diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index b584c85f2..b666b92d2 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -3498,9 +3498,9 @@ dependencies = [
 
 [[package]]
 name = "landlock"
-version = "0.4.2"
+version = "0.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b3d2ef408b88e913bfc6594f5e693d57676f6463ded7d8bf994175364320c706"
+checksum = "affe8b77dce5b172f8e290bd801b12832a77cd1942d1ea98259916e89d5829d6"
 dependencies = [
  "enumflags2",
  "libc",
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index 3de8d47d5..b5533f4fc 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -132,7 +132,7 @@ indexmap = "2.12.0"
 insta = "1.43.2"
 itertools = "0.14.0"
 keyring = "3.6"
-landlock = "0.4.1"
+landlock = "0.4.3"
 lazy_static = "1"
 libc = "0.2.175"
 log = "0.4"
diff --git a/codex-rs/core/src/default_client.rs b/codex-rs/core/src/default_client.rs
index 8e4635460..b1cf11ed0 100644
--- a/codex-rs/core/src/default_client.rs
+++ b/codex-rs/core/src/default_client.rs
@@ -260,19 +260,33 @@ fn sanitize_user_agent(candidate: String, fallback: &str) -> String {
 pub fn create_client() -> CodexHttpClient {
     use reqwest::header::HeaderMap;
 
-    let mut headers = HeaderMap::new();
-    headers.insert("originator", originator().header_value.clone());
+    let mut default_headers = HeaderMap::new();
+    default_headers.insert("originator", originator().header_value.clone());
     let ua = get_codex_user_agent();
 
-    let mut builder = reqwest::Client::builder()
-        // Set UA via dedicated helper to avoid header validation pitfalls
-        .user_agent(ua)
-        .default_headers(headers);
-    if is_sandboxed() {
-        builder = builder.no_proxy();
-    }
-
-    let inner = builder.build().unwrap_or_else(|_| reqwest::Client::new());
+    let build_client = || {
+        let mut builder = reqwest::Client::builder()
+            .use_rustls_tls()
+            .user_agent(ua.clone())
+            .default_headers(default_headers.clone());
+        if is_sandboxed() {
+            builder = builder.no_proxy();
+        }
+        builder.build()
+    };
+
+    let inner = match build_client() {
+        Ok(client) => client,
+        Err(error) => {
+            tracing::error!(?error, "Failed to build reqwest client with rustls");
+            match build_client() {
+                Ok(client) => client,
+                Err(error) => {
+                    panic!("failed to build reqwest client with rustls: {error}");
+                }
+            }
+        }
+    };
     CodexHttpClient::new(inner)
 }
 
diff --git a/codex-rs/tui/src/slash_command.rs b/codex-rs/tui/src/slash_command.rs
index 969d279b0..b17b61259 100644
--- a/codex-rs/tui/src/slash_command.rs
+++ b/codex-rs/tui/src/slash_command.rs
@@ -84,10 +84,8 @@ impl SlashCommand {
     }
 
     fn is_visible(self) -> bool {
-        match self {
-            SlashCommand::Rollout | SlashCommand::TestApproval => cfg!(debug_assertions),
-            _ => true,
-        }
+        !matches!(self, SlashCommand::Rollout | SlashCommand::TestApproval)
+            || cfg!(debug_assertions)
     }
 }