diff --git a/fetch-calibration.sh b/fetch-calibration.sh
index 8cb10d2..4745d97 100755
--- a/fetch-calibration.sh
+++ b/fetch-calibration.sh
@@ -147,12 +147,12 @@ human() {
 asset_parts() {
     local mission="$1" asset suffix parts=""
     asset="$(asset_name "$mission")"
-    if curl -fsIL -o /dev/null "${BASE_URL}/${asset}"; then
+    if curl --proto '=https' --proto-redir '=https' -fsIL -o /dev/null "${BASE_URL}/${asset}"; then
         echo "$asset"
         return 0
     fi
     for suffix in $VISOR_SPLIT_SUFFIXES; do
-        curl -fsIL -o /dev/null "${BASE_URL}/${asset}${suffix}" || break
+        curl --proto '=https' --proto-redir '=https' -fsIL -o /dev/null "${BASE_URL}/${asset}${suffix}" || break
         parts="${parts:+$parts }${asset}${suffix}"
     done
     echo "$parts"
@@ -161,7 +161,7 @@ asset_parts() {
 # Size of one asset in KB, from the last Content-Length of the redirect chain.
 asset_kb() {
     local length
-    length=$(curl -fsIL "${BASE_URL}/$1" \
+    length=$(curl --proto '=https' --proto-redir '=https' -fsIL "${BASE_URL}/$1" \
         | tr -d '\r' \
         | awk 'tolower($1) == "content-length:" { n = $2 } END { print n }') || return 1
     [ -n "$length" ] || return 1
@@ -278,7 +278,7 @@ download_part() {
         resuming=true
     fi
     echo "  fetching $name"
-    curl -fL --progress-bar -C - -o "$CACHE/$name" "${BASE_URL}/${name}" || status=$?
+    curl --proto '=https' --proto-redir '=https' -fL --progress-bar -C - -o "$CACHE/$name" "${BASE_URL}/${name}" || status=$?
     if [ "$status" -ne 0 ]; then
         ok=false
         # 22 (the 416 a file already at the remote length answers a resume with)
@@ -287,7 +287,7 @@ download_part() {
         if $resuming && { [ "$status" -eq 22 ] || [ "$status" -eq 33 ]; }; then
             echo "  could not resume $name; starting over"
             rm -f "$CACHE/$name"
-            curl -fL --progress-bar -o "$CACHE/$name" "${BASE_URL}/${name}" && ok=true
+            curl --proto '=https' --proto-redir '=https' -fL --progress-bar -o "$CACHE/$name" "${BASE_URL}/${name}" && ok=true
         fi
     fi
     if ! $ok; then
diff --git a/terrain-intelligence-generator/test-calibration-demo.sh b/terrain-intelligence-generator/test-calibration-demo.sh
index 16fb3cb..af557f5 100755
--- a/terrain-intelligence-generator/test-calibration-demo.sh
+++ b/terrain-intelligence-generator/test-calibration-demo.sh
@@ -103,7 +103,7 @@ if [ -f "${DATA_DIR}/.${CALIB_ASSET}.complete" ]; then
 else
     echo "Downloading ${CALIB_ASSET} (380 MB)..."
     mkdir -p "${DATA_DIR}"
-    curl -fsSL "${RELEASE_URL}/${CALIB_ASSET}" | tar -xz -C "${DATA_DIR}" || {
+    curl --proto '=https' --proto-redir '=https' -fsSL "${RELEASE_URL}/${CALIB_ASSET}" | tar -xz -C "${DATA_DIR}" || {
         echo -e "${RED}✗ Could not download or extract ${CALIB_ASSET}${NC}"; exit 2; }
     touch "${DATA_DIR}/.${CALIB_ASSET}.complete"
