diff --git a/Cargo.toml b/Cargo.toml
index a8193c3f0ed..b938992bc30 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -47,7 +47,14 @@ chrono = "0.4.38"
 bs58 = "0.5.1"
 clap = { version = "4.5.4", features = ["derive", "env"] }
 derivative = "2.2.0"
-diesel = { version = "2.2.7", features = ["postgres", "serde_json", "numeric", "r2d2", "chrono", "i-implement-a-third-party-backend-and-opt-into-breaking-changes"] }
+diesel = { version = "2.2.7", features = [
+    "postgres",
+    "serde_json",
+    "numeric",
+    "r2d2",
+    "chrono",
+    "i-implement-a-third-party-backend-and-opt-into-breaking-changes",
+] }
 diesel-derive-enum = { version = "2.1.0", features = ["postgres"] }
 diesel-dynamic-schema = { version = "0.2.3", features = ["postgres"] }
 diesel_derives = "2.2.3"
diff --git a/graph/src/firehose/endpoints.rs b/graph/src/firehose/endpoints.rs
index 0ec95c3e2c5..448eb845496 100644
--- a/graph/src/firehose/endpoints.rs
+++ b/graph/src/firehose/endpoints.rs
@@ -194,9 +194,14 @@ impl FirehoseEndpoint {
 
         let endpoint_builder = match uri.scheme().unwrap_or(&Scheme::HTTP).as_str() {
             "http" => Channel::builder(uri),
-            "https" => Channel::builder(uri)
-                .tls_config(ClientTlsConfig::new())
-                .expect("TLS config on this host is invalid"),
+            "https" => {
+                let mut tls = ClientTlsConfig::new();
+                tls = tls.with_native_roots();
+
+                Channel::builder(uri)
+                    .tls_config(tls)
+                    .expect("TLS config on this host is invalid")
+            }
             _ => panic!("invalid uri scheme for firehose endpoint"),
         };