diff --git a/web/backend/api/gateway.go b/web/backend/api/gateway.go
index 1813cac92..4c341ec77 100644
--- a/web/backend/api/gateway.go
+++ b/web/backend/api/gateway.go
@@ -2,6 +2,7 @@ package api
 
 import (
 	"bufio"
+	"crypto/tls"
 	"encoding/json"
 	"fmt"
 	"io"
@@ -44,10 +45,24 @@ var (
 )
 
 var gatewayHealthGet = func(url string, timeout time.Duration) (*http.Response, error) {
-	client := http.Client{Timeout: timeout}
+	transport := http.DefaultTransport
+	if strings.HasPrefix(url, "https://") {
+		transport = &http.Transport{
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec // localhost self-signed
+		}
+	}
+	client := http.Client{Timeout: timeout, Transport: transport}
 	return client.Get(url)
 }
 
+// gatewayHealthScheme returns "https" if the gateway is serving TLS, "http" otherwise.
+func gatewayHealthScheme(cfg *config.Config) string {
+	if cfg != nil && strings.HasPrefix(cfg.Channels.Telegram.WebAppURL, "https://") {
+		return "https"
+	}
+	return "http"
+}
+
 // registerGatewayRoutes binds gateway lifecycle endpoints to the ServeMux.
 func (h *Handler) registerGatewayRoutes(mux *http.ServeMux) {
 	mux.HandleFunc("GET /api/gateway/status", h.handleGatewayStatus)
@@ -356,7 +371,9 @@ func (h *Handler) startGatewayLocked(initialStatus string) (int, error) {
 			if healthPort == 0 {
 				healthPort = 18790
 			}
-			healthURL := fmt.Sprintf("http://%s/health", net.JoinHostPort(healthHost, strconv.Itoa(healthPort)))
+			scheme := gatewayHealthScheme(cfg)
+			hostPort := net.JoinHostPort(healthHost, strconv.Itoa(healthPort))
+			healthURL := fmt.Sprintf("%s://%s/health", scheme, hostPort)
 			resp, err := gatewayHealthGet(healthURL, 1*time.Second)
 			if err == nil {
 				resp.Body.Close()
@@ -609,7 +626,7 @@ func (h *Handler) gatewayStatusData() map[string]any {
 			}
 		}
 
-		url := fmt.Sprintf("http://%s/health", net.JoinHostPort(host, strconv.Itoa(port)))
+		url := fmt.Sprintf("%s://%s/health", gatewayHealthScheme(cfg), net.JoinHostPort(host, strconv.Itoa(port)))
 		resp, err := gatewayHealthGet(url, 2*time.Second)
 
 		if err != nil {