reqwest 0.13.2",
- "ring",
  "rkyv",
  "rustls 0.23.37",
  "rustls-pemfile",
@@ -8349,6 +8350,7 @@ version = "0.16.0"
 dependencies = [
  "ahash",
  "arcstr",
+ "aws-lc-rs",
  "base64 0.22.1",
  "blake3",
  "chrono",
@@ -8369,7 +8371,6 @@ dependencies = [
  "rcgen",
  "regex",
  "reqwest 0.13.2",
- "ring",
  "rkyv",
  "rustls 0.23.37",
  "rustls-pemfile",
diff --git a/crates/common/Cargo.toml b/crates/common/Cargo.toml
index 376e12e8..13e22783 100644
--- a/crates/common/Cargo.toml
+++ b/crates/common/Cargo.toml
@@ -30,6 +30,7 @@ arc-swap = "1.6.0"
 rustls = { version = "0.23.5", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
 rustls-pemfile = "2.0"
 rustls-pki-types = { version = "1" }
+aws-lc-rs = { version = "1" }
 ring = { version = "0.17" }
 tokio = { version = "1.47", features = ["net", "macros"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }
diff --git a/crates/common/src/config/server/listener.rs b/crates/common/src/config/server/listener.rs
index a966c825..0403b214 100644
--- a/crates/common/src/config/server/listener.rs
+++ b/crates/common/src/config/server/listener.rs
@@ -18,7 +18,7 @@ use registry::schema::{
 };
 use rustls::{
     ALL_VERSIONS, ServerConfig, SupportedCipherSuite,
-    crypto::ring::{ALL_CIPHER_SUITES, cipher_suite::*, default_provider},
+    crypto::aws_lc_rs::{ALL_CIPHER_SUITES, cipher_suite::*, default_provider},
 };
 use std::sync::Arc;
 use store::registry::{RegistryObject, bootstrap::Bootstrap};
diff --git a/crates/common/src/config/server/tls.rs b/crates/common/src/config/server/tls.rs
index ec19db3f..da48a34b 100644
--- a/crates/common/src/config/server/tls.rs
+++ b/crates/common/src/config/server/tls.rs
@@ -12,7 +12,7 @@ use registry::schema::{
 };
 use rustls::{
     SupportedProtocolVersion,
-    crypto::ring::sign::any_supported_type,
+    crypto::aws_lc_rs::sign::any_supported_type,
     sign::CertifiedKey,
     version::{TLS12, TLS13},
 };
diff --git a/crates/common/src/enterprise/license.rs b/crates/common/src/enterprise/license.rs
index 29c026af..c10944a7 100644
--- a/crates/common/src/enterprise/license.rs
+++ b/crates/common/src/enterprise/license.rs
@@ -22,7 +22,7 @@
 use crate::manager::fetch_resource;
 use base64::{Engine, engine::general_purpose::STANDARD};
 use hyper::{HeaderMap, header::AUTHORIZATION};
-use ring::signature::{ED25519, UnparsedPublicKey};
+use aws_lc_rs::signature::{ED25519, UnparsedPublicKey};
 use std::{
     fmt::{Display, Formatter},
     time::Duration,
diff --git a/crates/common/src/manager/defaults.rs b/crates/common/src/manager/defaults.rs
index a8a9c057..28373fcc 100644
--- a/crates/common/src/manager/defaults.rs
+++ b/crates/common/src/manager/defaults.rs
@@ -13,6 +13,10 @@ use registry::{
     },
     types::{duration::Duration, error::Error, list::List, map::Map},
 };
+use aws_lc_rs::{
+    rand::SystemRandom,
+    signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair},
+};
 use std::str::FromStr;
 use store::{
     rand::{Rng, distr::Alphanumeric, rng},
@@ -289,7 +293,16 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
     }
 
