diff --git a/_primitives/_rust/Cargo.lock b/_primitives/_rust/Cargo.lock
index ef7f2bf..bf65d2d 100644
--- a/_primitives/_rust/Cargo.lock
+++ b/_primitives/_rust/Cargo.lock
@@ -3202,6 +3202,7 @@ version = "0.1.0"
 dependencies = [
  "async-trait",
  "kei-runtime-core",
+ "openssl-sys",
  "serde",
  "serde_json",
  "thiserror 1.0.69",
@@ -5288,6 +5289,15 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-src"
+version = "300.6.0+3.6.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a8e8cbfd3a4a8c8f089147fd7aaa33cf8c7450c4d09f8f80698a0cf093abeff4"
+dependencies = [
+ "cc",
+]
+
 [[package]]
 name = "openssl-sys"
 version = "0.9.115"
@@ -5296,6 +5306,7 @@ checksum = "158fe5b292746440aa6e7a7e690e55aeb72d41505e2804c23c6973ad0e9c9781"
 dependencies = [
  "cc",
  "libc",
+ "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
diff --git a/_primitives/_rust/kei-auth-webauthn/Cargo.toml b/_primitives/_rust/kei-auth-webauthn/Cargo.toml
index 096add2..f87b332 100644
--- a/_primitives/_rust/kei-auth-webauthn/Cargo.toml
+++ b/_primitives/_rust/kei-auth-webauthn/Cargo.toml
@@ -22,6 +22,13 @@ webauthn-rs = "0.5"
 uuid = { version = "1", features = ["v4", "serde"] }
 kei-runtime-core = { path = "../kei-runtime-core" }
 
+# webauthn-rs тянет openssl-sys транзитивно (webauthn-attestation-ca).
+# В CI release.yml `x86_64-apple-darwin` собирается на `macos-latest` (arm64)
+# через cross-compile, где системный openssl не найден через pkg-config.
+# vendored-фича компилирует openssl из исходников — работает на любом хосте
+# (CI fail 2026-05-18 run 26014515768).
+openssl-sys = { version = "0.9", features = ["vendored"] }
+
 [dev-dependencies]
 tokio = { workspace = true }