diff --git a/internal/scan/passive.go b/internal/scan/passive.go
index 1aaec43d..089969e1 100644
--- a/internal/scan/passive.go
+++ b/internal/scan/passive.go
@@ -33,7 +33,7 @@ import (
 var (
 	crtshBaseURL       = "https://crt.sh/?q=%%25.%s&output=json"
 	certspotterBaseURL = "https://api.certspotter.com/v1/issuances?domain=%s&include_subdomains=true&expand=dns_names"
-	waybackBaseURL     = "http://web.archive.org/cdx/search/cdx?url=*.%s/*&output=text&fl=original&collapse=urlkey"
+	waybackBaseURL     = "https://web.archive.org/cdx/search/cdx?url=*.%s/*&output=text&fl=original&collapse=urlkey"
 )
 
 // cap the response we read from any one source so a hostile/huge feed can't
diff --git a/internal/scan/passive_test.go b/internal/scan/passive_test.go
index 547a3893..aed98076 100644
--- a/internal/scan/passive_test.go
+++ b/internal/scan/passive_test.go
@@ -15,6 +15,7 @@ package scan
 import (
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
 )
@@ -168,6 +169,22 @@ func TestPassive_ScopesSubdomainsToTarget(t *testing.T) {
 	}
 }
 
+func TestPassive_SourcesUseTLS(t *testing.T) {
+	// all three passive feeds must be fetched over https: an on-path attacker
+	// able to tamper with a plain-http response could inject or drop
+	// subdomains/urls in the reported results without detection.
+	sources := map[string]string{
+		"crtsh":       crtshBaseURL,
+		"certspotter": certspotterBaseURL,
+		"wayback":     waybackBaseURL,
+	}
+	for name, base := range sources {
+		if !strings.HasPrefix(base, "https://") {
+			t.Errorf("%s base url is not https: %q", name, base)
+		}
+	}
+}
+
 func TestNormalizeHost(t *testing.T) {
 	tests := []struct {
 		in   string