diff --git a/src/util/bootstrap.cpp b/src/util/bootstrap.cpp
index a3f852e..d033d79 100644
--- a/src/util/bootstrap.cpp
+++ b/src/util/bootstrap.cpp
@@ -453,6 +453,12 @@ Bootstrap::RemoteInfo Bootstrap::getRemoteFileSize(const std::string& url) {
     curl_easy_setopt(curl, CURLOPT_URL, url.c_str());
     curl_easy_setopt(curl, CURLOPT_NOBODY, 1L);           // HEAD request
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    // Redirects may only stay on HTTPS (no downgrade / file:// etc.).
+#if LIBCURL_VERSION_NUM >= 0x075500
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https");
+#else
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, (long)CURLPROTO_HTTPS);
+#endif
     curl_easy_setopt(curl, CURLOPT_USERAGENT, "ObsidianDragon/1.0");
     curl_easy_setopt(curl, CURLOPT_TIMEOUT, 15L);
     curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 10L);
@@ -612,6 +618,12 @@ bool Bootstrap::download(const std::string& url, const std::string& destZip) {
     curl_easy_setopt(curl, CURLOPT_XFERINFOFUNCTION, progressCallback);
     curl_easy_setopt(curl, CURLOPT_XFERINFODATA, this);
     curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    // Redirects may only stay on HTTPS (no downgrade / file:// etc.).
+#if LIBCURL_VERSION_NUM >= 0x075500
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS_STR, "https");
+#else
+    curl_easy_setopt(curl, CURLOPT_REDIR_PROTOCOLS, (long)CURLPROTO_HTTPS);
+#endif
     curl_easy_setopt(curl, CURLOPT_USERAGENT, "ObsidianDragon/1.0");
     curl_easy_setopt(curl, CURLOPT_TIMEOUT, 0L);           // no timeout for large file
     curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 30L);