diff --git a/Cargo.lock b/Cargo.lock
index ae3a3bc3a611c..434fd3504964c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1281,7 +1281,7 @@ dependencies = [
  "pin-project",
  "quick-xml 0.31.0",
  "rand 0.8.5",
- "reqwest",
+ "reqwest 0.12.28",
  "rustc_version",
  "serde",
  "serde_json",
@@ -4340,7 +4340,7 @@ dependencies = [
  "parquet",
  "rand 0.8.5",
  "reqsign",
- "reqwest",
+ "reqwest 0.12.28",
  "roaring",
  "rust_decimal",
  "serde",
@@ -4370,7 +4370,7 @@ dependencies = [
  "http 1.4.0",
  "iceberg",
  "itertools 0.13.0",
- "reqwest",
+ "reqwest 0.12.28",
  "serde",
  "serde_derive",
  "serde_json",
@@ -4690,10 +4690,12 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.77"
+version = "0.3.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1cfaf33c695fc6e08064efbc1f72ec937429614f25eef83af942d0e227c3a28f"
+checksum = "2964e92d1d9dc3364cae4d718d93f227e3abb088e747d92e0395bfdedf1c12ca"
 dependencies = [
+ "cfg-if",
+ "futures-util",
  "once_cell",
  "wasm-bindgen",
 ]
@@ -5086,7 +5088,7 @@ version = "1.4.3"
 source = "git+https://github.com/MaterializeInc/duckdb-rs.git?rev=752c7efe2582#752c7efe25820590f590fb0a112443b9ddd396e7"
 dependencies = [
  "flate2",
- "reqwest",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
  "tar",
@@ -5513,7 +5515,7 @@ dependencies = [
  "mz-sql-parser",
  "open",
  "openssl-probe",
- "reqwest",
+ "reqwest 0.13.2",
  "rpassword",
  "security-framework",
  "semver",
@@ -5718,7 +5720,7 @@ dependencies = [
  "mz-frontegg-auth",
  "mz-ore",
  "mz-pgwire-common",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "tokio-postgres",
@@ -5829,7 +5831,7 @@ dependencies = [
  "postgres",
  "prometheus",
  "proxy-header",
- "reqwest",
+ "reqwest 0.13.2",
  "semver",
  "tempfile",
  "tokio",
@@ -5993,7 +5995,7 @@ dependencies = [
  "proptest",
  "proptest-derive",
  "prost-build",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "tokio",
@@ -6010,7 +6012,7 @@ dependencies = [
  "chrono",
  "mz-frontegg-auth",
  "mz-frontegg-client",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "thiserror 2.0.18",
  "tokio",
@@ -6281,7 +6283,7 @@ dependencies = [
  "mz-tls-util",
  "postgres-openssl",
  "regex",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_yaml",
  "tokio",
@@ -6470,7 +6472,7 @@ dependencies = [
  "rdkafka",
  "rdkafka-sys",
  "regex",
- "reqwest",
+ "reqwest 0.13.2",
  "rlimit",
  "semver",
  "sentry-tracing",
@@ -6634,7 +6636,7 @@ dependencies = [
  "prost",
  "prost-build",
  "prost-types",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "sha2",
@@ -6678,7 +6680,7 @@ dependencies = [
  "mz-ore",
  "mz-repr",
  "prometheus",
- "reqwest",
+ "reqwest 0.13.2",
  "reqwest-middleware",
  "reqwest-retry",
  "serde",
@@ -6696,7 +6698,7 @@ dependencies = [
  "jsonwebtoken",
  "mz-frontegg-auth",
  "mz-ore",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -6720,7 +6722,7 @@ dependencies = [
  "mz-frontegg-auth",
  "mz-ore",
  "openssl",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "tokio",
@@ -6891,7 +6893,7 @@ dependencies = [
 name = "mz-metabase"
 version = "0.0.0"
 dependencies = [
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
 ]
 
