diff --git a/.github/workflows/columnq_cli_release.yml b/.github/workflows/columnq_cli_release.yml
index ccf153b..66a24fb 100644
--- a/.github/workflows/columnq_cli_release.yml
+++ b/.github/workflows/columnq_cli_release.yml
@@ -3,6 +3,7 @@ name: columnq-cli release
 on:
   push:
     paths:
+      - '.github/workflows/columnq_cli_release.yml'
       - 'columnq/**'
       - 'columnq-cli/**'
       - 'Cargo.lock'
@@ -117,15 +118,19 @@ jobs:
     needs: validate-release-tag
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         platform: [
-          { manylinux: '2010', target: "x86_64-unknown-linux-musl", image_tag: "x86_64-musl", features: "simd" },
+          { manylinux: '2010', target: "x86_64-unknown-linux-musl", image_tag: "x86_64-musl", features: "simd,rustls", upload: "true" },
+          { manylinux: '2010', target: "x86_64-unknown-linux-musl", image_tag: "x86_64-musl", features: "simd,native-tls-vendored", upload: "false" },
           # { manylinux: '2010', target: "i686-unknown-linux-musl", image_tag: "i686-musl", features: "" },
-          { manylinux: '2014', target: "aarch64-unknown-linux-musl", image_tag: "aarch64-musl", features: "" },
-          { manylinux: '2014', target: "armv7-unknown-linux-musleabihf", image_tag: "armv7-musleabihf", features: "" },
+          { manylinux: '2014', target: "aarch64-unknown-linux-musl", image_tag: "aarch64-musl", features: "rustls", upload: "true" },
+          { manylinux: '2014', target: "aarch64-unknown-linux-musl", image_tag: "aarch64-musl", features: "native-tls-vendored", upload: "false" },
+          { manylinux: '2014', target: "armv7-unknown-linux-musleabihf", image_tag: "armv7-musleabihf", features: "rustls", upload: "true" },
+          { manylinux: '2014', target: "armv7-unknown-linux-musleabihf", image_tag: "armv7-musleabihf", features: "native-tls-vendored", upload: "false" },
         ]
     container:
-      image: docker://benfred/rust-musl-cross:${{ matrix.platform.image_tag }}
+      image: docker://messense/rust-musl-cross:${{ matrix.platform.image_tag }}
       env:
         RUSTUP_HOME: /root/.rustup
         CARGO_HOME: /root/.cargo
@@ -140,20 +145,22 @@ jobs:
           rustup default nightly-${{ env.RUST_TC_NIGHTLY_VER }}
       - name: Build Wheels
         run: |
-          pip3 install 'maturin<0.12'
+          sudo python3 -m pip install 'maturin<0.12'
           maturin build -m columnq-cli/Cargo.toml -b bin --no-sdist --release -o dist \
             --target ${{ matrix.platform.target }} --manylinux ${{ matrix.platform.manylinux }} \
-            --cargo-extra-args="--features=${{ matrix.platform.features }}"
+            --cargo-extra-args="--no-default-features --features=${{ matrix.platform.features }}"
       - name: Upload wheels
         uses: actions/upload-artifact@v2
+        if: "matrix.platform.upload == 'true'"
         with:
           name: wheels
           path: dist
       - name: Archive binary
+        if: "matrix.platform.upload == 'true'"
         run: tar czvf target/release/columnq-cli.tar.gz -C target/${{ matrix.platform.target }}/release columnq
       - name: Upload binary to GitHub Release
         uses: svenstaro/upload-release-action@v2
-        if: "startsWith(github.ref, 'refs/tags/')"
+        if: "startsWith(github.ref, 'refs/tags/') && matrix.platform.upload == 'true'"
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           asset_name: columnq-cli-${{ matrix.platform.target }}.tar.gz
@@ -178,4 +185,4 @@ jobs:
           TWINE_PASSWORD: ${{ secrets.COLUMNQ_CLI_PYPI_TOKEN }}
         run: |
           pip install --upgrade twine
-          twine upload --skip-existing *
+          twine upload --skip-existing *
\ No newline at end of file
diff --git a/.github/workflows/roapi_http_release.yml b/.github/workflows/roapi_http_release.yml
index 1c9b8f4..b044d4e 100644
--- a/.github/workflows/roapi_http_release.yml
+++ b/.github/workflows/roapi_http_release.yml
@@ -3,6 +3,7 @@ name: roapi-http release
 on:
   push:
     paths:
+      - '.github/workflows/roapi_http_release.yml'
       - 'columnq/**'
       - 'roapi-http/**'
       - 'Cargo.lock'
@@ -118,15 +119,19 @@ jobs:
     needs: validate-release-tag
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         platform: [
