diff --git a/crates/obscura-net/src/wreq_client.rs b/crates/obscura-net/src/wreq_client.rs
index db3ad63..bc10a6c 100644
--- a/crates/obscura-net/src/wreq_client.rs
+++ b/crates/obscura-net/src/wreq_client.rs
@@ -36,10 +36,12 @@ impl StealthHttpClient {
     }
 
     pub fn with_proxy(cookie_jar: Arc<CookieJar>, proxy_url: Option<&str>) -> Self {
-        let cert_store = wreq::tls::CertStore::builder()
-            .set_default_paths()
-            .build()
-            .expect("Failed to load system CA certificates");
+        // Issue #184: `set_default_paths()` reads OpenSSL's compile-time CA
+        // paths, which only resolve on Linux. On Windows the store ends up
+        // empty and every TLS handshake fails with CERTIFICATE_VERIFY_FAILED.
+        // `CertStore::default()` uses wreq's bundled Mozilla roots
+        // (`webpki-root-certs`), which works the same on every platform.
+        let cert_store = wreq::tls::CertStore::default();
 
         let emulation_opts = wreq_util::EmulationOption::builder()
             .emulation(wreq_util::Emulation::Chrome145)