diff --git a/cmd/tip/golangorg.go b/cmd/tip/golangorg.go
index e2fa4b524a..f26a3725d0 100644
--- a/cmd/tip/golangorg.go
+++ b/cmd/tip/golangorg.go
@@ -60,6 +60,7 @@ func (b golangorgBuilder) Init(logger *log.Logger, dir, hostport string, heads m
 	install.Env = append(os.Environ(),
 		"GOROOT="+goDir,
 		"GO111MODULE=on",
+		"GOPROXY=https://proxy.golang.org",
 		"GOBIN="+binDir,
 	)
 	if err := install.Run(); err != nil {
diff --git a/cmd/tip/tip.go b/cmd/tip/tip.go
index b4cb080ef9..278a7dae7a 100644
--- a/cmd/tip/tip.go
+++ b/cmd/tip/tip.go
@@ -56,7 +56,10 @@ func main() {
 
 	p := &Proxy{builder: b}
 	go p.run()
-	mux := newServeMux(p)
+	mux := newServeMux(p, serveOptions{
+		// Redirect to HTTPS only if we're actually serving HTTPS.
+		RedirectToHTTPS: *autoCertDomain != "",
+	})
 
 	log.Printf("Starting up tip server for builder %q", os.Getenv(k))
 
@@ -253,9 +256,19 @@ func (p *Proxy) poll() {
 	p.cmd = cmd
 }
 
-func newServeMux(p *Proxy) http.Handler {
+type serveOptions struct {
+	// RedirectToHTTPS controls whether requests served
+	// over HTTP should be redirected to HTTPS.
+	RedirectToHTTPS bool
+}
+
+func newServeMux(p *Proxy, opt serveOptions) http.Handler {
 	mux := http.NewServeMux()
-	mux.Handle("/", httpsOnlyHandler{p})
+	if opt.RedirectToHTTPS {
+		mux.Handle("/", httpsOnlyHandler{p})
+	} else {
+		mux.Handle("/", p)
+	}
 	mux.HandleFunc("/_ah/health", p.serveHealthCheck)
 	return mux
 }
diff --git a/cmd/tip/tip_test.go b/cmd/tip/tip_test.go
index e042f4b55b..9e0106a864 100644
--- a/cmd/tip/tip_test.go
+++ b/cmd/tip/tip_test.go
@@ -10,7 +10,7 @@ import (
 )
 
 func TestTipRedirects(t *testing.T) {
-	mux := newServeMux(&Proxy{builder: &golangorgBuilder{}})
+	mux := newServeMux(&Proxy{builder: &golangorgBuilder{}}, serveOptions{RedirectToHTTPS: true})
 	req := httptest.NewRequest("GET", "http://example.com/foo?bar=baz", nil)
 	req.Header.Set("X-Forwarded-Proto", "http")
 	w := httptest.NewRecorder()