diff --git a/quotesdb/Cargo.toml b/quotesdb/Cargo.toml
index 72c404d..4a38793 100644
--- a/quotesdb/Cargo.toml
+++ b/quotesdb/Cargo.toml
@@ -13,13 +13,48 @@ path = "src/bin/api/main.rs"
 name = "ui"
 path = "src/bin/ui/main.rs"
 
+# Shared dependencies: compile for both native host and wasm32-unknown-unknown.
 [dependencies]
 common = { path = "../common" }
+# UUID v4 for database primary keys; serde feature for serialisation.
 uuid = { version = "1", features = ["v4", "serde"] }
+# OsRng-based passphrase generation (WASM-compatible via getrandom/wasm_js).
+rand = "0.9"
+# Serialisation for shared types (API request/response models, Quote structs).
+serde = { version = "1", features = ["derive"] }
+serde_json = "1"
 
+# Native-only dependencies (API server binary).
+# tokio, axum, and rusqlite are incompatible with wasm32-unknown-unknown.
+[target.'cfg(not(target_arch = "wasm32"))'.dependencies]
+# Async runtime for the native API server.
+tokio = { version = "1", features = ["full"] }
+# HTTP framework for the native API server.
+axum = { version = "0.8", features = ["json"] }
+# SQLite driver for local development (native only; production uses Cloudflare D1).
+# Version pinned to 0.32 to match tokio-rusqlite 0.6's transitive dependency.
+rusqlite = { version = "0.32", features = ["bundled"] }
+# Async wrapper around rusqlite for use with Tokio.
+tokio-rusqlite = "0.6"
+# Async trait support for the QuoteRepository abstraction.
+async-trait = "0.1"
+
+# WASM-only dependencies (Workers API binary + UI binary).
+# workers-rs, getrandom/wasm_js, and UI libraries are wasm32-specific.
 [target.'cfg(target_arch = "wasm32")'.dependencies]
+# Cloudflare Workers SDK — provides D1 bindings, fetch, KV, etc.
+worker = { version = "0.5", features = ["d1"] }
+# Entropy source for WASM targets: bridges uuid (v4) and rand (OsRng) to
+# crypto.getRandomValues() via the Web Crypto API.
 getrandom = { version = "0.4", features = ["wasm_js"] }
 
+# Build-time dependencies for compile-time YAML-to-JSON conversion of the
+# OpenAPI spec. serde_yaml is only needed at build time — it never enters
+# the Workers binary or native binary.
+[build-dependencies]
+serde_json = "1"
+serde_yaml = "0.9"
+
 [dev-dependencies]
 
 [profile.release]