 fi
@@ -116,7 +116,7 @@ if [ -f "${DATA_DIR}/.${SAMPLE_ASSET}.complete" ]; then
     echo "Reusing sample products in ${DATA_DIR}/sample_data"
 else
     echo "Downloading ${SAMPLE_ASSET} (740 MB)..."
-    curl -fsSL "${RELEASE_URL}/${SAMPLE_ASSET}" | \
+    curl --proto '=https' --proto-redir '=https' -fsSL "${RELEASE_URL}/${SAMPLE_ASSET}" | \
         tar -xz -C "${DATA_DIR}" "${XYZ_MEMBER}" "${ILT_MEMBER}" || {
         echo -e "${RED}✗ Could not download or extract ${SAMPLE_ASSET}${NC}"; exit 2; }
     touch "${DATA_DIR}/.${SAMPLE_ASSET}.complete"
diff --git a/terrain-intelligence-generator/test-fullfeatured-image.sh b/terrain-intelligence-generator/test-fullfeatured-image.sh
index 4bb1098..7a242f2 100755
--- a/terrain-intelligence-generator/test-fullfeatured-image.sh
+++ b/terrain-intelligence-generator/test-fullfeatured-image.sh
@@ -191,7 +191,7 @@ else
     # --occurrence stops tar at the first match, which closes the pipe and
     # ends the download early instead of pulling all 740MB. curl then reports
     # a write failure, which is the expected outcome, not an error.
-    ( cd "${TEST_WORKSPACE}" && curl -fsSL "${SAMPLE_URL}" 2>/dev/null \
+    ( cd "${TEST_WORKSPACE}" && curl --proto '=https' --proto-redir '=https' -fsSL "${SAMPLE_URL}" 2>/dev/null \
         | tar -xz --occurrence=1 "${SAMPLE_MEMBER}" ) || true
     SAMPLE="${TEST_WORKSPACE}/${SAMPLE_MEMBER}"
     if [ ! -f "${SAMPLE}" ]; then
diff --git a/terrain-intelligence-generator/test-release-regression.sh b/terrain-intelligence-generator/test-release-regression.sh
index bd9c9a3..4c53475 100755
--- a/terrain-intelligence-generator/test-release-regression.sh
+++ b/terrain-intelligence-generator/test-release-regression.sh
@@ -257,10 +257,10 @@ if [ "${DO_DOWNLOAD}" -eq 1 ]; then
     set -o pipefail
     mkdir -p "${DATA_DIR}" || hard_fail "cannot create ${DATA_DIR}"
     missing_frames
-    [ ${#MISSING[@]} -eq 0 ] || curl -fL "${SAMPLE_URL}" | tar -zxf - -C "${DATA_DIR}" \
+    [ ${#MISSING[@]} -eq 0 ] || curl --proto '=https' --proto-redir '=https' -fL "${SAMPLE_URL}" | tar -zxf - -C "${DATA_DIR}" \
         || hard_fail "sample data download failed: ${SAMPLE_URL}"
     # Both archives carry their own top-level dir, so they extract into DATA_DIR.
-    calib_complete || curl -fL "${CALIB_URL}" | tar -zxf - -C "${DATA_DIR}" \
+    calib_complete || curl --proto '=https' --proto-redir '=https' -fL "${CALIB_URL}" | tar -zxf - -C "${DATA_DIR}" \
         || hard_fail "calibration download failed: ${CALIB_URL}"
     set +o pipefail
 fi
@@ -268,14 +268,14 @@ fi
 calib_complete || hard_fail \
     "no complete MSL calibration at ${CALIB_DIR} (expected camera_models/ and param_files/)" \
     "re-run with --download, or fetch it manually:" \
-    "  curl -L '${CALIB_URL}' | tar -zxf - -C '${DATA_DIR}'"
+    "  curl --proto '=https' --proto-redir '=https' -L '${CALIB_URL}' | tar -zxf - -C '${DATA_DIR}'"
 
