diff --git a/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightclient.rs b/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightclient.rs
index ca973ae..28b84fd 100644
--- a/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightclient.rs
+++ b/third_party/silentdragonxlite/silentdragonxlite-cli/lib/src/lightclient.rs
@@ -1147,6 +1147,8 @@ impl LightClient {
 pub fn start_mempool_monitor(lc: Arc<LightClient>) -> Result<(), String> {
     let config = lc.config.clone();
     let uri = config.server.clone();
+    // TLS verification follows the config (default on), as block sync does; `dangerous` is the only bypass.
+    let no_cert = config.no_cert_verification;
     let shutdown = lc.shutdown_flag.clone();
 
     let (incoming_mempool_tx, incoming_mempool_rx) = std::sync::mpsc::channel::<RawTransaction>();
@@ -1182,7 +1184,7 @@ pub fn start_mempool_monitor(lc: Arc<LightClient>) -> Result<(), String> {
                     incoming_mempool_tx_clone.send(rtx).map_err(|e| Box::new(e) as Box<dyn std::error::Error>)
                 };
 
-                match grpcconnector::monitor_mempool(&uri.clone(), true, send_closure).await {
+                match grpcconnector::monitor_mempool(&uri.clone(), no_cert, send_closure).await {
                     Ok(_) => info!("Mempool monitor loop successful"),
                     Err(e) => {
                         // If the server doesn't implement GetMempoolStream, stop the monitor instead
@@ -1558,10 +1560,9 @@ pub fn start_mempool_monitor(lc: Arc<LightClient>) -> Result<(), String> {
                 start_height
             };
 
-            let no_cert = true;
-
-                      // We'll also fetch all the txids that our transparent addresses are involved with
-                      self.scan_taddress_txids(&pool, block_times, transparent_start_height, end_height, no_cert)?;          
+            // Fetch the txids our transparent addresses are involved with. TLS verification follows the
+            // config (default on); `dangerous` is the only way to turn it off.
+            self.scan_taddress_txids(&pool, block_times, transparent_start_height, end_height, self.config.no_cert_verification)?;
             
             // Do block height accounting
             last_scanned_height = end_height;
@@ -1905,4 +1906,16 @@ pub fn test_bad_import() {
         }
     }
 
+    // C243 tripwire: the t-address scan and the mempool monitor must take TLS verification from the config
+    // (no_cert_verification, which only `dangerous` sets), never from a hard-coded `true`. The needles are
+    // joined at runtime so that this test's own source cannot match them.
+    #[test]
+    pub fn test_tls_verification_not_hardcoded_off() {
+        let src = include_str!("lightclient.rs");
+        let taddr_needle = ["let no_cert", "= true"].join(" ");
+        let mempool_needle = ["monitor_mempool(&uri.clone(),", "true"].join(" ");
+        assert!(!src.contains(&taddr_needle), "the t-address scan turns TLS verification off");
+        assert!(!src.contains(&mempool_needle), "the mempool monitor turns TLS verification off");
+    }
+
 }