diff --git a/Cargo.lock b/Cargo.lock
index 69bb6d213bf9..8fdd4e279037 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -7623,7 +7623,7 @@ dependencies = [
  "openssl",
  "panic-message",
  "parking_lot 0.12.1",
- "reqwest 0.11.20",
+ "reqwest 0.12.2",
  "risingwave_common",
  "risingwave_sqlparser",
  "serde",
@@ -8858,6 +8858,7 @@ dependencies = [
  "base64 0.21.7",
  "bytes",
  "encoding_rs",
+ "futures-channel",
  "futures-core",
  "futures-util",
  "h2 0.4.3",
@@ -8983,7 +8984,7 @@ dependencies = [
  "madsim-tokio",
  "redis",
  "regex",
- "reqwest 0.11.20",
+ "reqwest 0.12.2",
  "serde",
  "serde_json",
  "serde_with",
@@ -9257,7 +9258,7 @@ dependencies = [
  "prost 0.12.1",
  "rand",
  "regex",
- "reqwest 0.11.20",
+ "reqwest 0.12.2",
  "risingwave-fields-derive",
  "risingwave_common_estimate_size",
  "risingwave_common_metrics",
@@ -9565,7 +9566,7 @@ dependencies = [
  "rand",
  "redis",
  "regex",
- "reqwest 0.11.20",
+ "reqwest 0.12.2",
  "risingwave_common",
  "risingwave_common_estimate_size",
  "risingwave_jni_core",
@@ -14687,6 +14688,7 @@ dependencies = [
  "regex-automata 0.4.5",
  "regex-syntax 0.8.2",
  "reqwest 0.11.20",
+ "reqwest 0.12.2",
  "ring 0.16.20",
  "rust_decimal",
  "rustc-hash",
diff --git a/Cargo.toml b/Cargo.toml
index 30b60c14d4ce..33683e6ee27e 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -109,7 +109,7 @@ aws-smithy-http = "0.60"
 aws-smithy-runtime-api = "1"
 aws-smithy-runtime = "1"
 aws-smithy-types = { version = "1", default-features = false, features = [
-  "hyper-0-14-x",
+  "hyper-0-14-x", # required by aws sdk
 ] }
 aws-endpoint = "0.60"
 aws-types = "1"
diff --git a/src/common/Cargo.toml b/src/common/Cargo.toml
index d37fe65ea23a..dcc80c256832 100644
--- a/src/common/Cargo.toml
+++ b/src/common/Cargo.toml
@@ -75,7 +75,7 @@ prometheus = { version = "0.13" }
 prost = { workspace = true }
 rand = "0.8"
 regex = "1"
-reqwest = { version = "0.11", features = ["json"] }
+reqwest = { version = "0.12.2", features = ["json"] }
 risingwave-fields-derive = { path = "./fields-derive" }
 risingwave_common_estimate_size = { workspace = true }
 risingwave_common_metrics = { path = "./metrics" }
diff --git a/src/common/common_service/Cargo.toml b/src/common/common_service/Cargo.toml
index ea228f9dcba8..4f39105be207 100644
--- a/src/common/common_service/Cargo.toml
+++ b/src/common/common_service/Cargo.toml
@@ -17,7 +17,7 @@ normal = ["workspace-hack"]
 [dependencies]
 async-trait = "0.1"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
-hyper = "0.14"
+hyper = "0.14" # required by tonic
 prometheus = { version = "0.13" }
 risingwave_common = { workspace = true }
 risingwave_pb = { workspace = true }
diff --git a/src/common/common_service/src/metrics_manager.rs b/src/common/common_service/src/metrics_manager.rs
index b7e57a41ecd2..2a284294cf7d 100644
--- a/src/common/common_service/src/metrics_manager.rs
+++ b/src/common/common_service/src/metrics_manager.rs
@@ -44,6 +44,7 @@ impl MetricsManager {
                         GLOBAL_METRICS_REGISTRY.deref().clone(),
                     ))
                     .service_fn(Self::metrics_service);
+                // TODO: use axum server