@@ -6968,7 +6970,7 @@ dependencies = [
  "flate2",
  "hex",
  "hex-literal",
- "reqwest",
+ "reqwest 0.13.2",
  "sha2",
  "tar",
  "walkdir",
@@ -6984,7 +6986,7 @@ dependencies = [
  "jsonwebtoken",
  "mz-ore",
  "openssl",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "tokio",
@@ -7024,7 +7026,7 @@ dependencies = [
  "mz-ore",
  "mz-repr",
  "mz-secrets",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "sha2",
@@ -7110,7 +7112,7 @@ dependencies = [
  "mz-server-core",
  "prometheus",
  "rand 0.9.4",
- "reqwest",
+ "reqwest 0.13.2",
  "semver",
  "serde",
  "serde_json",
@@ -7249,7 +7251,7 @@ dependencies = [
  "prost",
  "prost-build",
  "rand 0.9.4",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "sha2",
@@ -7860,7 +7862,7 @@ dependencies = [
  "protobuf-native",
  "rdkafka",
  "regex",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "static_assertions",
@@ -8000,7 +8002,7 @@ dependencies = [
  "mz-tracing",
  "postgres-protocol",
  "regex",
- "reqwest",
+ "reqwest 0.13.2",
  "serde_json",
  "shell-words",
  "tempfile",
@@ -8239,7 +8241,7 @@ dependencies = [
  "prometheus",
  "proptest",
  "prost",
- "reqwest",
+ "reqwest 0.13.2",
  "sentry",
  "serde",
  "smallvec",
@@ -8312,7 +8314,8 @@ dependencies = [
  "rand 0.9.4",
  "rdkafka",
  "regex",
- "reqwest",
+ "reqwest 0.12.28",
+ "reqwest 0.13.2",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -8398,7 +8401,7 @@ dependencies = [
  "rand 0.9.4",
  "rdkafka",
  "regex",
- "reqwest",
+ "reqwest 0.13.2",
  "semver",
  "serde",
  "serde_json",
@@ -8907,7 +8910,7 @@ dependencies = [
  "percent-encoding",
  "quick-xml 0.38.4",
  "reqsign",
- "reqwest",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
  "tokio",
@@ -9036,7 +9039,7 @@ dependencies = [
  "bytes",
  "http 1.4.0",
  "opentelemetry",
- "reqwest",
+ "reqwest 0.12.28",
 ]
 
 [[package]]
@@ -9051,7 +9054,7 @@ dependencies = [
  "opentelemetry-proto",
  "opentelemetry_sdk",
  "prost",
- "reqwest",
+ "reqwest 0.12.28",
  "thiserror 2.0.18",
  "tokio",
  "tonic",
@@ -10517,7 +10520,7 @@ dependencies = [
  "percent-encoding",
  "quick-xml 0.37.5",
  "rand 0.8.5",
- "reqwest",
+ "reqwest 0.12.28",
  "rust-ini",
  "serde",
  "serde_json",
@@ -10531,6 +10534,46 @@ name = "reqwest"
 version = "0.12.28"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "eddd3ca559203180a307f12d114c268abf583f59b03cb906fd0b3ff8646c1147"
+dependencies = [
+ "base64 0.22.1",
+ "bytes",
+ "futures-channel",
+ "futures-core",
+ "futures-util",
+ "http 1.4.0",
+ "http-body 1.0.1",
+ "http-body-util",
+ "hyper 1.9.0",
+ "hyper-tls 0.6.0",
+ "hyper-util",
+ "js-sys",
+ "log",
+ "native-tls",
+ "percent-encoding",
+ "pin-project-lite",
+ "rustls-pki-types",
+ "serde",
+ "serde_json",
+ "serde_urlencoded",
+ "sync_wrapper",
+ "tokio",
+ "tokio-native-tls",
+ "tokio-util",
+ "tower 0.5.3",
+ "tower-http",
+ "tower-service",
+ "url",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "wasm-streams 0.4.1",
+ "web-sys",
+]
+
+[[package]]
+name = "reqwest"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ab3f43e3283ab1488b624b44b0e988d0acea0b3214e694730a055cb6b2efa801"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -10568,30 +10611,30 @@ dependencies = [
  "url",
  "wasm-bindgen",
  "wasm-bindgen-futures",
- "wasm-streams",
+ "wasm-streams 0.5.0",
  "web-sys",
 ]
 
