diff --git a/src/PepperDash.Essentials.MobileControl/Touchpanel/MobileControlTouchpanelController.cs b/src/PepperDash.Essentials.MobileControl/Touchpanel/MobileControlTouchpanelController.cs
index ec241a333..262cb34e2 100644
--- a/src/PepperDash.Essentials.MobileControl/Touchpanel/MobileControlTouchpanelController.cs
+++ b/src/PepperDash.Essentials.MobileControl/Touchpanel/MobileControlTouchpanelController.cs
@@ -554,15 +554,8 @@ private string GetUrlWithCorrectIp(string url)
                 return false;
             }) ? csIpAddress.ToString() : processorIp;
 
-            var match = Regex.Match(url, @"^http://([^:/]+):\d+/mc/app\?token=.+$");
-            if (match.Success)
-            {
-                string ipa = match.Groups[1].Value;
-                // ip will be "192.168.1.100"
-            }
-
-            // replace ipa with ip but leave the rest of the string intact
-            var updatedUrl = Regex.Replace(url, @"^http://[^:/]+", $"http://{ip}");
+            // replace the host but preserve whatever scheme (http/https) is already present in the URL
+            var updatedUrl = Regex.Replace(url, @"^(https?)://[^:/]+", $"$1://{ip}");
 
             this.LogVerbose("Updated URL: {updatedUrl}", updatedUrl);
 
diff --git a/src/PepperDash.Essentials.MobileControl/WebSocketServer/MobileControlWebsocketServer.cs b/src/PepperDash.Essentials.MobileControl/WebSocketServer/MobileControlWebsocketServer.cs
index 1c9ed37af..a948d8577 100644
--- a/src/PepperDash.Essentials.MobileControl/WebSocketServer/MobileControlWebsocketServer.cs
+++ b/src/PepperDash.Essentials.MobileControl/WebSocketServer/MobileControlWebsocketServer.cs
@@ -127,6 +127,16 @@ private string SecretProviderKey
         /// </summary>
         public int Port { get; private set; }
 
+        /// <summary>
+        /// Gets the HTTP scheme to use for generated URLs, based on whether the direct server is configured as secure
+        /// </summary>
+        private string HttpScheme => _parent.Config.DirectServer.Secure ? "https" : "http";
+
+        /// <summary>
+        /// Gets the WebSocket scheme to use for generated URLs, based on whether the direct server is configured as secure
+        /// </summary>
+        private string WsScheme => _parent.Config.DirectServer.Secure ? "wss" : "ws";
+
         /// <summary>
         /// Gets the user app URL prefix
         /// </summary>
@@ -134,7 +144,8 @@ public string UserAppUrlPrefix
         {
             get
             {
-                return string.Format("http://{0}:{1}{2}?token=",
+                return string.Format("{0}://{1}:{2}{3}?token=",
+                    HttpScheme,
                     CrestronEthernetHelper.GetEthernetParameter(CrestronEthernetHelper.ETHERNET_PARAMETER_TO_GET.GET_CURRENT_IP_ADDRESS, 0),
                     Port,
                     _userAppBaseHref);
@@ -273,7 +284,7 @@ public override void Initialize()
             {
                 base.Initialize();
 
-                _server = new HttpServer(Port, false);
+                _server = new HttpServer(Port, _parent.Config.DirectServer.Secure);
 
                 _server.OnGet += Server_OnGet;
 
@@ -291,7 +302,7 @@ public override void Initialize()
                     {
                         ClientCertificateRequired = false,
                         CheckCertificateRevocation = false,
-                        EnabledSslProtocols = SslProtocols.Tls12 | SslProtocols.Tls11
+                        EnabledSslProtocols = SslProtocols.Tls12
                     };
                 }
 
@@ -403,11 +414,11 @@ private void AddClientsForTouchpanels()
                     ip = csIpAddress.ToString();
                 }
 
-                var appUrl = $"http://{ip}:{_parent.Config.DirectServer.Port}/mc/app?token={touchpanel.Key}";
+                var appUrl = $"{HttpScheme}://{ip}:{Port}/mc/app?token={touchpanel.Key}";
 
                 this.LogVerbose("Sending URL {appUrl} to touchpanel {touchpanelKey}", appUrl, touchpanel.Touchpanel.Key);
 
-                touchpanel.Touchpanel.SetAppUrl($"http://{ip}:{_parent.Config.DirectServer.Port}/mc/app?token={touchpanel.Key}");
+                touchpanel.Touchpanel.SetAppUrl(appUrl);
             }
         }
 
@@ -487,7 +498,7 @@ private MobileControlApplicationConfig GetApplicationConfig(string processorIp)
             {
                 var config = new MobileControlApplicationConfig
                 {
-                    ApiPath = string.Format("http://{0}:{1}/mc/api", processorIp, _parent.Config.DirectServer.Port),
+                    ApiPath = string.Format("{0}://{1}:{2}/mc/api", HttpScheme, processorIp, Port),
                     GatewayAppPath = "",
                     LogoPath = _parent.Config.ApplicationConfig?.LogoPath ?? "logo/logo.png",
                     EnableDev = _parent.Config.ApplicationConfig?.EnableDev ?? false,
@@ -1098,6 +1109,7 @@ private async void Server_OnPost(object sender, HttpRequestEventArgs e)
                     res.StatusCode = 200;
                     res.Close();
 
+                    // remote log collector has no dedicated secure flag; keep it on http regardless of DirectServer.Secure
                     var logRequest = new HttpRequestMessage(HttpMethod.Post, $"http://{_parent.Config.DirectServer.Logging.Host}:{_parent.Config.DirectServer.Logging.Port}/logs")
                     {
                         Content = new StringContent(body, Encoding.UTF8, "application/json"),
@@ -1213,8 +1225,7 @@ private void HandleJoinRequest(HttpListenerRequest req, HttpListenerResponse res
             this.LogVerbose("Assigning ClientId: {clientId} for token: {token} at {timestamp}", clientId, token, now);
 
             // Construct WebSocket URL with clientId query parameter
-            var wsProtocol = "ws";
-            var wsUrl = $"{wsProtocol}://{CrestronEthernetHelper.GetEthernetParameter(CrestronEthernetHelper.ETHERNET_PARAMETER_TO_GET.GET_CURRENT_IP_ADDRESS, 0)}:{Port}{_wsPath}{token}?clientId={clientId}";
+            var wsUrl = $"{WsScheme}://{CrestronEthernetHelper.GetEthernetParameter(CrestronEthernetHelper.ETHERNET_PARAMETER_TO_GET.GET_CURRENT_IP_ADDRESS, 0)}:{Port}{_wsPath}{token}?clientId={clientId}";
 
             // Construct the response object
             JoinResponse jRes = new JoinResponse
@@ -1226,7 +1237,8 @@ private void HandleJoinRequest(HttpListenerRequest req, HttpListenerResponse res
                 Config = _parent.GetConfigWithPluginVersion(),
                 CodeExpires = new DateTime().AddYears(1),
                 UserCode = bridge.UserCode,
-                UserAppUrl = string.Format("http://{0}:{1}/mc/app",
+                UserAppUrl = string.Format("{0}://{1}:{2}/mc/app",
+                HttpScheme,
                 CrestronEthernetHelper.GetEthernetParameter(CrestronEthernetHelper.ETHERNET_PARAMETER_TO_GET.GET_CURRENT_IP_ADDRESS, 0),
                 Port),
                 WebSocketUrl = wsUrl,