diff --git a/app/geodata/download.go b/app/geodata/download.go
index 05464de63..be1601bdb 100644
--- a/app/geodata/download.go
+++ b/app/geodata/download.go
@@ -36,7 +36,6 @@ type stage struct {
 
 type downloader struct {
 	ctx         context.Context
-	httpClient  *http.Client
 	httpsClient *http.Client
 }
 
@@ -64,12 +63,11 @@ func (c *idleConn) Write(b []byte) (int, error) {
 func newDownloader(ctx context.Context, dispatcher routing.Dispatcher, outbound string) *downloader {
 	return &downloader{
 		ctx:         ctx,
-		httpClient:  newClient(ctx, dispatcher, outbound, false),
-		httpsClient: newClient(ctx, dispatcher, outbound, true),
+		httpsClient: newClient(ctx, dispatcher, outbound),
 	}
 }
 
-func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string, isHTTPS bool) *http.Client {
+func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound string) *http.Client {
 	dial := func(ctx context.Context, network, address string) (net.Conn, error) {
 		var conn net.Conn
 		err := task.Run(ctx, func() error {
@@ -94,53 +92,33 @@ func newClient(baseCtx context.Context, dispatcher routing.Dispatcher, outbound
 			Conn: conn,
 		}, nil
 	}
-	if isHTTPS {
-		return &http.Client{
-			Transport: &http2.Transport{
-				DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
-					conn, err := dial(ctx, network, address)
-					if err != nil {
-						return nil, err
-					}
-					host, _, _ := net.SplitHostPort(address)
-					tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
-					handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
-					defer cancel()
-					if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
-						conn.Close()
-						return nil, err
-					}
-					return tlsConn, nil
-				},
-			},
-			CheckRedirect: func(req *http.Request, via []*http.Request) error {
-				if req.URL.Scheme != "https" {
-					return errors.New("redirected to non-https URL: ", req.URL.String())
+	return &http.Client{
+		Transport: &http2.Transport{
+			DialTLSContext: func(ctx context.Context, network string, address string, cfg *tls.Config) (net.Conn, error) {
+				conn, err := dial(ctx, network, address)
+				if err != nil {
+					return nil, err
 				}
-				if len(via) >= 10 {
-					return errors.New("stopped after 10 redirects")
+				host, _, _ := net.SplitHostPort(address)
+				tlsConn := utls.UClient(conn, &utls.Config{ServerName: host}, utls.HelloChrome_Auto)
+				handshakeCtx, cancel := context.WithTimeout(ctx, idleTimeout)
+				defer cancel()
+				if err := tlsConn.HandshakeContext(handshakeCtx); err != nil {
+					conn.Close()
+					return nil, err
 				}
-				return nil
+				return tlsConn, nil
 			},
-		}
-	} else {
-		return &http.Client{
-			Transport: &http.Transport{
-				Proxy:                 nil,
-				DisableKeepAlives:     true,
-				DialContext:           dial,
-				ResponseHeaderTimeout: idleTimeout,
-			},
-			CheckRedirect: func(req *http.Request, via []*http.Request) error {
-				if req.URL.Scheme != "https" {
-					return errors.New("redirected to non-https URL: ", req.URL.String())
-				}
-				if len(via) >= 10 {
-					return errors.New("stopped after 10 redirects")
-				}
-				return nil
-			},
-		}
+		},
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			if req.URL.Scheme != "https" {
+				return errors.New("redirected to non-https URL: ", req.URL.String())
+			}
+			if len(via) >= 10 {
+				return errors.New("stopped after 10 redirects")
+			}
+			return nil
+		},
 	}
 }
 
@@ -206,13 +184,7 @@ func (d *downloader) fetch(rawURL string, writer io.Writer) error {
 	}
 	utils.TryDefaultHeadersWith(req.Header, "nav")
 
-	var client *http.Client
-	if req.URL.Scheme == "https" {
-		client = d.httpsClient
-	} else {
-		client = d.httpClient
-	}
-	resp, err := client.Do(req)
+	resp, err := d.httpsClient.Do(req)
 	if err != nil {
 		return err
 	}
diff --git a/app/geodata/download_test.go b/app/geodata/download_test.go
index 0d6324c29..bfe07f0bc 100644
--- a/app/geodata/download_test.go
+++ b/app/geodata/download_test.go
@@ -34,11 +34,11 @@ func TestDownloadOneLuaGuard(t *testing.T) {
 			if err := os.WriteFile(filepath.Join(dir, "asset.lua"), nil, 0o600); err != nil {
 				t.Fatal(err)
 			}
-			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+			server := httptest.NewTLSServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
 				_, _ = w.Write([]byte(tc.body))
 			}))
 			defer server.Close()
-			d := &downloader{ctx: context.Background(), httpClient: server.Client()}
+			d := &downloader{ctx: context.Background(), httpsClient: server.Client()}
 			staged, err := d.downloadOne(&Asset{Url: server.URL, File: "asset.lua"})
 			if err != nil {
 				t.Fatal(err)