 [[package]]
 name = "reqwest-middleware"
-version = "0.4.2"
+version = "0.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "57f17d28a6e6acfe1733fe24bcd30774d13bffa4b8a22535b4c8c98423088d4e"
+checksum = "199dda04a536b532d0cc04d7979e39b1c763ea749bf91507017069c00b96056f"
 dependencies = [
  "anyhow",
  "async-trait",
  "http 1.4.0",
- "reqwest",
+ "reqwest 0.13.2",
  "serde",
- "thiserror 1.0.69",
+ "thiserror 2.0.18",
  "tower-service",
 ]
 
 [[package]]
 name = "reqwest-retry"
-version = "0.8.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "105747e3a037fe5bf17458d794de91149e575b6183fc72c85623a44abb9683f5"
+checksum = "fe2412db2af7d2268e7a5406be0431f37d9eb67ff390f35b395716f5f06c2eaa"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -10599,7 +10642,7 @@ dependencies = [
  "getrandom 0.2.16",
  "http 1.4.0",
  "hyper 1.9.0",
- "reqwest",
+ "reqwest 0.13.2",
  "reqwest-middleware",
  "retry-policies",
  "thiserror 2.0.18",
@@ -11012,7 +11055,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "971369158e31ad10bd73b558625f99de39554a2f00c2ff886a6796d950e69664"
 dependencies = [
  "async-trait",
- "reqwest",
+ "reqwest 0.12.28",
  "serde",
  "serde_json",
  "thiserror 2.0.18",
@@ -11047,7 +11090,7 @@ checksum = "2f925d575b468e88b079faf590a8dd0c9c99e2ec29e9bab663ceb8b45056312f"
 dependencies = [
  "httpdate",
  "native-tls",
- "reqwest",
+ "reqwest 0.12.28",
  "sentry-backtrace",
  "sentry-contexts",
  "sentry-core",
@@ -13136,47 +13179,32 @@ checksum = "b8dad83b4f25e74f184f64c43b150b91efe7647395b42289f38e50566d82855b"
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.100"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1edc8929d7499fc4e8f0be2262a241556cfc54a0bea223790e71446f2aab1ef5"
+checksum = "0bf938a0bacb0469e83c1e148908bd7d5a6010354cf4fb73279b7447422e3a89"
 dependencies = [
  "cfg-if",
  "once_cell",
  "rustversion",
  "wasm-bindgen-macro",
-]
-
-[[package]]
-name = "wasm-bindgen-backend"
-version = "0.2.100"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2f0a0651a5c2bc21487bde11ee802ccaf4c51935d0d3d42a6101f98161700bc6"
-dependencies = [
- "bumpalo",
- "log",
- "proc-macro2",
- "quote",
- "syn 2.0.117",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.37"
+version = "0.4.68"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c02dbc21516f9f1f04f187958890d7e6026df8d16540b7ad9492bc34a67cea03"
+checksum = "f371d383f2fb139252e0bfac3b81b265689bf45b6874af544ffa4c975ac1ebf8"
 dependencies = [
- "cfg-if",
  "js-sys",
  "wasm-bindgen",
- "web-sys",
 ]
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.100"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7fe63fc6d09ed3792bd0897b314f53de8e16568c2b3f7982f468c0bf9bd0b407"
+checksum = "eeff24f84126c0ec2db7a449f0c2ec963c6a49efe0698c4242929da037ca28ed"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -13184,22 +13212,22 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.100"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8ae87ea40c9f689fc23f209965b6fb8a99ad69aeeb0231408be24920604395de"
+checksum = "9d08065faf983b2b80a79fd87d8254c409281cf7de75fc4b773019824196c904"
 dependencies = [
+ "bumpalo",
  "proc-macro2",
  "quote",
  "syn 2.0.117",
- "wasm-bindgen-backend",
  "wasm-bindgen-shared",
 ]
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.100"
+version = "0.2.118"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a05d73b933a847d6cccdda8f838a22ff101ad9bf93e33684f39c1f5f0eece3d"
+checksum = "5fd04d9e306f1907bd13c6361b5c6bfc7b3b3c095ed3f8a9246390f8dbdee129"
 dependencies = [
  "unicode-ident",
 ]
@@ -13217,6 +13245,19 @@ dependencies = [
  "web-sys",
 ]
 
