diff --git a/packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs b/packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs
index 81421d8866..a89ec5a048 100644
--- a/packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs
+++ b/packages/paperclip-runner/runner/crates/runner-core/src/bin/paperclip-runnerd.rs
@@ -104,6 +104,14 @@ fn install_diagnostic_panic_hook(directory: Option<PathBuf>) {
     }));
 }
 
+fn install_crypto_provider() {
+    // The production dependency graph enables both rustls crypto backends.
+    // Select the backend declared by this workspace before any TLS builder
+    // asks rustls for the process-level default. An embedding process may have
+    // already selected a provider, which is also a valid initialized state.
+    let _ = rustls::crypto::ring::default_provider().install_default();
+}
+
 fn build_metadata() -> serde_json::Value {
     json!({
         "schema": RUNNERD_BUILD_METADATA_SCHEMA,
@@ -359,6 +367,28 @@ fn run(args: &[String]) -> Result<(), LocalRunnerError> {
     })
 }
 
+fn run_main(args: Vec<String>) -> ExitCode {
+    let diagnostics_directory = diagnostic_directory(&args);
+    install_diagnostic_panic_hook(diagnostics_directory.clone());
+    install_crypto_provider();
+    match run(&args) {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(error) => {
+            let message = format!("paperclip-runnerd: {error}");
+            if let Some(directory) = diagnostics_directory {
+                if let Err(persist_error) = persist_runner_diagnostic(&directory, &message) {
+                    eprintln!(
+                        "paperclip-runnerd: failed to persist bounded diagnostic: {persist_error}"
+                    );
+                }
+            } else {
+                eprintln!("{message}");
+            }
+            ExitCode::FAILURE
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -374,6 +404,17 @@ mod tests {
         );
     }
 
+    #[test]
+    fn startup_installs_a_crypto_provider_before_tls_initialization() {
+        let _ = run_main(vec!["--build-metadata".to_owned()]);
+        assert!(rustls::crypto::CryptoProvider::get_default().is_some());
+
+        // Startup is process-global. A repeated startup call must remain
+        // safe when a provider was selected earlier in the process lifetime.
+        let _ = run_main(vec!["--build-metadata".to_owned()]);
+        let _ = rustls::ClientConfig::builder();
+    }
+
     #[test]
     fn persistent_diagnostic_is_private_bounded_and_redacted() {
         let unique = format!(
@@ -422,23 +463,5 @@ mod tests {
 }
 
 fn main() -> ExitCode {
-    let args = std::env::args().skip(1).collect::<Vec<_>>();
-    let diagnostics_directory = diagnostic_directory(&args);
-    install_diagnostic_panic_hook(diagnostics_directory.clone());
-    match run(&args) {
-        Ok(()) => ExitCode::SUCCESS,
-        Err(error) => {
-            let message = format!("paperclip-runnerd: {error}");
-            if let Some(directory) = diagnostics_directory {
-                if let Err(persist_error) = persist_runner_diagnostic(&directory, &message) {
-                    eprintln!(
-                        "paperclip-runnerd: failed to persist bounded diagnostic: {persist_error}"
-                    );
-                }
-            } else {
-                eprintln!("{message}");
-            }
-            ExitCode::FAILURE
-        }
-    }
+    run_main(std::env::args().skip(1).collect())
 }
diff --git a/packages/paperclip-runner/runner/crates/runner-core/tests/local_runner.rs b/packages/paperclip-runner/runner/crates/runner-core/tests/local_runner.rs
index 91cba4d71d..e71ef5778a 100644
--- a/packages/paperclip-runner/runner/crates/runner-core/tests/local_runner.rs
+++ b/packages/paperclip-runner/runner/crates/runner-core/tests/local_runner.rs
@@ -68,6 +68,19 @@ fn event_type(message: &Value) -> Option<&str> {
         .flatten()
 }
 
+#[test]
+fn runnerd_startup_reports_build_metadata_without_panicking() {
+    let output = Command::new(env!("CARGO_BIN_EXE_paperclip-runnerd"))
+        .arg("--build-metadata")
+        .output()
+        .expect("runner daemon should start");
+
+    assert!(output.status.success());
+    let metadata: Value =
+        serde_json::from_slice(&output.stdout).expect("build metadata should be valid JSON");
+    assert_eq!(metadata["binaryName"], "paperclip-runnerd");
+}
+
 #[test]
 fn happy_path_emits_one_result_and_one_terminal() {
     let commands = [