                 let serve_future =
                     hyper::Server::bind(&listen_socket_addr).serve(Shared::new(service));
                 if let Err(err) = serve_future.await {
diff --git a/src/common/metrics/Cargo.toml b/src/common/metrics/Cargo.toml
index 46d497b8768c..af0429c84873 100644
--- a/src/common/metrics/Cargo.toml
+++ b/src/common/metrics/Cargo.toml
@@ -20,7 +20,7 @@ clap = { version = "4", features = ["derive"] }
 easy-ext = "1"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
 http = "0.2"
-hyper = { version = "0.14", features = ["client"] }
+hyper = { version = "0.14", features = ["client"] } # used by tonic
 hytra = { workspace = true }
 itertools = "0.12"
 parking_lot = "0.12"
diff --git a/src/compute/Cargo.toml b/src/compute/Cargo.toml
index 62bf74d21c37..3ac4777c05d5 100644
--- a/src/compute/Cargo.toml
+++ b/src/compute/Cargo.toml
@@ -23,7 +23,7 @@ either = "1"
 foyer = { workspace = true }
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
 futures-async-stream = { workspace = true }
-hyper = "0.14"
+hyper = "0.14" # required by tonic
 itertools = "0.12"
 maplit = "1.0.2"
 pprof = { version = "0.13", features = ["flamegraph"] }
diff --git a/src/connector/Cargo.toml b/src/connector/Cargo.toml
index 1f2ba18373b9..0212d08f23f9 100644
--- a/src/connector/Cargo.toml
+++ b/src/connector/Cargo.toml
@@ -66,7 +66,7 @@ hyper = { version = "0.14", features = [
     "http1",
     "http2",
     "stream",
-] }
+] } # required by clickhouse client
 hyper-tls = "0.5"
 icelake = { workspace = true }
 indexmap = { version = "1.9.3", features = ["serde"] }
@@ -111,7 +111,7 @@ rdkafka = { workspace = true, features = [
 ] }
 redis = { version = "0.25", features = ["aio", "tokio-comp", "async-std-comp"] }
 regex = "1.4"
-reqwest = { version = "0.11", features = ["json"] }
+reqwest = { version = "0.12.2", features = ["json"] }
 risingwave_common = { workspace = true }
 risingwave_common_estimate_size = { workspace = true }
 risingwave_jni_core = { workspace = true }
diff --git a/src/connector/src/sink/doris.rs b/src/connector/src/sink/doris.rs
index 4a5a1ded01f9..be3976f30fd6 100644
--- a/src/connector/src/sink/doris.rs
+++ b/src/connector/src/sink/doris.rs
@@ -12,6 +12,8 @@
 // See the License for the specific language governing permissions and
 // limitations under the License.
 
+// TODO: use hyper 1 or reqwest 0.12.2
+
 use std::collections::HashMap;
 use std::sync::Arc;
 
diff --git a/src/connector/src/sink/doris_starrocks_connector.rs b/src/connector/src/sink/doris_starrocks_connector.rs
index 3f175950f466..04d591b82078 100644
--- a/src/connector/src/sink/doris_starrocks_connector.rs
+++ b/src/connector/src/sink/doris_starrocks_connector.rs
@@ -187,6 +187,7 @@ impl InserterInnerBuilder {
         })
     }
 
+    // TODO: use hyper 1 or reqwest 0.12.2
     fn build_request_and_client(
         &self,
         uri: String,
diff --git a/src/meta/Cargo.toml b/src/meta/Cargo.toml
index 2841b4e08875..29c1c9520cf5 100644
--- a/src/meta/Cargo.toml
+++ b/src/meta/Cargo.toml
@@ -34,7 +34,7 @@ fail = "0.5"
 function_name = "0.3.0"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
 hex = "0.4"
-hyper = "0.14"
+hyper = "0.14" # required by tonic