+[[package]]
+name = "wasm-streams"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "9d1ec4f6517c9e11ae630e200b2b65d193279042e28edd4a2cda233e46670bbb"
+dependencies = [
+ "futures-util",
+ "js-sys",
+ "wasm-bindgen",
+ "wasm-bindgen-futures",
+ "web-sys",
+]
+
 [[package]]
 name = "wasmtimer"
 version = "0.4.3"
@@ -13233,9 +13274,9 @@ dependencies = [
 
 [[package]]
 name = "web-sys"
-version = "0.3.77"
+version = "0.3.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "33b6dd2ef9186f1f2072e409e99cd22a975331a6b3591b12c764e0e55c60d5d2"
+checksum = "4f2dfbb17949fa2088e5d39408c48368947b86f7834484e87b73de55bc14d97d"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
diff --git a/Cargo.toml b/Cargo.toml
index 786754b7f2064..705aeb2c9f677 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -443,9 +443,15 @@ rdkafka = { version = "0.29.0", features = ["cmake-build", "libz-static", "ssl-v
 rdkafka-sys = { version = "4.3.0", features = ["cmake-build", "libz-static", "ssl-vendored", "zstd"] }
 regex = "1.12.3"
 regex-syntax = "0.8.10"
-reqwest = { version = "0.12.28", features = ["blocking", "charset", "cookies", "default-tls", "http2", "json", "native-tls-vendored", "stream"] }
-reqwest-middleware = { version = "0.4.2", features = ["json"] }
-reqwest-retry = "0.8.0"
+# reqwest 0.13 changed defaults: `default-tls` now pulls in rustls
+# (banned) and `query`/`system-proxy` are opt-in. List features
+# explicitly to stay on native-tls.
+reqwest = { version = "0.13.2", default-features = false, features = ["blocking", "charset", "cookies", "http2", "json", "native-tls", "native-tls-vendored", "query", "stream", "system-proxy"] }
+# Satisfies reqsign 0.16's `AwsCredentialLoad` trait, pulled in via our
+# iceberg fork and pinned to reqwest 0.12. Remove once iceberg bumps.
+reqwest_0_12 = { package = "reqwest", version = "0.12", default-features = false }
+reqwest-middleware = { version = "0.5.1", features = ["json"] }
+reqwest-retry = "0.9.1"
 rlimit = "0.11.0"
 rocksdb = { version = "0.24.0", default-features = false, features = ["lz4", "snappy", "zstd"] }
 ropey = "1.6.1"
diff --git a/deny.toml b/deny.toml
index 75db5b2ec6517..56c5f8a8480ab 100644
--- a/deny.toml
+++ b/deny.toml
@@ -128,6 +128,8 @@ skip = [
     { name = "fallible-iterator", version = "0.3.0" },
     # arrow
     { name = "hashbrown", version = "0.16.1" },
+    # reqwest_0_12 workspace alias; see Cargo.toml.
+    { name = "reqwest", version = "0.12" },
 ]
 
 [[bans.deny]]
diff --git a/src/persist/src/azure.rs b/src/persist/src/azure.rs
index 92248a3f5f754..d83866d94ed8f 100644
--- a/src/persist/src/azure.rs
+++ b/src/persist/src/azure.rs
@@ -11,7 +11,7 @@
 