-          { manylinux: '2010', target: "x86_64-unknown-linux-musl", image_tag: "x86_64-musl", features: "simd" },
+          { manylinux: '2010', target: "x86_64-unknown-linux-musl", image_tag: "x86_64-musl", features: "simd,rustls", upload: "true" },
+          { manylinux: '2010', target: "x86_64-unknown-linux-musl", image_tag: "x86_64-musl", features: "simd,native-tls-vendored", upload: "false" },
           # { manylinux: '2010', target: "i686-unknown-linux-musl", image_tag: "i686-musl", features: "" },
-          { manylinux: '2014', target: "aarch64-unknown-linux-musl", image_tag: "aarch64-musl", features: "" },
-          { manylinux: '2014', target: "armv7-unknown-linux-musleabihf", image_tag: "armv7-musleabihf", features: "" },
+          { manylinux: '2014', target: "aarch64-unknown-linux-musl", image_tag: "aarch64-musl", features: "rustls", upload: "true"},
+          { manylinux: '2014', target: "aarch64-unknown-linux-musl", image_tag: "aarch64-musl", features: "native-tls-vendored", upload: "false" },
+          { manylinux: '2014', target: "armv7-unknown-linux-musleabihf", image_tag: "armv7-musleabihf", features: "rustls", upload: "true" },
+          { manylinux: '2014', target: "armv7-unknown-linux-musleabihf", image_tag: "armv7-musleabihf", features: "native-tls-vendored", upload: "false" },
         ]
     container:
-      image: docker://benfred/rust-musl-cross:${{ matrix.platform.image_tag }}
+      image: docker://messense/rust-musl-cross:${{ matrix.platform.image_tag }}
       env:
         RUSTUP_HOME: /root/.rustup
         CARGO_HOME: /root/.cargo
@@ -141,18 +146,22 @@ jobs:
           rustup default nightly-${{ env.RUST_TC_NIGHTLY_VER }}
       - name: Build Wheels
         run: |
-          pip3 install 'maturin<0.12'
-          maturin build -m roapi-http/Cargo.toml -b bin --no-sdist --release -o dist --target ${{ matrix.platform.target }} --manylinux ${{ matrix.platform.manylinux }} --cargo-extra-args="--features=${{ matrix.platform.features }}"
+          sudo python3 -m pip install 'maturin<0.12'
+          maturin build -m roapi-http/Cargo.toml -b bin --no-sdist --release -o dist \
+            --target ${{ matrix.platform.target }} --manylinux ${{ matrix.platform.manylinux }} \
+            --cargo-extra-args="--no-default-features --features=${{ matrix.platform.features }}"
       - name: Upload wheels
         uses: actions/upload-artifact@v2
+        if: "matrix.platform.upload == 'true'"
         with:
           name: wheels
           path: dist
       - name: Archive binary
+        if: "matrix.platform.upload == 'true'"
         run: tar czvf target/release/roapi-http.tar.gz -C target/${{ matrix.platform.target }}/release roapi-http
       - name: Upload binary to GitHub Release
         uses: svenstaro/upload-release-action@v2
-        if: "startsWith(github.ref, 'refs/tags/')"
+        if: "startsWith(github.ref, 'refs/tags/') && matrix.platform.upload == 'true'"
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           asset_name: roapi-http-${{ matrix.platform.target }}.tar.gz
diff --git a/Cargo.lock b/Cargo.lock
index 3f2319e..b6df3c7 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -201,7 +201,7 @@ dependencies = [
  "serde_json",
  "serde_urlencoded 0.7.0",
  "smallvec",
- "socket2",
+ "socket2 0.3.19",
  "time 0.2.25",
  "url",
 ]
@@ -551,6 +551,8 @@ dependencies = [
  "deltalake",
  "futures",
  "graphql-parser",
+ "hyper-rustls",
+ "hyper-tls",
  "lazy_static",
  "log",
  "pretty_assertions",
@@ -1253,9 +1255,9 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 
 [[package]]
 name = "hyper"
-version = "0.14.4"
+version = "0.14.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8e946c2b1349055e0b72ae281b238baf1a3ea7307c7e9f9d64673bdd9c26ac7"
+checksum = "8bf09f61b52cfcf4c00de50df88ae423d6c02354e385a86341133b5338630ad1"
 dependencies = [
  "bytes",
  "futures-channel",
@@ -1268,7 +1270,7 @@ dependencies = [
  "httpdate",
  "itoa",
  "pin-project",
- "socket2",
+ "socket2 0.4.2",
  "tokio",
  "tower-service",
  "tracing",
@@ -1582,7 +1584,7 @@ version = "0.3.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5a33c1b55807fbed163481b5ba66db4b2fa6cde694a5027be10fb724206c5897"
 dependencies = [
- "socket2",
+ "socket2 0.3.19",
  "winapi",
 ]
 