 itertools = "0.12"
 maplit = "1.0.2"
 memcomparable = { version = "0.2" }
diff --git a/src/object_store/Cargo.toml b/src/object_store/Cargo.toml
index 29144c2cab88..61b5741f3918 100644
--- a/src/object_store/Cargo.toml
+++ b/src/object_store/Cargo.toml
@@ -22,14 +22,14 @@ crc32fast = "1"
 either = "1"
 fail = "0.5"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
-hyper = { version = "0.14", features = ["tcp", "client"] }
+hyper = { version = "0.14", features = ["tcp", "client"] } # required by aws sdk
 hyper-rustls = { version = "0.24.2", features = ["webpki-roots"] }
 hyper-tls = "0.5.0"
 itertools = "0.12"
 madsim = "0.2.22"
 opendal = "0.45.1"
 prometheus = { version = "0.13", features = ["process"] }
-reqwest = "0.11"
+reqwest = "0.11" # required by opendal
 risingwave_common = { workspace = true }
 rustls = "0.23.4"
 spin = "0.9"
diff --git a/src/risedevtool/Cargo.toml b/src/risedevtool/Cargo.toml
index a616b7335d0b..f911a8ddebb6 100644
--- a/src/risedevtool/Cargo.toml
+++ b/src/risedevtool/Cargo.toml
@@ -26,7 +26,7 @@ itertools = "0.12"
 rdkafka = { workspace = true }
 redis = "0.25"
 regex = "1"
-reqwest = "0.11"
+reqwest = { version = "0.12.2", features = ["blocking"] }
 serde = { version = "1", features = ["derive"] }
 serde_json = "1"
 serde_with = "3"
diff --git a/src/rpc_client/Cargo.toml b/src/rpc_client/Cargo.toml
index 9320c861c2dd..9c9f8d8dab84 100644
--- a/src/rpc_client/Cargo.toml
+++ b/src/rpc_client/Cargo.toml
@@ -20,7 +20,7 @@ easy-ext = "1"
 either = "1.10.0"
 futures = { version = "0.3", default-features = false, features = ["alloc"] }
 http = "0.2"
-hyper = "0.14"
+hyper = "0.14" # required by tonic
 itertools = "0.12.0"
 lru = { workspace = true }
 moka = { version = "0.12", features = ["future"] }
diff --git a/src/utils/pgwire/Cargo.toml b/src/utils/pgwire/Cargo.toml
index 47840b0cf498..bcbfd7ecdbe3 100644
--- a/src/utils/pgwire/Cargo.toml
+++ b/src/utils/pgwire/Cargo.toml
@@ -25,7 +25,7 @@ jsonwebtoken = "9"
 openssl = "0.10.60"
 panic-message = "0.3"
 parking_lot = "0.12"
-reqwest = { version = "0.11" }
+reqwest = "0.12.2"
 risingwave_common = { workspace = true }
 risingwave_sqlparser = { workspace = true }
 serde = { version = "1", features = ["derive"] }
diff --git a/src/workspace-hack/Cargo.toml b/src/workspace-hack/Cargo.toml
index c0de1148567b..c350759f1a1c 100644
--- a/src/workspace-hack/Cargo.toml
+++ b/src/workspace-hack/Cargo.toml
@@ -109,7 +109,8 @@ redis = { version = "0.25", features = ["async-std-comp", "tokio-comp"] }
 regex = { version = "1" }
 regex-automata = { version = "0.4", default-features = false, features = ["dfa", "hybrid", "meta", "nfa", "perf", "unicode"] }
 regex-syntax = { version = "0.8" }
-reqwest = { version = "0.11", features = ["blocking", "json", "rustls-tls"] }
+reqwest-5ef9efb8ec2df382 = { package = "reqwest", version = "0.12", features = ["blocking", "json"] }
+reqwest-a6292c17cd707f01 = { package = "reqwest", version = "0.11", default-features = false, features = ["blocking", "default-tls", "json", "rustls-tls"] }
 ring = { version = "0.16", features = ["std"] }
 rust_decimal = { version = "1", features = ["db-postgres", "maths"] }
 rustc-hash = { version = "1" }