diff --git a/.github/config/.env.test b/.github/config/.env.test
index 00bcdbb19..28c1f6c46 100644
--- a/.github/config/.env.test
+++ b/.github/config/.env.test
@@ -78,3 +78,8 @@ VAULT_URL=http://localhost:8200/v1
 VAULT_ROLE=swiftbrowserui
 VAULT_SECRET=swiftui
 VAULT_KEY_NAME=human-readable-short-string-to-identify-the-whitelisted-key
+
+VITE_TLS=False
+# paths should be absolute or relative to vite.config.js
+VITE_TLS_CERT=
+VITE_TLS_KEY=
diff --git a/swift_browser_ui_frontend/vite.config.js b/swift_browser_ui_frontend/vite.config.js
index 20d70da23..7e3c7892f 100644
--- a/swift_browser_ui_frontend/vite.config.js
+++ b/swift_browser_ui_frontend/vite.config.js
@@ -2,10 +2,26 @@
 import { defineConfig } from "vite";
 import { createVuePlugin as vue } from "vite-plugin-vue2";
 
+import fs from "node:fs";
 import path from "node:path";
 
+const TLS_ENABLED = process.env.VITE_TLS === "True";
+const http_mode = TLS_ENABLED ? "https" : "http";
+// paths should be absolute or relative to vite.config.js
+const TLS_CERT_PATH = process.env.VITE_TLS_CERT || undefined;
+const TLS_KEY_PATH = process.env.VITE_TLS_KEY || undefined;
+
+let https = null;
+if (TLS_ENABLED) {
+  console.log("vite dev serve will expect https");
+  https = {
+    key:  fs.readFileSync(TLS_KEY_PATH),
+    cert: fs.readFileSync(TLS_CERT_PATH),
+  };
+}
+
 const proxyTo = {
-  target: `http://${process.env.BACKEND_HOST || "localhost"}:${process.env.BACKEND_PORT || "8080"}`,
+  target: `${http_mode}://${process.env.BACKEND_HOST || "localhost"}:${process.env.BACKEND_PORT || "8080"}`,
   changeOrigin: true,
   secure: false,  // Won't check certificates
 };
@@ -134,6 +150,7 @@ export default defineConfig(({ command, mode }) => {
     server: {
       host: "0.0.0.0",
       port: process.env.FRONTEND_PORT || "8081",
+      https,
       strictPort: true,
       proxy,
     },