diff --git a/.bumpy/fix-url-prepend-https.md b/.bumpy/fix-url-prepend-https.md
new file mode 100644
index 000000000..4545c732d
--- /dev/null
+++ b/.bumpy/fix-url-prepend-https.md
@@ -0,0 +1,5 @@
+---
+varlock: patch
+---
+
+Do not prependHttps when a URL already has a protocol
diff --git a/packages/varlock/src/env-graph/lib/data-types.ts b/packages/varlock/src/env-graph/lib/data-types.ts
index ecf7fb680..95f2b5dc6 100644
--- a/packages/varlock/src/env-graph/lib/data-types.ts
+++ b/packages/varlock/src/env-graph/lib/data-types.ts
@@ -393,7 +393,11 @@ const UrlDataType = createEnvGraphDataType(
     generatePlaceholder: (seed) => `https://${seed}.invalid/`,
     coerce(rawVal) {
       const val = coerceToString(rawVal);
-      if (settings?.prependHttps && !val.startsWith('https://')) return `https://${val}`;
+      // Only prepend when no URI scheme is present (docs: "if no protocol is specified").
+      // Checking only https:// used to turn http://example.com into https://http://example.com.
+      if (settings?.prependHttps && !/^[a-zA-Z][a-zA-Z\d+.-]*:\/\//.test(val)) {
+        return `https://${val}`;
+      }
       return val;
     },
     validate(val) {
diff --git a/packages/varlock/src/env-graph/test/data-types.test.ts b/packages/varlock/src/env-graph/test/data-types.test.ts
index 2aac08f93..6a6641599 100644
--- a/packages/varlock/src/env-graph/test/data-types.test.ts
+++ b/packages/varlock/src/env-graph/test/data-types.test.ts
@@ -63,6 +63,15 @@ describe('url data type', () => {
       expect(g.configSchema.MY_URL.isValid).toBe(true);
       expect(g.configSchema.MY_URL.resolvedValue).toBe('https://example.com');
     });
+
+    it('does not prepend when another protocol is already present', async () => {
+      const g = await loadAndResolve(outdent`
+        # @type=url(prependHttps=true)
+        MY_URL=http://example.com
+      `);
+      expect(g.configSchema.MY_URL.isValid).toBe(true);
+      expect(g.configSchema.MY_URL.resolvedValue).toBe('http://example.com');
+    });
   });
 
   describe('noTrailingSlash', () => {