 use anyhow::{Context, anyhow};
 use async_trait::async_trait;
-use azure_core::{ExponentialRetryOptions, RetryOptions, StatusCode, TransportOptions};
+use azure_core::{ExponentialRetryOptions, RetryOptions, StatusCode};
 use azure_identity::create_default_credential;
 use azure_storage::{CloudLocation, EMULATOR_ACCOUNT, prelude::*};
 use azure_storage_blobs::blob::operations::GetBlobResponse;
@@ -70,6 +70,11 @@ impl AzureBlobConfig {
     ) -> Result<Self, Error> {
         let client = if account == EMULATOR_ACCOUNT {
             info!("Connecting to Azure emulator");
+            // Per-attempt/read/connect-timeout plumbing via `TransportOptions`
+            // was dropped: azure_core 0.21 pins reqwest 0.12 internally, so our
+            // 0.13 client no longer satisfies its `HttpClient` trait. Restored
+            // on the new SDK in the azure_sdk migration PR; `operation_timeout`
+            // still applies via the retry policy.
             ClientBuilder::with_location(
                 CloudLocation::Emulator {
                     address: url.domain().expect("domain for Azure emulator").to_string(),
@@ -77,18 +82,6 @@ impl AzureBlobConfig {
                 },
                 StorageCredentials::emulator(),
             )
-            .transport({
-                // Azure uses reqwest / hyper internally, but we specify a client explicitly to
-                // plumb through our timeouts.
-                TransportOptions::new(Arc::new(
-                    reqwest::ClientBuilder::new()
-                        .timeout(knobs.operation_attempt_timeout())
-                        .read_timeout(knobs.read_timeout())
-                        .connect_timeout(knobs.connect_timeout())
-                        .build()
-                        .expect("valid config for azure HTTP client"),
-                ))
-            })
             .retry(RetryOptions::exponential(
                 ExponentialRetryOptions::default().max_total_elapsed(knobs.operation_timeout()),
             ))
diff --git a/src/storage-types/Cargo.toml b/src/storage-types/Cargo.toml
index e7051e44e0148..76e45a4afef24 100644
--- a/src/storage-types/Cargo.toml
+++ b/src/storage-types/Cargo.toml
@@ -61,6 +61,8 @@ prost.workspace = true
 rdkafka.workspace = true
 regex.workspace = true
 reqwest.workspace = true
+# For impls of `iceberg::io::AwsCredentialLoad` (reqsign 0.16); see workspace Cargo.toml.
+reqwest_0_12 = { workspace = true }
 serde.workspace = true
 serde_json = { workspace = true, features = ["preserve_order"] }
 thiserror.workspace = true
diff --git a/src/storage-types/src/connections.rs b/src/storage-types/src/connections.rs
index ba388cfe74287..0398317b56719 100644
--- a/src/storage-types/src/connections.rs
+++ b/src/storage-types/src/connections.rs
@@ -100,7 +100,8 @@ impl AwsSdkCredentialLoader {
 impl AwsCredentialLoad for AwsSdkCredentialLoader {
     async fn load_credential(
         &self,
-        _client: reqwest::Client,
+        // reqsign 0.16 trait signature; see `reqwest_0_12` in workspace Cargo.toml.
+        _client: reqwest_0_12::Client,
     ) -> anyhow::Result<Option<AwsCredential>> {
         let creds = self
             .provider
diff --git a/test/testdrive/webhook.td b/test/testdrive/webhook.td
index 5cecc0346bdad..9b8bcaeaf0b8c 100644
--- a/test/testdrive/webhook.td
+++ b/test/testdrive/webhook.td
@@ -296,7 +296,7 @@ will_work
 
 > CREATE SOURCE webhook_text_headers_block_list IN CLUSTER webhook_cluster FROM WEBHOOK
   BODY FORMAT TEXT
-  INCLUDE HEADERS (NOT 'accept', NOT 'host')
+  INCLUDE HEADERS (NOT 'accept', NOT 'accept-encoding', NOT 'host')
 
 $ webhook-append name=webhook_text_headers_block_list
 foo
@@ -318,7 +318,7 @@ anotha_one "{x-random=>bar}"
   BODY FORMAT TEXT
   INCLUDE HEADER 'x-timestamp' as event_timestamp
   INCLUDE HEADER 'x-id' as event_id
-  INCLUDE HEADERS (NOT 'accept', NOT 'content-length', NOT 'host', NOT 'x-api-key')
+  INCLUDE HEADERS (NOT 'accept', NOT 'accept-encoding', NOT 'content-length', NOT 'host', NOT 'x-api-key')
   CHECK ( WITH (HEADERS) headers->'x-api-key' = 'abc123' )
 
 $ webhook-append name=webhook_text_filtering_headers x-timestamp=100 x-id=a x-api-key=abc123 content-type=text/example