diff --git a/Cargo.lock b/Cargo.lock
index 9402bf86678..9b2cd3bd379 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -379,7 +379,7 @@ dependencies = [
  "aws-smithy-types",
  "bytes",
  "fastrand",
- "h2",
+ "h2 0.3.26",
  "http 0.2.12",
  "http-body 0.4.6",
  "http-body 1.0.0",
@@ -970,6 +970,7 @@ dependencies = [
  "github-meta",
  "googletest",
  "hex",
+ "http 0.2.12",
  "http 1.1.0",
  "http-body-util",
  "hyper 1.3.1",
@@ -989,7 +990,7 @@ dependencies = [
  "prometheus",
  "rand",
  "regex",
- "reqwest 0.11.27",
+ "reqwest 0.12.4",
  "scheduled-thread-pool",
  "secrecy",
  "semver",
@@ -1051,7 +1052,7 @@ dependencies = [
  "anyhow",
  "async-trait",
  "oauth2",
- "reqwest 0.11.27",
+ "reqwest 0.12.4",
  "serde",
  "thiserror",
  "tracing",
@@ -1093,7 +1094,7 @@ dependencies = [
  "bytes",
  "clap",
  "crates_io_index",
- "reqwest 0.11.27",
+ "reqwest 0.12.4",
  "secrecy",
  "semver",
  "serde",
@@ -1984,6 +1985,25 @@ dependencies = [
  "tracing",
 ]
 
+[[package]]
+name = "h2"
+version = "0.4.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "816ec7294445779408f36fe57bc5b7fc1cf59664059096c65f905c1c61f58069"
+dependencies = [
+ "bytes",
+ "fnv",
+ "futures-core",
+ "futures-sink",
+ "futures-util",
+ "http 1.1.0",
+ "indexmap",
+ "slab",
+ "tokio",
+ "tokio-util",
+ "tracing",
+]
+
 [[package]]
 name = "half"
 version = "2.4.1"
@@ -2202,7 +2222,7 @@ dependencies = [
  "futures-channel",
  "futures-core",
  "futures-util",
- "h2",
+ "h2 0.3.26",
  "http 0.2.12",
  "http-body 0.4.6",
  "httparse",
@@ -2225,6 +2245,7 @@ dependencies = [
  "bytes",
  "futures-channel",
  "futures-util",
+ "h2 0.4.4",
  "http 1.1.0",
  "http-body 1.0.0",
  "httparse",
@@ -2252,19 +2273,6 @@ dependencies = [
  "tokio-rustls",
 ]
 
-[[package]]
-name = "hyper-tls"
-version = "0.5.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6183ddfa99b85da61a140bea0efc93fdf56ceaa041b37d553518030827f9905"
-dependencies = [
- "bytes",
- "hyper 0.14.28",
- "native-tls",
- "tokio",
- "tokio-native-tls",
-]
-
 [[package]]
 name = "hyper-tls"
 version = "0.6.0"
@@ -3484,23 +3492,20 @@ version = "0.11.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "dd67538700a17451e7cba03ac727fb961abb7607553461627b97de0b89cf4a62"
 dependencies = [
- "async-compression",
  "base64 0.21.7",
  "bytes",
  "encoding_rs",
  "futures-core",
  "futures-util",
- "h2",
+ "h2 0.3.26",
  "http 0.2.12",
  "http-body 0.4.6",
  "hyper 0.14.28",
  "hyper-rustls",
- "hyper-tls 0.5.0",
  "ipnet",
  "js-sys",
  "log",
  "mime",
- "native-tls",
  "once_cell",
  "percent-encoding",
  "pin-project-lite",
@@ -3513,7 +3518,6 @@ dependencies = [
  "sync_wrapper 0.1.2",
  "system-configuration",
  "tokio",
- "tokio-native-tls",
  "tokio-rustls",
  "tokio-util",
  "tower-service",
@@ -3531,16 +3535,19 @@ version = "0.12.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "566cafdd92868e0939d3fb961bd0dc25fcfaaed179291093b3d43e6b3150ea10"
 dependencies = [
+ "async-compression",
  "base64 0.22.0",
  "bytes",
+ "encoding_rs",
  "futures-channel",
