diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ba8243353d..26af85c9b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -361,7 +361,7 @@ jobs:
           cache-on-failure: true
       - name: Install trunk
         run: |
-          curl -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
+          curl --proto '=https' -fsSL "https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}/trunk-x86_64-unknown-linux-gnu.tar.gz" \
             | tar -xz -C "$HOME/.cargo/bin" trunk
           trunk --version
       # package.sh runs Trunk's release builds, validates relative URLs, cuts the wasm into
diff --git a/Dockerfile b/Dockerfile
index 66734f255a..1803d3a2e9 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -25,8 +25,8 @@ RUN set -eu; \
     asset="trunk-${arch}-unknown-linux-musl.tar.gz"; \
     url="https://github.com/trunk-rs/trunk/releases/download/v${TRUNK_VERSION}"; \
     cd /tmp; \
-    curl -fsSL --retry 3 -A Photocraft-dev "$url/$asset" -o "$asset"; \
-    curl -fsSL --retry 3 -A Photocraft-dev "$url/$asset.sha256" -o "$asset.sha256"; \
+    curl --proto '=https' -fsSL --retry 3 -A Photocraft-dev "$url/$asset" -o "$asset"; \
+    curl --proto '=https' -fsSL --retry 3 -A Photocraft-dev "$url/$asset.sha256" -o "$asset.sha256"; \
     printf '%s  %s\n' "$(cat "$asset.sha256")" "$asset" | sha256sum -c -; \
     tar -xzf "$asset" -C /usr/local/bin trunk; \
     rm "$asset" "$asset.sha256"; \