diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
index bc0133f..fb5944c 100644
--- a/.github/ISSUE_TEMPLATE/bug_report.yml
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -32,7 +32,6 @@ body:
       options:
         - rustls-tls (default)
         - native-tls (system OpenSSL)
-        - vendored-openssl
         - not sure
     validations:
       required: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cc1fe92..d5a9d95 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -160,14 +160,14 @@ jobs:
           - aarch64-unknown-linux-musl
           - armv7-unknown-linux-musleabihf
           - x86_64-unknown-linux-musl
+          - arm-unknown-linux-musleabi
         tls: [rustls-tls]
         include:
-          # Proves the OpenSSL backend cross-builds, the configuration targets
-          # without ring support (such as PowerPC) have to use. Vendored here
-          # because the cross image has no OpenSSL for the target; OpenWrt
-          # builds use plain `native-tls` against the SDK's libopenssl.
+          # Proves the OpenSSL backend cross-builds, the configuration OpenWrt
+          # uses. OpenSSL is compiled in here only because the cross image has
+          # none for the target; OpenWrt builds link the SDK's libopenssl.
           - target: aarch64-unknown-linux-musl
-            tls: vendored-openssl
+            tls: native-tls
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -176,8 +176,18 @@ jobs:
         with:
           toolchain: stable
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        with:
+          # One cache per matrix entry. The key otherwise names only the job,
+          # so an entry restores whatever another one built.
+          key: ${{ matrix.target }}-${{ matrix.tls }}
       - run: cargo install cross@0.2.5 --locked
-      - run: cross build --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}
+      - run: cross build --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}${{ matrix.tls == 'native-tls' && ',native-tls/vendored' || '' }}
+      # A binary that links can still fail to start, so run it under the image's
+      # QEMU runner. --help because cross keeps --version for itself, and without
+      # network so that a dropped argument cannot start a real speed test.
+      - run: cross run --release --target ${{ matrix.target }} --no-default-features --features ${{ matrix.tls }}${{ matrix.tls == 'native-tls' && ',native-tls/vendored' || '' }} -- --help | grep '^Usage:'
+        env:
+          CROSS_CONTAINER_OPTS: --network=none
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: librespeed-cli-${{ matrix.target }}-${{ matrix.tls }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fd29a21..09a3a45 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -60,12 +60,26 @@ jobs:
     with:
       ref: ${{ needs.resolve.outputs.source }}
 
+  # What a tag publishes cannot be taken back, so a known advisory in its lock
+  # file stops it here. README's release policy says how to decide on one.
+  advisories:
+    name: Advisories
+    needs: resolve
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ needs.resolve.outputs.source }}
+      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
+        with:
+          command: check advisories
+
   # The canonical crate is assembled once, here, and this job also fixes
   # which commit the rest of the run is about. The publish job reproduces
   # the crate and compares the bytes before uploading anything.
   prepare:
     name: Package the crate
-    needs: [resolve, validate]
+    needs: [resolve, validate, advisories]
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.guard.outputs.version }}
@@ -137,10 +151,11 @@ jobs:
       # this installs, and cross is part of what builds the binaries.
       - run: cargo install cross@0.2.5 --locked
 
-      # OpenSSL is vendored so the published binaries are self-contained;
-      # OpenWrt packages build against the SDK's libopenssl instead.
+      # rustls, so the published binaries are self-contained and carry no OpenSSL
+      # of their own to keep up to date. OpenWrt packages build against the SDK's
+      # libopenssl instead.
       - name: Build
-        run: cross build --release --target ${{ matrix.target }} --no-default-features --features vendored-openssl
+        run: cross build --release --locked --target ${{ matrix.target }}
 
       - name: Package
         run: |
diff --git a/Cargo.lock b/Cargo.lock
index 61f5eeb..c009534 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -855,15 +855,6 @@ version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
-[[package]]
-name = "openssl-src"
-version = "300.6.1+3.6.3"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46eb8fb9fb3b61ce1c0f8a026c4c1a0714d3a9e138e7fbde78753ce2babc3846"
-dependencies = [
- "cc",
-]
-
 [[package]]
 name = "openssl-sys"
 version = "0.9.117"
@@ -872,7 +863,6 @@ checksum = "b47e7e6bb2c38cd930d25a23b40fa52e068c10e85f3e03a7f5ba5aaca5713695"
 dependencies = [
  "cc",
  "libc",
- "openssl-src",
  "pkg-config",
  "vcpkg",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 9455537..4a9d454 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -55,9 +55,6 @@ rustls-tls = [
 # support, such as the 32-bit PowerPC e500v2 in Turris 1.x routers. This is what
 # OpenWrt packaging wants: it reuses the libopenssl already in the image.
 native-tls = ["dep:hyper-tls", "dep:native-tls", "dep:tokio-native-tls"]
-# As above, but builds OpenSSL from source and links it statically, for
-# cross-compiling without the target's OpenSSL headers at hand.
-vendored-openssl = ["native-tls", "native-tls/vendored"]
 
 [dependencies]
 anyhow = "1"
diff --git a/README.md b/README.md
index 69bc6ef..8e4a2e4 100644
--- a/README.md
+++ b/README.md
@@ -52,7 +52,6 @@ a reproducible build date in `--version`.
 | --- | --- | --- | --- |
 | `rustls-tls` (default) | rustls + ring | none, statically linked | anything |
 | `native-tls` | system OpenSSL | libopenssl | anything OpenSSL builds for |
-| `vendored-openssl` | OpenSSL built from source | none, statically linked | anything OpenSSL builds for |
 
 `ring` builds everywhere, falling back to portable C where it has no
 hand-written assembly, which is everything outside x86, x86_64, aarch64 and
@@ -291,8 +290,8 @@ one chain and stops at the first step that fails:
 2. **Checks** run [ci.yml](.github/workflows/ci.yml) against that commit:
    tests on three platforms, both TLS backends, the minimum supported Rust
    version, lint, the fuzz targets, the differential test against the Go
-   client and `cargo package`. Nothing is built or published until they
-   pass.
+   client and `cargo package`, and a tag with a known advisory in its
+   `Cargo.lock` stops too. Nothing is built or published until they pass.
 3. **Package the crate** verifies the tag against `version` in `Cargo.toml`
    and builds the `.crate` once, recording its SHA-256. A tag that disagrees
    stops the run here, before a release exists to leave behind.
diff --git a/deny.toml b/deny.toml
index e3808c9..548223d 100644
--- a/deny.toml
+++ b/deny.toml
@@ -5,6 +5,7 @@ targets = [
     "x86_64-unknown-linux-musl",
     "aarch64-unknown-linux-musl",
     "armv7-unknown-linux-musleabihf",
+    "arm-unknown-linux-musleabi",
     "powerpc-unknown-linux-musl",
     "x86_64-apple-darwin",
     "x86_64-pc-windows-msvc",