@@ -1608,9 +1610,9 @@ dependencies = [
 
 [[package]]
 name = "native-tls"
-version = "0.2.7"
+version = "0.2.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b8d96b2e1c8da3957d58100b09f102c6d9cfdfced01b7ec5a8974044bb09dbd4"
+checksum = "48ba9f7719b5a0f42f338907614285fb5fd70e53858141f69898a1fb7203b24d"
 dependencies = [
  "lazy_static",
  "libc",
@@ -1755,9 +1757,9 @@ checksum = "624a8340c38c1b80fd549087862da4ba43e08858af025b236e509b6649fc13d5"
 
 [[package]]
 name = "openssl"
-version = "0.10.33"
+version = "0.10.36"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a61075b62a23fef5a29815de7536d940aa35ce96d18ce0cc5076272db678a577"
+checksum = "8d9facdb76fec0b73c406f125d44d86fdad818d66fef0531eec9233ca425ff4a"
 dependencies = [
  "bitflags",
  "cfg-if 1.0.0",
@@ -1774,14 +1776,24 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77af24da69f9d9341038eba93a073b1fdaaa1b788221b00a69bce9e762cb32de"
 
 [[package]]
-name = "openssl-sys"
-version = "0.9.61"
+name = "openssl-src"
+version = "111.16.0+1.1.1l"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "313752393519e876837e09e1fa183ddef0be7735868dced3196f4472d536277f"
+checksum = "7ab2173f69416cf3ec12debb5823d244127d23a9b127d5a5189aa97c5fa2859f"
+dependencies = [
+ "cc",
+]
+
+[[package]]
+name = "openssl-sys"
+version = "0.9.67"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "69df2d8dfc6ce3aaf44b40dec6f487d5a886516cf6879c49e98e0710f310a058"
 dependencies = [
  "autocfg",
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
@@ -1929,9 +1941,9 @@ checksum = "8b870d8c151b6f2fb93e84a13146138f05d02ed11c7e7c54f8826aaaf7c9f184"
 
 [[package]]
 name = "pkg-config"
-version = "0.3.19"
+version = "0.3.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3831453b3449ceb48b6d9c7ad7c96d5ea673e9b470a1dc578c2ce6521230884c"
+checksum = "7c9b1041b4387893b91ee6746cddfc28516aff326a3519fb2adf820932c5e6cb"
 
 [[package]]
 name = "ppv-lite86"
@@ -2148,9 +2160,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.11.2"
+version = "0.11.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bf12057f289428dbf5c591c74bf10392e4a8003f993405a902f20117019022d4"
+checksum = "246e9f61b9bb77df069a947682be06e31ac43ea37862e244a69f177694ea6d22"
 dependencies = [
  "base64",
  "bytes",
@@ -2160,6 +2172,7 @@ dependencies = [
  "http",
  "http-body",
  "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "ipnet",
  "js-sys",
@@ -2169,15 +2182,18 @@ dependencies = [
  "native-tls",
  "percent-encoding",
  "pin-project-lite",
+ "rustls",
  "serde",
  "serde_json",
  "serde_urlencoded 0.7.0",
  "tokio",
  "tokio-native-tls",
+ "tokio-rustls",
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
  "web-sys",
+ "webpki-roots",
  "winreg",
 ]
 
@@ -2230,6 +2246,7 @@ dependencies = [
  "futures",
  "http",
  "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "lazy_static",
  "log",
@@ -2255,6 +2272,7 @@ dependencies = [
  "futures",
  "http",
  "hyper",
+ "hyper-rustls",
  "hyper-tls",
  "lazy_static",
  "log",
@@ -2723,6 +2741,16 @@ dependencies = [
  "winapi",
 ]
 
+[[package]]
+name = "socket2"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5dc90fe6c7be1a323296982db1836d1ea9e47b6839496dde9a541bc496df3516"
+dependencies = [
+ "libc",
+ "winapi",
+]
+
 [[package]]
 name = "spin"
 version = "0.5.2"
@@ -3202,9 +3230,9 @@ dependencies = [
 
 [[package]]
 name = "vcpkg"
-version = "0.2.11"
+version = "0.2.15"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b00bca6106a5e23f3eee943593759b7fcddb00554332e856d990c893966879fb"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
 
 [[package]]
 name = "vec_map"
@@ -3328,6 +3356,15 @@ dependencies = [
  "untrusted",
 ]
 
