diff --git a/lib/wasix/src/capabilities.rs b/lib/wasix/src/capabilities.rs
index fb47c122087..e3c3b0ab1b6 100644
--- a/lib/wasix/src/capabilities.rs
+++ b/lib/wasix/src/capabilities.rs
@@ -3,7 +3,7 @@ use std::time::Duration;
 use crate::http::HttpClientCapabilityV1;
 
 /// Defines capabilities for a Wasi environment.
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct Capabilities {
     pub insecure_allow_all: bool,
     pub http_client: HttpClientCapabilityV1,
@@ -40,7 +40,7 @@ impl Default for Capabilities {
 }
 
 /// Defines threading related permissions.
-#[derive(Debug, Default, Clone)]
+#[derive(Debug, Default, Clone, PartialEq, Eq, Hash)]
 pub struct CapabilityThreadingV1 {
     /// Maximum number of threads that can be spawned.
     ///
diff --git a/lib/wasix/src/http/client.rs b/lib/wasix/src/http/client.rs
index 824834d5272..0fb8434021b 100644
--- a/lib/wasix/src/http/client.rs
+++ b/lib/wasix/src/http/client.rs
@@ -1,28 +1,28 @@
-use std::{collections::HashSet, ops::Deref, sync::Arc};
+use std::{collections::BTreeSet, ops::Deref, sync::Arc};
 
 use futures::future::BoxFuture;
 use http::{HeaderMap, Method, StatusCode};
 use url::Url;
 
 /// Defines http client permissions.
-#[derive(Clone, Debug)]
+#[derive(Clone, Debug, PartialEq, Eq, Hash)]
 pub struct HttpClientCapabilityV1 {
     pub allow_all: bool,
-    pub allowed_hosts: HashSet<String>,
+    pub allowed_hosts: BTreeSet<String>,
 }
 
 impl HttpClientCapabilityV1 {
     pub fn new() -> Self {
         Self {
             allow_all: false,
-            allowed_hosts: HashSet::new(),
+            allowed_hosts: Default::default(),
         }
     }
 
     pub fn new_allow_all() -> Self {
         Self {
             allow_all: true,
-            allowed_hosts: HashSet::new(),
+            allowed_hosts: Default::default(),
         }
     }