diff --git a/apps/base/ghp/deployment.yaml b/apps/base/ghp/deployment.yaml
index c6c9c25..1a7f5b2 100644
--- a/apps/base/ghp/deployment.yaml
+++ b/apps/base/ghp/deployment.yaml
@@ -102,7 +102,7 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTP
+              scheme: HTTPS
             initialDelaySeconds: 30
             periodSeconds: 30
             successThreshold: 1
@@ -112,7 +112,7 @@ spec:
             httpGet:
               path: /metrics
               port: metrics
-              scheme: HTTP
+              scheme: HTTPS
             initialDelaySeconds: 10
             periodSeconds: 5
             successThreshold: 1
diff --git a/apps/base/ghp/vmservicescrape.yaml b/apps/base/ghp/vmservicescrape.yaml
index a91bde9..e5ca485 100644
--- a/apps/base/ghp/vmservicescrape.yaml
+++ b/apps/base/ghp/vmservicescrape.yaml
@@ -16,3 +16,8 @@ spec:
   endpoints:
     - port: metrics
       path: /metrics
+      scheme: https
+      # ghp serves metrics over TLS with an internal-CA cert; skip verification
+      # since the scrape targets a pod IP the cert SANs do not cover.
+      tlsConfig:
+        insecureSkipVerify: true