diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 6cf520e..2753207 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
       - name: setup node
         uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 24
       - name: install pnpm
         uses: pnpm/action-setup@v4
         with: 
@@ -37,7 +37,7 @@ jobs:
       - name: install pnpm packages
         run: pnpm install
       - name: build Oxyde
-        uses: tauri-apps/tauri-action@v0
+        uses: tauri-apps/tauri-action@latest
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SURREAL_URL: ${{ secrets.SURREAL_URL }}
diff --git a/src-tauri/Cargo.lock b/src-tauri/Cargo.lock
index 025d22a..64618be 100644
--- a/src-tauri/Cargo.lock
+++ b/src-tauri/Cargo.lock
@@ -906,7 +906,7 @@ dependencies = [
  "bitflags 2.11.1",
  "core-foundation",
  "core-graphics-types",
- "foreign-types",
+ "foreign-types 0.5.0",
  "libc",
 ]
 
@@ -1640,6 +1640,15 @@ version = "0.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "77ce24cb58228fbb8aa041425bb1050850ac19177686ea6e0f41a70416f56fdb"
 
+[[package]]
+name = "foreign-types"
+version = "0.3.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f6f339eb8adc052cd2ca78910fda869aefa38d22d5cb648e6485e4d3fc06f3b1"
+dependencies = [
+ "foreign-types-shared 0.1.1",
+]
+
 [[package]]
 name = "foreign-types"
 version = "0.5.0"
@@ -1647,7 +1656,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d737d9aa519fb7b749cbc3b962edcf310a8dd1f4b67c91c4f83975dbdd17d965"
 dependencies = [
  "foreign-types-macros",
- "foreign-types-shared",
+ "foreign-types-shared 0.3.1",
 ]
 
 [[package]]
@@ -1661,6 +1670,12 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "foreign-types-shared"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "00b0228411908ca8685dba7fc2cdd70ec9990a6e753e89b6ac91a84c40fbaf4b"
+
 [[package]]
 name = "foreign-types-shared"
 version = "0.3.1"
@@ -2566,6 +2581,22 @@ dependencies = [
  "tower-service",
 ]
 
+[[package]]
+name = "hyper-tls"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "70206fc6890eaca9fde8a0bf71caa2ddfc9fe045ac9e5c70df101a7dbde866e0"
+dependencies = [
+ "bytes",
+ "http-body-util",
+ "hyper",
+ "hyper-util",
+ "native-tls",
+ "tokio",
+ "tokio-native-tls",
+ "tower-service",
+]
+
 [[package]]
 name = "hyper-util"
 version = "0.1.20"
@@ -3335,6 +3366,23 @@ dependencies = [
  "windows-sys 0.60.2",
 ]
 
+[[package]]
+name = "native-tls"
+version = "0.2.18"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "465500e14ea162429d264d44189adc38b199b62b1c21eea9f69e4b73cb03bbf2"
+dependencies = [
+ "libc",
+ "log",
+ "openssl",
+ "openssl-probe",
+ "openssl-sys",
+ "schannel",
+ "security-framework",
+ "security-framework-sys",
+ "tempfile",
+]
+
 [[package]]
 name = "ndarray"
 version = "0.17.2"
@@ -3714,12 +3762,50 @@ dependencies = [
  "pathdiff",
 ]
 
+[[package]]
+name = "openssl"
+version = "0.10.77"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bfe4646e360ec77dff7dde40ed3d6c5fee52d156ef4a62f53973d38294dad87f"
+dependencies = [
+ "bitflags 2.11.1",
+ "cfg-if",
+ "foreign-types 0.3.2",
+ "libc",
+ "once_cell",
+ "openssl-macros",
+ "openssl-sys",
+]
+
+[[package]]
+name = "openssl-macros"
+version = "0.1.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "a948666b637a0f465e8564c73e89d4dde00d72d4d473cc972f390fc3dcee7d9c"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "openssl-probe"
 version = "0.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7c87def4c32ab89d880effc9e097653c8da5d6ef28e6b539d313baaacfbafcbe"
 
+[[package]]
+name = "openssl-sys"
+version = "0.9.113"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ad2f2c0eba47118757e4c6d2bff2838f3e0523380021356e7875e858372ce644"
+dependencies = [
+ "cc",
+ "libc",
+ "pkg-config",
+ "vcpkg",
+]
+
 [[package]]
 name = "option-ext"
 version = "0.2.0"
@@ -4758,10 +4844,12 @@ dependencies = [
  "http-body-util",
  "hyper",
  "hyper-rustls",
+ "hyper-tls",
  "hyper-util",
  "js-sys",
  "log",
  "mime_guess",
+ "native-tls",
  "percent-encoding",
  "pin-project-lite",
  "quinn",
@@ -4772,6 +4860,7 @@ dependencies = [
  "serde_json",
  "sync_wrapper",
  "tokio",
+ "tokio-native-tls",
  "tokio-rustls",
  "tokio-util",
  "tower",
@@ -5786,6 +5875,7 @@ dependencies = [
  "getrandom 0.3.4",
  "indexmap 2.14.0",
  "js-sys",
+ "native-tls",
  "path-clean",
  "reqwest",
  "ring",
@@ -6518,6 +6608,16 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "tokio-native-tls"
+version = "0.3.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bbae76ab933c85776efabc971569dd6119c580d8f5d448769dec1764bf796ef2"
+dependencies = [
+ "native-tls",
+ "tokio",
+]
+
 [[package]]
 name = "tokio-rustls"
 version = "0.26.4"
@@ -6547,9 +6647,11 @@ checksum = "d25a406cddcc431a75d3d9afc6a7c0f7428d4891dd973e4d54c56b46127bf857"
 dependencies = [
  "futures-util",
  "log",
+ "native-tls",
  "rustls",
  "rustls-pki-types",
  "tokio",
+ "tokio-native-tls",
  "tokio-rustls",
  "tungstenite",
  "webpki-roots 0.26.11",
@@ -6863,6 +6965,7 @@ dependencies = [
  "http",
  "httparse",
  "log",
+ "native-tls",
  "rand 0.9.4",
  "rustls",
  "rustls-pki-types",
@@ -7044,6 +7147,12 @@ version = "0.9.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b1982d899e57d646498709735f16e9224cf1e8680676ad687f930cf8b5b555ae"
 
