diff --git a/agent/agent.go b/agent/agent.go
index 4fc0c0279852..47674f1da745 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -750,7 +750,7 @@ func (a *Agent) reloadWatches(cfg *config.RuntimeConfig) error {
 
 			addr := config.Address
 			if config.Scheme == "https" {
-				addr = "https://" + addr
+				addr = "https://" + config.TLSConfig.Address
 			}
 
 			if err := wp.RunWithConfig(addr, config); err != nil {
diff --git a/agent/config/runtime.go b/agent/config/runtime.go
index db3eb699c24f..1800a08e6f54 100644
--- a/agent/config/runtime.go
+++ b/agent/config/runtime.go
@@ -1467,6 +1467,7 @@ func (c *RuntimeConfig) APIConfig(includeClientCerts bool) (*api.Config, error)
 		Datacenter: c.Datacenter,
 		TLSConfig:  api.TLSConfig{InsecureSkipVerify: !c.VerifyOutgoing},
 	}
+	dcfg := api.DefaultConfig()
 
 	unixAddr, httpAddr, httpsAddr := c.ClientAddress()
 
@@ -1475,7 +1476,7 @@ func (c *RuntimeConfig) APIConfig(includeClientCerts bool) (*api.Config, error)
 		cfg.Scheme = "https"
 		cfg.TLSConfig.CAFile = c.CAFile
 		cfg.TLSConfig.CAPath = c.CAPath
-		cfg.TLSConfig.Address = httpsAddr
+		cfg.TLSConfig.Address = dcfg.TLSConfig.Address
 		if includeClientCerts {
 			cfg.TLSConfig.CertFile = c.CertFile
 			cfg.TLSConfig.KeyFile = c.KeyFile