     if bp.registry.count_object(ObjectType::OidcProvider).await? == 0 {
-        let todo = "use asymmetric keys";
+        let pkcs8_doc =
+            EcdsaKeyPair::generate_pkcs8(&ECDSA_P256_SHA256_FIXED_SIGNING, &SystemRandom::new())
+                .map_err(|err| {
+                    trc::EventType::Server(trc::ServerEvent::Startup)
+                        .into_err()
+                        .reason(err)
+                        .caused_by(trc::location!())
+                })?;
+        let signature_pem = pem::encode(&pem::Pem::new("PRIVATE KEY", pkcs8_doc.as_ref()));
+
         bp.registry
             .write(RegistryWrite::insert(
                 &OidcProvider {
@@ -301,12 +314,9 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
                             .collect::<String>(),
                     }),
                     signature_key: SecretText::Text(SecretTextValue {
-                        secret: rng()
-                            .sample_iter(Alphanumeric)
-                            .take(64)
-                            .map(char::from)
-                            .collect::<String>(),
+                        secret: signature_pem,
                     }),
+                    signature_algorithm: JwtSignatureAlgorithm::Es256,
                     ..Default::default()
                 }
                 .into(),
diff --git a/crates/common/src/network/acme/account.rs b/crates/common/src/network/acme/account.rs
index 376e8d13..ac8115d3 100644
--- a/crates/common/src/network/acme/account.rs
+++ b/crates/common/src/network/acme/account.rs
@@ -11,8 +11,8 @@ use base64::Engine;
 use base64::engine::general_purpose::{self, URL_SAFE_NO_PAD};
 use registry::schema::structs::AcmeProvider;
 use reqwest::Method;
-use ring::rand::SystemRandom;
-use ring::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
+use aws_lc_rs::rand::SystemRandom;
+use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
 use utils::sanitize_email;
 
 static ALG: &EcdsaSigningAlgorithm = &ECDSA_P256_SHA256_FIXED_SIGNING;
@@ -51,7 +51,7 @@ pub async fn acme_create_account(
 
     let directory = Directory::discover(&provider.directory, provider.max_retries as u32).await?;
     let account_key = EcdsaKeyPair::generate_pkcs8(ALG, &SystemRandom::new()).unwrap();
-    let key_pair = EcdsaKeyPair::from_pkcs8(ALG, account_key.as_ref(), &SystemRandom::new())
+    let key_pair = EcdsaKeyPair::from_pkcs8(ALG, account_key.as_ref())
         .map_err(|err| AcmeError::Crypto(format!("Failed to create ECDSA key pair: {}", err)))?;
     let eab = if let Some(eab) = &eab {
         eab_sign(&key_pair, &eab.kid, &eab.hmac_key, &directory.new_account)?.into()
diff --git a/crates/common/src/network/acme/directory.rs b/crates/common/src/network/acme/directory.rs
index 1c6c4ae3..a3354289 100644
--- a/crates/common/src/network/acme/directory.rs
+++ b/crates/common/src/network/acme/directory.rs
@@ -21,8 +21,7 @@ use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use rcgen::{CustomExtension, KeyPair, PKCS_ECDSA_P256_SHA256};
 use registry::schema::structs::AcmeProvider;
 use reqwest::Method;
-use ring::rand::SystemRandom;
-use ring::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
+use aws_lc_rs::signature::{ECDSA_P256_SHA256_FIXED_SIGNING, EcdsaKeyPair, EcdsaSigningAlgorithm};
 use serde::de::DeserializeOwned;
 use serde_json::json;
 use store::Serialize;
@@ -58,7 +57,6 @@ impl AcmeRequestBuilder {
                 .map_err(|err| {
                     AcmeError::Crypto(format!("Failed to decode account key: {}", err))
                 })?,
-            &SystemRandom::new(),
         )
         .map_err(|err| AcmeError::Crypto(format!("Failed to create ECDSA key pair: {}", err)))?;
 
