diff --git a/client/graphql.go b/client/graphql.go
index c148d7579d786310f79c3229920b2f8def8551d0..57750f2ad602bc3b2b4dde38fa017a53ca305897 100644
--- a/client/graphql.go
+++ b/client/graphql.go
@@ -129,7 +129,7 @@ 	}
 	req.Header.Add("Content-Type", contentType)
 	req.Header.Add("User-Agent",
 		fmt.Sprintf("%s -- SourceHut core-go (https://git.sr.ht/~sircmpwn/core-go)",
-		config.ServiceName(ctx)))
+			config.ServiceName(ctx)))
 	auth := InternalAuth{
 		Name:     username,
 		ClientID: config.ServiceName(ctx),
diff --git a/objects/middleware.go b/objects/middleware.go
index 0c2da48864f81c1163e28389b72a804ff89082d5..efdb4b57bffc601e90fc8e6e7c2871bc6eb5a20a 100644
--- a/objects/middleware.go
+++ b/objects/middleware.go
@@ -11,6 +11,8 @@ 	"github.com/aws/aws-sdk-go-v2/credentials"
 	"github.com/aws/aws-sdk-go-v2/service/s3"
 	"github.com/aws/smithy-go/endpoints"
 	"github.com/vaughan0/go-ini"
+
+	"git.sr.ht/~sircmpwn/core-go/config"
 )
 
 var s3CtxKey = &contextKey{"s3"}
@@ -76,12 +78,17 @@ 	if !ok {
 		region = "default"
 	}
 
+	scheme := "https://"
+	if config.GetBool(conf, "objects", "s3-insecure", false) {
+		scheme = "http://"
+	}
+
 	creds := credentials.NewStaticCredentialsProvider(accessKey, secretKey, "")
 	return s3.NewFromConfig(aws.Config{
 		Region:      region,
 		Credentials: creds,
 	}, func(opts *s3.Options) {
-		opts.BaseEndpoint = aws.String("https://" + upstream)
+		opts.BaseEndpoint = aws.String(scheme + upstream)
 		opts.EndpointResolverV2 = &S3Resolver{
 			conf,
 			s3.NewDefaultEndpointResolverV2(),