diff --git a/Cargo.lock b/Cargo.lock
index 69c4337..94d6a3e 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1603,19 +1603,14 @@ dependencies = [
  "once_cell",
  "paste",
  "percent-encoding",
- "rustls",
- "rustls-pemfile",
  "serde",
  "serde_json",
  "sha2",
  "smallvec",
  "sqlformat",
  "thiserror",
- "tokio",
- "tokio-stream",
  "tracing",
  "url",
- "webpki-roots",
 ]
 
 [[package]]
@@ -1652,7 +1647,6 @@ dependencies = [
  "sqlx-sqlite",
  "syn 1.0.109",
  "tempfile",
- "tokio",
  "url",
 ]
 
@@ -1895,17 +1889,6 @@ dependencies = [
  "tokio",
 ]
 
-[[package]]
-name = "tokio-stream"
-version = "0.1.14"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "397c988d37662c7dda6d2208364a706264bf3d6138b11d436cbac0ad38832842"
-dependencies = [
- "futures-core",
- "pin-project-lite",
- "tokio",
-]
-
 [[package]]
 name = "tokio-util"
 version = "0.7.8"
@@ -2208,15 +2191,6 @@ dependencies = [
  "wasm-bindgen",
 ]
 
-[[package]]
-name = "webpki-roots"
-version = "0.24.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b291546d5d9d1eab74f069c77749f2cb8504a12caa20f0f2de93ddbf6f411888"
-dependencies = [
- "rustls-webpki",
-]
-
 [[package]]
 name = "whoami"
 version = "1.4.1"
diff --git a/Cargo.toml b/Cargo.toml
index ddabb38..6a615fb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -24,7 +24,7 @@ rustls-pemfile = "1.0.2"
 quick-xml = { version = "0.30.0", features = ["async-tokio"] }
 derive_more = "0.99.17"
 uuid = { version = "1.3.0", features = ["v4"] }
-sqlx = { version = "0.7.0-alpha.2", features = ["sqlite", "runtime-tokio-rustls", "migrate"] }
+sqlx = { version = "0.7.0-alpha.2", features = ["sqlite", "migrate"] }
 
 [dev-dependencies]
 assert_matches = "1.5.0"
diff --git a/deny.toml b/deny.toml
index 19a24a9..f7ace18 100644
--- a/deny.toml
+++ b/deny.toml
@@ -17,14 +17,18 @@ allow = [
     "MIT",
     "Apache-2.0",
     "ISC",
-    "MPL-2.0",
     "BSD-3-Clause",
 ]
 exceptions = [
     { allow = ["Unicode-DFS-2016"], name = "unicode-ident" },
     { allow = ["OpenSSL"], name = "ring" },
 ]
-deny = ["GPL-2.0", "GPL-3.0", "AGPL-3.0"]
+deny = [
+    "GPL-2.0",
+    "GPL-3.0",
+    "AGPL-3.0",
+    "MPL-2.0" # it is used by webpki-roots; we do not hardcode root certs in the binary
+]
 copyleft = "deny"
 confidence-threshold = 0.93
 private = { ignore = true }