From 1d9edb907a3faee35697e58c9763e039a92ba0fa Mon Sep 17 00:00:00 2001
From: Mike Fridman <mfridman@buf.build>
Date: Wed, 31 Dec 2025 09:18:01 -0500
Subject: [PATCH] Respect TLS configuration in registry browser login

---
 .../command/registry/registrylogin/registrylogin.go         | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/cmd/buf/internal/command/registry/registrylogin/registrylogin.go b/cmd/buf/internal/command/registry/registrylogin/registrylogin.go
index a30c9c162b..e11632420a 100644
--- a/cmd/buf/internal/command/registry/registrylogin/registrylogin.go
+++ b/cmd/buf/internal/command/registry/registrylogin/registrylogin.go
@@ -28,6 +28,7 @@ import (
 	"github.com/bufbuild/buf/private/buf/bufapp"
 	"github.com/bufbuild/buf/private/buf/bufcli"
 	"github.com/bufbuild/buf/private/bufpkg/bufconnect"
+	"github.com/bufbuild/buf/private/bufpkg/buftransport"
 	"github.com/bufbuild/buf/private/gen/proto/connect/buf/alpha/registry/v1alpha1/registryv1alpha1connect"
 	registryv1alpha1 "github.com/bufbuild/buf/private/gen/proto/go/buf/alpha/registry/v1alpha1"
 	"github.com/bufbuild/buf/private/pkg/connectclient"
@@ -271,7 +272,6 @@ func doBrowserLogin(
 	container appext.Container,
 	remote string,
 ) (string, error) {
-	baseURL := "https://" + remote
 	clientName, err := getClientName()
 	if err != nil {
 		return "", err
@@ -284,6 +284,10 @@ func doBrowserLogin(
 	if err != nil {
 		return "", err
 	}
+	baseURL := buftransport.PrependHTTPS(remote)
+	if appConfig.TLS == nil {
+		baseURL = buftransport.PrependHTTP(remote)
+	}
 	client := httpclient.NewClient(appConfig.TLS)
 	oauth2Client := oauth2.NewClient(baseURL, client)
 	// Register the device.