diff --git a/Cargo.toml b/Cargo.toml
index 0f366db..16ee26f 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -75,6 +75,11 @@ toml = "0.8"
 # Already in Cargo.lock transitively (via reqwest) — this adds only the
 # direct edge; MIT/Apache-2.0, cargo-deny clean.
 ipnet = "2"
+# axum-server 0.8: in-process TLS listener for rustls Phase 1 (deploy spec §5.4). Consumes
+# rustls 0.23 + tokio-rustls 0.26 (already in Cargo.lock transitively via str0m → aws-lc-rs
+# at 0.23.41 / 0.26.4 — verified). The tls-rustls feature enables
+# axum_server::tls_rustls::{RustlsConfig, RustlsAcceptor}. MIT license — cargo-deny-clean.
+axum-server = { version = "0.8", features = ["tls-rustls"] }
 # rcgen NOTE: rcgen 0.14.8 bumped MSRV to Rust 1.88, breaking the 1.85
 # toolchain matrix. rcgen is a transitive dep via dimpl → str0m 0.21 →
 # rutster-media. Cargo.lock pins it to 0.14.7 (the minimum satisfying