+[[package]]
+name = "webpki-roots"
+version = "0.21.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aabe153544e473b775453675851ecc86863d2a81d786d741f6b76778f2a48940"
+dependencies = [
+ "webpki",
+]
+
 [[package]]
 name = "winapi"
 version = "0.3.9"
@@ -3395,6 +3432,7 @@ dependencies = [
  "http",
  "hyper",
  "hyper-rustls",
+ "hyper-tls",
  "log",
  "percent-encoding",
  "rustls",
diff --git a/columnq-cli/Cargo.toml b/columnq-cli/Cargo.toml
index b9e9036..e8ea8e7 100644
--- a/columnq-cli/Cargo.toml
+++ b/columnq-cli/Cargo.toml
@@ -12,7 +12,7 @@ name = "columnq"
 path = "src/main.rs"
 
 [dependencies]
-columnq = { path = "../columnq", version = "0" }
+columnq = { path = "../columnq", version = "0", default-features = false }
 
 serde_json = "*"
 log = "0"
@@ -24,6 +24,9 @@ clap = { version = ">=3.0.0-beta.2,<4", features = ["color"] }
 dirs = { version = "3" }
 
 [features]
+default = ["rustls"]
+rustls = ["columnq/rustls"]
+native-tls-vendored = ["columnq/native-tls-vendored"]
 simd = ["columnq/simd"]
 
 [dev-dependencies]
diff --git a/columnq/Cargo.toml b/columnq/Cargo.toml
index da7c2d4..31635a8 100644
--- a/columnq/Cargo.toml
+++ b/columnq/Cargo.toml
@@ -19,26 +19,28 @@ regex = "1"
 lazy_static = "1"
 graphql-parser = "0"
 sqlparser = "0.10"
-yup-oauth2 = "5"
+yup-oauth2 = { version = "5.1", default-features = false }
 thiserror = "1"
 serde_json = "1"
 serde_derive = "1"
 serde = "1"
 uriparse = "0"
 bytes = { version = "1" }
-reqwest = { version = "0.11", features = ["blocking", "json"] }
+reqwest = { version = "0.11", default-features = false, features = ["blocking", "json"] }
 
 tokio = "1"
 futures = "0.3"
 
 # S3
-rusoto_core = { version = "0.47" }
-rusoto_s3 = { version = "0.47" }
+rusoto_core = { version = "0.47", default-features = false }
+rusoto_s3 = { version = "0.47", default-features = false }
 rusoto_credential = { version = "0.47" }
-rusoto_sts = { version = "0.47" }
+rusoto_sts = { version = "0.47", default-features = false }
+hyper-tls = { version = "0.5.0", default-features = false, features = ["vendored"], optional = true }
+hyper-rustls = { version = "0.22.1", default-features = false, optional = true }
 
 
-deltalake = { version = "0", features = ["s3", "datafusion-ext"] }
+deltalake = { version = "0", default-features = false, features = ["datafusion-ext"] }
 
 [dev-dependencies]
 anyhow = "1"
@@ -47,4 +49,7 @@ tempdir = "0"
 pretty_assertions = "*"
 
 [features]
+default = ["rustls"]
+rustls = ["reqwest/rustls-tls", "rusoto_core/rustls", "rusoto_core/rustls", "rusoto_sts/rustls", "deltalake/s3-rustls", "yup-oauth2/hyper-rustls"]
+native-tls-vendored = ["reqwest/native-tls-vendored", "hyper-tls/vendored", "rusoto_core/native-tls", "rusoto_s3/native-tls", "rusoto_sts/native-tls", "deltalake/s3", "yup-oauth2/hyper-tls"]
 simd = ["datafusion/simd"]
diff --git a/roapi-http/Cargo.toml b/roapi-http/Cargo.toml
index 77e0028..4ff725b 100644
--- a/roapi-http/Cargo.toml
+++ b/roapi-http/Cargo.toml
@@ -15,7 +15,7 @@ name = "roapi-http"
 path = "src/main.rs"
 
 [dependencies]
-columnq = { path = "../columnq", version = "0" }
+columnq = { path = "../columnq", version = "0", default-features = false }
 
 # all actix dependencies are patched to use git source until actix-web 4.x lands
 actix-web = "4.0.0-beta.4"
@@ -35,6 +35,9 @@ thiserror = "1"
 anyhow = "1"
 
 [features]
+default = ["rustls"]
+rustls = ["columnq/rustls"]
+native-tls-vendored = ["columnq/native-tls-vendored"]
 simd = ["columnq/simd"]
 
 [dev-dependencies]