diff --git a/pkg/service/datastore/datastore.go b/pkg/service/datastore/datastore.go
index f709fa4..971dfc6 100644
--- a/pkg/service/datastore/datastore.go
+++ b/pkg/service/datastore/datastore.go
@@ -1800,6 +1800,12 @@ type Settings struct {
 	AmazonClientID      string         `json:"amazon_client_id,omitempty"`
 	AmazonClientSecret  string         `json:"amazon_client_secret,omitempty"`
 	AmazonRedirectURI   string         `json:"amazon_redirect_uri,omitempty"`
+
+	// AllowInsecureUpstreamTLS, when true, disables TLS certificate verification
+	// for the upstream Bose-cloud proxy and mirror traffic. The default (false)
+	// keeps verification on; opt in only when the upstream certificate chain is
+	// broken (post end-of-service) and a temporary unblock is required.
+	AllowInsecureUpstreamTLS bool `json:"allow_insecure_upstream_tls,omitempty"`
 }
 
 // GetSettings retrieves the global service settings.
diff --git a/pkg/service/handlers/handlers_proxy.go b/pkg/service/handlers/handlers_proxy.go
index 2af5bc7..ce03d6f 100644
--- a/pkg/service/handlers/handlers_proxy.go
+++ b/pkg/service/handlers/handlers_proxy.go
@@ -62,6 +62,13 @@ func (s *Server) ServeProxy(target *url.URL) http.HandlerFunc {
 			r.Body = io.NopCloser(bytes.NewBuffer(reqBody))
 		}
 
+		// AllowInsecureUpstreamTLS is opt-in via settings.json — defaults to
+		// false so the upstream certificate chain is verified normally. The
+		// opt-in exists for deployments stuck behind a broken Bose-cloud
+		// chain post end-of-service.
+		settings, _ := s.ds.GetSettings()
+		insecure := settings.AllowInsecureUpstreamTLS
+
 		rp := &httputil.ReverseProxy{
 			Rewrite: func(pr *httputil.ProxyRequest) {
 				pr.SetURL(target)
@@ -77,7 +84,7 @@ func (s *Server) ServeProxy(target *url.URL) http.HandlerFunc {
 				lp.LogRequest(pr.Out)
 			},
 			Transport: &http.Transport{
-				TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+				TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure},
 			},
 		}
 
diff --git a/pkg/service/handlers/mirror_middleware.go b/pkg/service/handlers/mirror_middleware.go
index 0ee3ada..1767daa 100644
--- a/pkg/service/handlers/mirror_middleware.go
+++ b/pkg/service/handlers/mirror_middleware.go
@@ -271,6 +271,12 @@ func (s *Server) performMirror(r *http.Request) *mirrorResponseRecorder {
 		return nil
 	}
 
+	// AllowInsecureUpstreamTLS is opt-in via settings.json — defaults to
+	// false so verification stays on. The opt-in exists for deployments
+	// stuck behind a broken Bose-cloud certificate chain post EOS.
+	settings, _ := s.ds.GetSettings()
+	insecure := settings.AllowInsecureUpstreamTLS
+
 	// Create a proxy that doesn't write to the original ResponseWriter
 	proxy := &httputil.ReverseProxy{
 		Rewrite: func(pr *httputil.ProxyRequest) {
@@ -279,7 +285,7 @@ func (s *Server) performMirror(r *http.Request) *mirrorResponseRecorder {
 			pr.Out.Header.Set("X-Mirror-Request", "true")
 		},
 		Transport: &http.Transport{
-			TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+			TLSClientConfig: &tls.Config{InsecureSkipVerify: insecure},
 		},
 	}