diff --git a/packages/database/src/bootstrap-connectors.test.ts b/packages/database/src/bootstrap-connectors.test.ts
new file mode 100644
index 0000000..287ec68
--- /dev/null
+++ b/packages/database/src/bootstrap-connectors.test.ts
@@ -0,0 +1,11 @@
+import { describe, expect, it } from "vitest";
+import { environmentConnectorTestMode } from "./bootstrap-connectors.ts";
+
+describe("environment connector bootstrap", () => {
+  it("permits scoped HTTP homelab connectors without weakening HTTPS connectors", () => {
+    expect(environmentConnectorTestMode("http://tawny.internal:5080")).toBe(
+      true,
+    );
+    expect(environmentConnectorTestMode("https://unifi.internal")).toBe(false);
+  });
+});
diff --git a/packages/database/src/bootstrap-connectors.ts b/packages/database/src/bootstrap-connectors.ts
index 4e91ff4..c990a7e 100644
--- a/packages/database/src/bootstrap-connectors.ts
+++ b/packages/database/src/bootstrap-connectors.ts
@@ -24,6 +24,10 @@ type EnvironmentConnector = {
   auth: ConnectorAuth;
 };
 
+export function environmentConnectorTestMode(baseUrl: string) {
+  return new URL(baseUrl).protocol === "http:";
+}
+
 function optionalEnvironmentConnector(input: {
   product: "kelpie" | "tawny" | "unifi";
   instanceId: string;
@@ -47,7 +51,7 @@ function optionalEnvironmentConnector(input: {
       baseUrl: parsedUrl.toString(),
       allowedHosts: [parsedUrl.hostname.toLowerCase()],
       allowPrivateNetwork: true,
-      testMode: false,
+      testMode: environmentConnectorTestMode(parsedUrl.toString()),
       ...(input.tlsCaCertificateBase64?.trim()
         ? {
             tlsCaCertificateBase64: input.tlsCaCertificateBase64.trim(),