diff --git a/crates/rhema-cloudflare-code/Cargo.toml b/crates/rhema-cloudflare-code/Cargo.toml
index 35fcbb6..968388d 100644
--- a/crates/rhema-cloudflare-code/Cargo.toml
+++ b/crates/rhema-cloudflare-code/Cargo.toml
@@ -42,8 +42,11 @@ rhema-rsd = { version = "0.2.6", default-features = false }
 rhema-sandbox = { version = "0.2.6", default-features = false }
 # The protocol's HTTPS client: the `HttpTransport` seam this worker
 # implements over host fetch, plus the `HttpSandbox` the `http` backend
-# drives — reqwest behind its `native` feature, off here, workerd has
-# no sockets
+# drives. Featureless on wasm — workerd has no sockets — but with the
+# crate's native transport on host builds: the host compiles the
+# neutral half, and its only real transport is reqwest. The crate's
+# own cfg keeps the reqwest code native-only; the feature brings the
+# dependency.
 rhema-sandbox-http = { version = "0.2.6", default-features = false }
 rhema-transcript = { version = "0.2.6" }
 # The typed errors the backend choice and the turn's durable pieces report
@@ -52,6 +55,12 @@ async-trait = { workspace = true }
 serde = { workspace = true }
 serde_json = { workspace = true }
 
+# The same client with its native transport, host-only: the declaration
+# above keeps the wasm build featureless, this one gives the host build
+# the reqwest transport.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+rhema-sandbox-http = { version = "0.2.6", default-features = false, features = ["native"] }
+
 [target.'cfg(target_arch = "wasm32")'.dependencies]
 # Pinned to 0.8 (verified against this tree): the DurableObject trait,
 # SqlStorage, WebSocket, and Delay APIs this crate uses are 0.8-shaped;