+[[package]]
+name = "vcpkg"
+version = "0.2.15"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "accd4ea62f7bb7a82fe23066fb0957d48ef677f6eeb8215f372f52e48bb32426"
+
 [[package]]
 name = "version-compare"
 version = "0.2.1"
diff --git a/src-tauri/Cargo.toml b/src-tauri/Cargo.toml
index 8513763..58d6e84 100644
--- a/src-tauri/Cargo.toml
+++ b/src-tauri/Cargo.toml
@@ -22,7 +22,7 @@ tauri = { version = "2", features = [] }
 tauri-plugin-opener = "2"
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
-surrealdb = { version = "3.0.5" }
+surrealdb = { version = "3.0.5", features = ["native-tls"] }
 surrealdb-types = { version = "3.0.5" }
 tokio = { version = "1.52.0", features = ["full"] }
 thiserror = "2.0.18"
diff --git a/src-tauri/src/db.rs b/src-tauri/src/db.rs
index f2e9cc2..47fb577 100644
--- a/src-tauri/src/db.rs
+++ b/src-tauri/src/db.rs
@@ -2,24 +2,37 @@ use std::collections::HashMap;
 use std::sync::{Arc, Mutex, LazyLock};
 use std::env;
 
-use surrealdb::engine::remote::ws::{Client, Ws};
+use surrealdb::engine::remote::ws::{Client, Ws, Wss};
 use surrealdb::Surreal;
 use tokio::task::JoinHandle;
 use uuid::Uuid;
 
 use crate::error::AppError;
 
+// This should set the env variable correctly both during compile time and runtime (for development).
 pub static SURREAL_URL: LazyLock<String> = LazyLock::new(|| {
-    env::var("SURREAL_URL").unwrap_or_else(|_| "localhost:8000".to_string())
+    option_env!("SURREAL_URL")
+        .map(str::to_string)
+        .unwrap_or_else(|| env::var("SURREAL_URL")
+            .unwrap_or_else(|_| "ws://localhost:8000".to_string()))
 });
 pub static SURREAL_NS: LazyLock<String> = LazyLock::new(|| {
-    env::var("SURREAL_NS").unwrap_or_else(|_| "dev".to_string())
+    option_env!("SURREAL_NS")
+        .map(str::to_string)
+        .unwrap_or_else(|| env::var("SURREAL_NS")
+            .unwrap_or_else(|_| "dev".to_string()))
 });
 pub static SURREAL_DB: LazyLock<String> = LazyLock::new(|| {
-    env::var("SURREAL_DB").unwrap_or_else(|_| "oxyde".to_string())
+    option_env!("SURREAL_DB")
+        .map(str::to_string)
+        .unwrap_or_else(|| env::var("SURREAL_DB")
+            .unwrap_or_else(|_| "oxyde".to_string()))
 });
 pub static SURREAL_ACCESS: LazyLock<String> = LazyLock::new(|| {
-    env::var("SURREAL_ACCESS").unwrap_or_else(|_| "account".to_string())
+    option_env!("SURREAL_ACCESS")
+        .map(str::to_string)
+        .unwrap_or_else(|| env::var("SURREAL_ACCESS")
+            .unwrap_or_else(|_| "account".to_string()))
 });
 
 pub struct AppState {
@@ -36,9 +49,23 @@ pub struct AppState {
 }
 
 /// Connect to SurrealDB over WebSocket and select namespace/database.
+/// URL may include protocol prefix: `ws://`, `wss://`, `http://`, or `https://`.
+/// `wss://` and `https://` use TLS; others use plain WebSocket.
 /// Call once at app startup before managing state.
 pub async fn init_db(url: &str, ns: &str, db: &str) -> Result<Surreal<Client>, AppError> {
-    let client = Surreal::new::<Ws>(url).await?;
+    let client = if url.starts_with("wss://") || url.starts_with("https://") {
+        let host = url
+            .strip_prefix("wss://")
+            .or_else(|| url.strip_prefix("https://"))
+            .unwrap_or(url);
+        Surreal::new::<Wss>(host).await?
+    } else {
+        let host = url
+            .strip_prefix("ws://")
+            .or_else(|| url.strip_prefix("http://"))
+            .unwrap_or(url);
+        Surreal::new::<Ws>(host).await?
+    };
     client.use_ns(ns).use_db(db).await?;
     Ok(client)
 }
diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 835b5be..051a890 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -24,7 +24,7 @@
   },
   "bundle": {
     "active": true,
-    "targets": ["deb", "nsis", "app"],
+    "targets": ["deb", "nsis"],
     "icon": [
       "icons/32x32.png",
       "icons/128x128.png",