  "futures-core",
  "futures-util",
+ "h2 0.4.4",
  "http 1.1.0",
  "http-body 1.0.0",
  "http-body-util",
  "hyper 1.3.1",
- "hyper-tls 0.6.0",
+ "hyper-tls",
  "hyper-util",
  "ipnet",
  "js-sys",
@@ -3555,8 +3562,10 @@ dependencies = [
  "serde_json",
  "serde_urlencoded",
  "sync_wrapper 0.1.2",
+ "system-configuration",
  "tokio",
  "tokio-native-tls",
+ "tokio-util",
  "tower-service",
  "url",
  "wasm-bindgen",
diff --git a/Cargo.toml b/Cargo.toml
index 3d7905e804f..2d1a112e1f4 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -92,13 +92,14 @@ minijinja = "=1.0.20"
 mockall = "=0.12.1"
 oauth2 = { version = "=4.4.2", default-features = false, features = ["reqwest"] }
 object_store = { version = "=0.9.1", features = ["aws"] }
+object_store_http = { package = "http", version = "=0.2.12" }
 once_cell = "=1.19.0"
 p256 = "=0.13.2"
 parking_lot = "=0.12.1"
 paste = "=1.0.14"
 prometheus = { version = "=0.13.3", default-features = false }
 rand = "=0.8.5"
-reqwest = { version = "=0.11.27", features = ["blocking", "gzip", "json"] }
+reqwest = { version = "=0.12.4", features = ["blocking", "gzip", "json"] }
 scheduled-thread-pool = "=0.2.7"
 secrecy = "=0.8.0"
 semver = { version = "=1.0.22", features = ["serde"] }
diff --git a/crates/crates_io_github/Cargo.toml b/crates/crates_io_github/Cargo.toml
index 258d5bb665c..62751a2a7b3 100644
--- a/crates/crates_io_github/Cargo.toml
+++ b/crates/crates_io_github/Cargo.toml
@@ -11,7 +11,7 @@ workspace = true
 anyhow = "=1.0.82"
 async-trait = "=0.1.80"
 oauth2 = { version = "=4.4.2", default-features = false }
-reqwest = { version = "=0.11.27", features = ["json"] }
+reqwest = { version = "=0.12.4", features = ["json"] }
 serde = { version = "=1.0.198", features = ["derive"] }
 thiserror = "=1.0.59"
 tracing = "=0.1.40"
diff --git a/crates/crates_io_smoke_test/Cargo.toml b/crates/crates_io_smoke_test/Cargo.toml
index 265c00e8a13..e7bcf5b7e13 100644
--- a/crates/crates_io_smoke_test/Cargo.toml
+++ b/crates/crates_io_smoke_test/Cargo.toml
@@ -12,7 +12,7 @@ anyhow = "=1.0.82"
 bytes = "=1.6.0"
 clap = { version = "=4.5.4", features = ["derive", "env", "unicode", "wrap_help"] }
 crates_io_index = { path = "../crates_io_index" }
-reqwest = { version = "=0.11.27", features = ["gzip", "json"] }
+reqwest = { version = "=0.12.4", features = ["gzip", "json"] }
 secrecy = "=0.8.0"
 semver = { version = "=1.0.22", features = ["serde"] }
 serde = { version = "=1.0.198", features = ["derive"] }
diff --git a/src/storage.rs b/src/storage.rs
index 983fecbe704..75c5de0d286 100644
--- a/src/storage.rs
+++ b/src/storage.rs
@@ -8,8 +8,8 @@ use object_store::memory::InMemory;
 use object_store::path::Path;
 use object_store::prefix::PrefixStore;
 use object_store::{ClientOptions, ObjectStore, Result};
-use reqwest::header::CACHE_CONTROL;
-use reqwest::header::{HeaderMap, HeaderValue};
+use object_store_http::header::CACHE_CONTROL;
+use object_store_http::header::{HeaderMap, HeaderValue};
 use secrecy::{ExposeSecret, SecretString};
 use std::fs;
 use std::path::PathBuf;