diff --git a/hack/proxmox-talos-template.sh b/hack/proxmox-talos-template.sh
index 9301aeef5..5c166006e 100755
--- a/hack/proxmox-talos-template.sh
+++ b/hack/proxmox-talos-template.sh
@@ -187,12 +187,14 @@ EOF
     # host still verifies: CDI appends talos.imageFactoryCA to its system pool
     # the same way. The blank line keeps a bundle without a final newline from
     # running into the first block. The terminator holds an underscore, which
-    # no line of a checked certificate block can.
+    # no line of a checked certificate block can. A CA is accepted only for an
+    # https factory, and redirects are held to https as well, so the image
+    # cannot leave TLS verification halfway.
     cat <<EOF
 { cat /etc/ssl/certs/ca-certificates.crt; echo; cat; } > "\$work/factory-ca.pem" <<'FACTORY_CA_PEM'
 $CA_PEM
 FACTORY_CA_PEM
-curl -fL --retry 3 --cacert "\$work/factory-ca.pem" -o "\$work/disk.raw.xz" "\$URL"
+curl -fL --retry 3 --proto-redir =https --cacert "\$work/factory-ca.pem" -o "\$work/disk.raw.xz" "\$URL"
 EOF
   fi
   cat <<'EOF'
diff --git a/hack/proxmox-talos-template_test.bats b/hack/proxmox-talos-template_test.bats
index f52430e5a..333df956d 100644
--- a/hack/proxmox-talos-template_test.bats
+++ b/hack/proxmox-talos-template_test.bats
@@ -128,7 +128,7 @@ EOF
     "$SCRIPT" print 9002 main-pool |
     sed "s|/etc/ssl/certs/ca-certificates.crt|$stub/system.pem|" |
     PATH="$stub:$PATH" TMPDIR="$stub" sh >/dev/null
-  grep -qE '^curl -fL --retry 3 --cacert [^ ]*/factory-ca.pem -o [^ ]*/disk.raw.xz https://factory.internal/' "$stub/calls"
+  grep -qE '^curl -fL --retry 3 --proto-redir =https --cacert [^ ]*/factory-ca.pem -o [^ ]*/disk.raw.xz https://factory.internal/' "$stub/calls"
   got="$(cat "$stub/cacert")"
   want="$(printf 'system bundle\n\n'; grep -v '^$' "$stub/ca.pem")"
   [ "$got" = "$want" ] || { printf 'curl was handed:\n%s\nexpected:\n%s\n' "$got" "$want" >&2; false; }