Explicitly specify only HTTPS sources