 missing_frames
 if [ ${#MISSING[@]} -gt 0 ]; then
     hard_fail "${#MISSING[@]} input frame(s) missing from ${SAMPLE_DIR}" \
         "${MISSING[@]}" \
         "re-run with --download, or fetch the sample data manually:" \
-        "  curl -L '${SAMPLE_URL}' | tar -zxf - -C '${DATA_DIR}'"
+        "  curl --proto '=https' --proto-redir '=https' -L '${SAMPLE_URL}' | tar -zxf - -C '${DATA_DIR}'"
 fi
 
 # Clear a reused output dir: a stale PNG or product would be reported as this
diff --git a/terrain-intelligence-generator/test-visor-image.sh b/terrain-intelligence-generator/test-visor-image.sh
index ea92543..ecfbaee 100755
--- a/terrain-intelligence-generator/test-visor-image.sh
+++ b/terrain-intelligence-generator/test-visor-image.sh
@@ -153,7 +153,7 @@ else
     # --occurrence stops tar at the first match, which closes the pipe and
     # ends the download early instead of pulling all 740MB. curl then reports
     # a write failure, which is the expected outcome, not an error.
-    ( cd "${TEST_WORKSPACE}" && curl -fsSL "${SAMPLE_URL}" 2>/dev/null \
+    ( cd "${TEST_WORKSPACE}" && curl --proto '=https' --proto-redir '=https' -fsSL "${SAMPLE_URL}" 2>/dev/null \
         | tar -xz --occurrence=1 "${SAMPLE_MEMBER}" ) || true
     SAMPLE="${TEST_WORKSPACE}/${SAMPLE_MEMBER}"
     if [ ! -f "${SAMPLE}" ]; then
diff --git a/terrain-intelligence-generator/visor/install-visor-calibration.sh b/terrain-intelligence-generator/visor/install-visor-calibration.sh
index 47431bb..a66763f 100755
--- a/terrain-intelligence-generator/visor/install-visor-calibration.sh
+++ b/terrain-intelligence-generator/visor/install-visor-calibration.sh
@@ -44,12 +44,12 @@ for mission in "$@"; do
 
     # GitHub caps a release asset at 2GB, so the larger missions are split with
     # split(1) and have to be concatenated before they can be extracted.
-    if curl -fsIL -o /dev/null "${url}"; then
+    if curl --proto '=https' --proto-redir '=https' -fsIL -o /dev/null "${url}"; then
         names="${asset}"
     else
         names=""
         for suffix in ${VISOR_SPLIT_SUFFIXES}; do
-            curl -fsIL -o /dev/null "${url}${suffix}" || break
+            curl --proto '=https' --proto-redir '=https' -fsIL -o /dev/null "${url}${suffix}" || break
             names="${names} ${asset}${suffix}"
         done
     fi
@@ -69,7 +69,7 @@ for mission in "$@"; do
             exit 1
         fi
         echo "Fetching ${base_url}/${name}"
-        curl -fsSL -o "${downloads}/${name}" "${base_url}/${name}"
+        curl --proto '=https' --proto-redir '=https' -fsSL -o "${downloads}/${name}" "${base_url}/${name}"
         echo "${expected}  ${downloads}/${name}" | sha256sum -c - > /dev/null \
             || { echo "SHA-256 mismatch for ${name}" >&2; exit 1; }
         parts="${parts} ${downloads}/${name}"
diff --git a/terrain-intelligence-generator/visor/update-calibration-checksums.sh b/terrain-intelligence-generator/visor/update-calibration-checksums.sh
index eb9df18..53536e4 100755
--- a/terrain-intelligence-generator/visor/update-calibration-checksums.sh
+++ b/terrain-intelligence-generator/visor/update-calibration-checksums.sh
@@ -34,11 +34,11 @@ for mission in ${MISSIONS}; do
     asset="visor_calibration_${CALIBRATION_DATE}_${mission}.tar.gz"
 
     names=()
-    if curl -fsIL -o /dev/null "${BASE_URL}/${asset}"; then
+    if curl --proto '=https' --proto-redir '=https' -fsIL -o /dev/null "${BASE_URL}/${asset}"; then
         names=("${asset}")
     else
         for suffix in ${SPLIT_SUFFIXES}; do
-            curl -fsIL -o /dev/null "${BASE_URL}/${asset}${suffix}" || break
+            curl --proto '=https' --proto-redir '=https' -fsIL -o /dev/null "${BASE_URL}/${asset}${suffix}" || break
             names+=("${asset}${suffix}")
         done
     fi
@@ -50,7 +50,7 @@ for mission in ${MISSIONS}; do
 
     for name in "${names[@]}"; do
         echo "Hashing ${name}" >&2
-        digest=$(curl -fsSL "${BASE_URL}/${name}" | sha256sum | cut -d' ' -f1)
+        digest=$(curl --proto '=https' --proto-redir '=https' -fsSL "${BASE_URL}/${name}" | sha256sum | cut -d' ' -f1)
         echo "${digest}  ${name}" >> "${STAGED}"
     done
 done