diff --git a/crates/common/src/network/acme/jose.rs b/crates/common/src/network/acme/jose.rs
index 9313de07..94c3987e 100644
--- a/crates/common/src/network/acme/jose.rs
+++ b/crates/common/src/network/acme/jose.rs
@@ -9,10 +9,10 @@
 use crate::network::acme::{AcmeError, AcmeResult};
 use base64::Engine;
 use base64::engine::general_purpose::URL_SAFE_NO_PAD;
-use ring::digest::{Digest, SHA256, digest};
-use ring::hmac;
-use ring::rand::SystemRandom;
-use ring::signature::{EcdsaKeyPair, KeyPair};
+use aws_lc_rs::digest::{Digest, SHA256, digest};
+use aws_lc_rs::hmac;
+use aws_lc_rs::rand::SystemRandom;
+use aws_lc_rs::signature::{EcdsaKeyPair, KeyPair};
 use serde::Serialize;
 
 pub(crate) fn sign(
diff --git a/crates/common/src/network/acme/resolver.rs b/crates/common/src/network/acme/resolver.rs
index 2f78bbf9..4ff9bbb7 100644
--- a/crates/common/src/network/acme/resolver.rs
+++ b/crates/common/src/network/acme/resolver.rs
@@ -10,7 +10,7 @@ use crate::{
 };
 use rustls::{
     ServerConfig,
-    crypto::ring::sign::any_ecdsa_type,
+    crypto::aws_lc_rs::sign::any_ecdsa_type,
     server::{ClientHello, ResolvesServerCert},
     sign::CertifiedKey,
 };
diff --git a/crates/common/src/network/listen.rs b/crates/common/src/network/listen.rs
index 8753cbf4..ab6c060a 100644
--- a/crates/common/src/network/listen.rs
+++ b/crates/common/src/network/listen.rs
@@ -13,7 +13,7 @@ use crate::{
     config::server::{Listener, Listeners, ServerProtocol, TcpListener},
 };
 use proxy_header::io::ProxiedStream;
-use rustls::crypto::ring::cipher_suite::TLS13_AES_128_GCM_SHA256;
+use rustls::crypto::aws_lc_rs::cipher_suite::TLS13_AES_128_GCM_SHA256;
 use std::{
     net::{IpAddr, SocketAddr},
     sync::Arc,
diff --git a/crates/common/src/telemetry/webhooks/mod.rs b/crates/common/src/telemetry/webhooks/mod.rs
index 430fecd8..c02e550e 100644
--- a/crates/common/src/telemetry/webhooks/mod.rs
+++ b/crates/common/src/telemetry/webhooks/mod.rs
@@ -6,7 +6,7 @@
 
 use crate::{LONG_1Y_SLUMBER, config::telemetry::WebhookTracer};
 use base64::{Engine, engine::general_purpose::STANDARD};
-use ring::hmac;
+use aws_lc_rs::hmac;
 use serde::Serialize;
 use std::{
     sync::{
diff --git a/crates/store/Cargo.toml b/crates/store/Cargo.toml
index 23acb7a0..97131929 100644
--- a/crates/store/Cargo.toml
+++ b/crates/store/Cargo.toml
@@ -37,7 +37,7 @@ tokio-postgres = { version = "0.7.10", features = ["with-serde_json-1"], optiona
 tokio-rustls = { version = "0.26", optional = true, default-features = false, features = ["aws_lc_rs", "tls12"] }
 rustls = { version = "0.23.5", optional = true, default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
 rustls-pki-types = { version = "1", optional = true }
-ring = { version = "0.17", optional = true }
+aws-lc-rs = { version = "1", optional = true }
 bytes = { version = "1.10", optional = true }
 mysql_async = { version = "0.36", default-features = false, features = ["default-rustls", "minimal"], optional = true }
 serde_json = { version = "1.0.64" }
@@ -61,7 +61,7 @@ tokio = { version = "1.47", features = ["full"] }
 # Data Stores
 rocks = ["rocksdb", "rayon", "num_cpus"]
 sqlite = ["rusqlite", "rayon", "r2d2", "num_cpus", "lru-cache"]
-postgres = ["tokio-postgres", "deadpool", "deadpool-postgres", "tokio-rustls", "rustls", "ring", "rustls-pki-types", "futures", "bytes"]
+postgres = ["tokio-postgres", "deadpool", "deadpool-postgres", "tokio-rustls", "rustls", "aws-lc-rs", "rustls-pki-types", "futures", "bytes"]
 mysql = ["mysql_async", "futures"]
 foundation = ["foundationdb", "futures"]
 fdb-chunked-bm = []
diff --git a/crates/store/src/backend/postgres/tls.rs b/crates/store/src/backend/postgres/tls.rs
index 8681f156..cd69acbc 100644
--- a/crates/store/src/backend/postgres/tls.rs
+++ b/crates/store/src/backend/postgres/tls.rs
@@ -16,7 +16,7 @@ use std::{
 };
 
