diff --git a/compose.web.yml b/compose.web.yml
index 9a556e9f..4f96a69c 100644
--- a/compose.web.yml
+++ b/compose.web.yml
@@ -7,6 +7,7 @@ services:
     ports:
       - "8080:8080"
     environment:
+      NYATERM_WEB_ALLOW_INSECURE_HTTP: ${NYATERM_WEB_ALLOW_INSECURE_HTTP:-false}
       NYATERM_WEB_PUBLIC_URL: ${NYATERM_WEB_PUBLIC_URL:-http://localhost:8080/}
       NYATERM_WEB_PASSWORD: ${NYATERM_WEB_PASSWORD:?Set a random login password of at least 32 characters}
       NYATERM_WEB_ENCRYPTION_KEY: ${NYATERM_WEB_ENCRYPTION_KEY:?Set a persistent base64-encoded 32-byte encryption key}
diff --git a/src-tauri/crates/nyaterm-web/src/main.rs b/src-tauri/crates/nyaterm-web/src/main.rs
index 949ea4af..34d79df8 100644
--- a/src-tauri/crates/nyaterm-web/src/main.rs
+++ b/src-tauri/crates/nyaterm-web/src/main.rs
@@ -44,7 +44,14 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         return Err("Invalid public URL".into());
     }
     let loopback = matches!(url.host_str(), Some("localhost" | "127.0.0.1" | "[::1]"));
-    if url.scheme() != "https" && !loopback {
+    let allow_insecure_http = std::env::var("NYATERM_WEB_ALLOW_INSECURE_HTTP")
+        .unwrap_or_else(|_| "false".into())
+        .parse()
+        .unwrap_or(false);
+    if url.scheme() != "https"
+        && !loopback
+        && !allow_insecure_http
+    {
         return Err("Non-loopback public URLs require HTTPS".into());
     }
     let base_path = url.path().trim_end_matches('/').to_owned();