diff --git a/src-tauri/src/lib.rs b/src-tauri/src/lib.rs
index ae73a24..15282ae 100644
--- a/src-tauri/src/lib.rs
+++ b/src-tauri/src/lib.rs
@@ -112,6 +112,9 @@ fn write_log(path: &std::path::Path, msg: &str) -> std::io::Result<()> {
 
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
+    // Install rustls crypto provider before any TLS operations (RDP needs this)
+    let _ = tokio_rustls::rustls::crypto::aws_lc_rs::default_provider().install_default();
+
     // Initialize file-based logging to data_dir/wraith.log
     let log_path = data_directory().join("wraith.log");
     let _ = write_log(&log_path, "=== Wraith starting ===");
diff --git a/src-tauri/src/rdp/mod.rs b/src-tauri/src/rdp/mod.rs
index 48c0b13..e049302 100644
--- a/src-tauri/src/rdp/mod.rs
+++ b/src-tauri/src/rdp/mod.rs
@@ -269,7 +269,7 @@ impl RdpService {
 
 impl Clone for RdpService {
     fn clone(&self) -> Self {
-        unreachable!("RdpService should not be cloned — access via State<AppState>");
+        Self { sessions: self.sessions.clone() }
     }
 }