 use futures::future::{FutureExt, TryFutureExt};
-use ring::digest;
+use aws_lc_rs::digest;
 use rustls::ClientConfig;
 use rustls_pki_types::ServerName;
 use tokio::io::{AsyncRead, AsyncWrite, ReadBuf};
diff --git a/crates/utils/Cargo.toml b/crates/utils/Cargo.toml
index 5d30de4e..287e4af1 100644
--- a/crates/utils/Cargo.toml
+++ b/crates/utils/Cargo.toml
@@ -17,7 +17,7 @@ smtp-proto = { version = "0.2" }
 ahash = { version = "0.8", features = ["serde"] }
 chrono = "0.4"
 rand = "0.9.0"
-ring = { version = "0.17" }
+aws-lc-rs = { version = "1" }
 base64 = "0.22"
 serde_json = "1.0"
 rcgen = "0.14"
diff --git a/tests/Cargo.toml b/tests/Cargo.toml
index 5b75cbdd..17f1b15d 100644
--- a/tests/Cargo.toml
+++ b/tests/Cargo.toml
@@ -50,7 +50,7 @@ mail-parser = { version = "0.11", features = ["full_encoding", "rkyv"] }
 mail-builder = "0.4.4"
 sieve-rs = { version = "0.7", features = ["rkyv"] } 
 utils = { path = "../crates/utils", features = ["test_mode"] }
-jmap-client = { path = "/Users/me/code/jmap-client", features = ["websockets", "ring", "debug", "async"] } 
+jmap-client = { path = "/Users/me/code/jmap-client", features = ["websockets", "debug", "async"] } 
 tokio = { version = "1.47", features = ["full"] }
 tokio-rustls = { version = "0.26", default-features = false, features = ["aws_lc_rs", "tls12"] }
 rustls = { version = "0.23.5", default-features = false, features = ["std", "aws_lc_rs", "tls12"] }
@@ -74,7 +74,7 @@ serial_test = "3.0.0"
 num_cpus = "1.15.0"
 async-trait = "0.1.68"
 chrono = "0.4"
-ring = { version = "0.17" }
+aws-lc-rs = { version = "1" }
 biscuit = "0.8.0"
 form_urlencoded = "1.1.0"
 rkyv = { version = "0.8.10", features = ["little_endian"] }
diff --git a/tests/src/telemetry/webhooks.rs b/tests/src/telemetry/webhooks.rs
index 005b840f..7de8b834 100644
--- a/tests/src/telemetry/webhooks.rs
+++ b/tests/src/telemetry/webhooks.rs
@@ -21,7 +21,7 @@ use registry::{
     },
     types::map::Map,
 };
-use ring::hmac;
+use aws_lc_rs::hmac;
 use std::{
     sync::{
         Arc,
diff --git a/tests/src/utils/server.rs b/tests/src/utils/server.rs
index 544b9c2f..ebbfff80 100644
--- a/tests/src/utils/server.rs
+++ b/tests/src/utils/server.rs
@@ -91,7 +91,7 @@ pub struct TestServerBuilder {
 
 impl TestServerBuilder {
     pub async fn new(test_name: &str) -> Self {
-        let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
+        //let _ = rustls::crypto::aws_lc_rs::default_provider().install_default();
         let reset = std::env::var("NO_INSERT").is_err();
 
         Self::new_with_role(test_name, "mail.example.org".to_string(), None, reset).await