diff --git a/Dockers/xtream-proxy/docker-compose.example.yml b/Dockers/xtream-proxy/docker-compose.example.yml
index 0375db9..0b55218 100644
--- a/Dockers/xtream-proxy/docker-compose.example.yml
+++ b/Dockers/xtream-proxy/docker-compose.example.yml
@@ -15,7 +15,7 @@ services:
       # playlist-URLs. Leeg laten om de Host-header van het request te gebruiken.
       # PUBLIC_URL: "http://192.168.0.123:8080"
       # LOG_REQUESTS: "1"         # log elke (stream)request en status
-      # PROXY_INSECURE_TLS: "1"   # alleen nodig bij self-signed upstream-certificaten
+      # PROXY_INSECURE_TLS: "1"   # globale TLS-verificatie uitzetten; per entry kan ook "insecureTls": true
     volumes:
       - ./upstreams.json:/config/upstreams.json:ro
     restart: unless-stopped
diff --git a/Dockers/xtream-proxy/src/config.js b/Dockers/xtream-proxy/src/config.js
index 6e4b392..1bb469a 100644
--- a/Dockers/xtream-proxy/src/config.js
+++ b/Dockers/xtream-proxy/src/config.js
@@ -44,6 +44,15 @@ function readConfigEntries() {
       return;
     }
 
+    let insecureTls = false;
+    if (item.insecureTls !== undefined) {
+      if (typeof item.insecureTls !== 'boolean') {
+        console.warn(`${label}: "insecureTls" must be a boolean, ignoring`);
+      } else {
+        insecureTls = item.insecureTls;
+      }
+    }
+
     const validUrls = [];
     const seenUrls = new Set();
     urls.forEach((rawUrl, urlIndex) => {
@@ -77,7 +86,7 @@ function readConfigEntries() {
     }
 
     for (const url of validUrls) {
-      entries.push({ url, username, password, entryId: index });
+      entries.push({ url, username, password, entryId: index, insecureTls });
     }
   });
   return entries;
diff --git a/Dockers/xtream-proxy/src/probe.js b/Dockers/xtream-proxy/src/probe.js
index 68d325b..42f9b40 100644
--- a/Dockers/xtream-proxy/src/probe.js
+++ b/Dockers/xtream-proxy/src/probe.js
@@ -105,7 +105,7 @@ function probeUpstream(upstream) {
             'Accept-Encoding': 'identity',
             Connection: 'close',
           },
-          rejectUnauthorized: settings.rejectUnauthorized,
+          rejectUnauthorized: upstream.rejectUnauthorized,
         },
         (res) => {
           let body = '';
diff --git a/Dockers/xtream-proxy/src/proxy.js b/Dockers/xtream-proxy/src/proxy.js
index 67e88d6..af6d147 100644
--- a/Dockers/xtream-proxy/src/proxy.js
+++ b/Dockers/xtream-proxy/src/proxy.js
@@ -303,7 +303,7 @@ function handleProxy(req, res, reqUrl) {
             path: `${target.pathname}${target.search}`,
             method: req.method,
             headers,
-            rejectUnauthorized: settings.rejectUnauthorized,
+            rejectUnauthorized: upstream.rejectUnauthorized,
           },
           (proxyRes) => {
             settled = true;
diff --git a/Dockers/xtream-proxy/src/upstream-pool.js b/Dockers/xtream-proxy/src/upstream-pool.js
index 2a3f33f..c458049 100644
--- a/Dockers/xtream-proxy/src/upstream-pool.js
+++ b/Dockers/xtream-proxy/src/upstream-pool.js
@@ -84,6 +84,7 @@ function selectUpstream(exclude = new Set()) {
 function describeUpstream(upstream) {
   return {
     url: upstream.label,
+    insecureTls: upstream.insecureTls,
     healthy: upstream.state.healthy,
     busy: isBusy(upstream),
     latencyMs: upstream.state.latencyMs,
diff --git a/Dockers/xtream-proxy/src/upstream.js b/Dockers/xtream-proxy/src/upstream.js
index 6233787..6144498 100644
--- a/Dockers/xtream-proxy/src/upstream.js
+++ b/Dockers/xtream-proxy/src/upstream.js
@@ -1,5 +1,7 @@
 'use strict';
 
+const { settings } = require('./settings');
+
 function nowIso() {
   return new Date().toISOString();
 }
@@ -19,7 +21,7 @@ function baseState() {
 }
 
 class Upstream {
-  constructor({ url, username, password, entryId }) {
+  constructor({ url, username, password, entryId, insecureTls }) {
     const parsed = new URL(url);
     parsed.hash = '';
     parsed.search = '';
@@ -28,10 +30,15 @@ class Upstream {
     this.username = username;
     this.password = password;
     this.entryId = entryId;
+    this.insecureTls = insecureTls === true;
     this.key = `${parsed.origin}${this.basePath}|${username}|${password}`;
     this.state = { ...baseState(), inFlight: 0 };
   }
 
+  get rejectUnauthorized() {
+    return this.insecureTls ? false : settings.rejectUnauthorized;
+  }
+
   get label() {
     return `${this.base.origin}${this.basePath}`;
   }
diff --git a/Dockers/xtream-proxy/upstreams.json.example b/Dockers/xtream-proxy/upstreams.json.example
index 467f1a8..7e34317 100644
--- a/Dockers/xtream-proxy/upstreams.json.example
+++ b/Dockers/xtream-proxy/upstreams.json.example
@@ -12,6 +12,7 @@
       "https://panel2.example.com"
     ],
     "username": "user2",
-    "password": "pass2"
+    "password": "pass2",
+    "insecureTls": true
   }
 ]