diff --git a/README.md b/README.md
index 00e2a5b..8e3d33d 100644
--- a/README.md
+++ b/README.md
@@ -240,7 +240,9 @@ tinkerbell:
   --tink-worker-id ID              machine / worker ID
   --tink-tls BOOL                  enable TLS to tink-server (default: false)
   --tink-insecure-tls BOOL         allow insecure TLS (default: true)
-  --tink-insecure-registries LIST  comma-separated insecure registries
+  --tink-insecure-registries LIST  comma-separated insecure registries; each registry may be prefixed
+                                   with http:// (default) or https:// (HTTPS with skip TLS verify).
+                                   Example: foo.local,http://bar.local:5000,https://baz.local
   --tink-registry-username USER    registry auth username
   --tink-registry-password PASS    registry auth password
   --tink-syslog-host HOST          remote syslog host
diff --git a/captain/cli/_parser.py b/captain/cli/_parser.py
index 4e6d129..47a90a6 100644
--- a/captain/cli/_parser.py
+++ b/captain/cli/_parser.py
@@ -522,7 +522,11 @@ def _add_tink_flags(parser: configargparse.ArgParser) -> None:
         env_var="TINK_INSECURE_REGISTRIES",
         metavar="LIST",
         default="",
-        help="comma-separated insecure registries",
+        help=(
+            "comma-separated insecure registries; each registry may be prefixed "
+            "with http:// (default) or https:// (HTTPS with skip TLS verify). "
+            "Example: foo.local,http://bar.local:5000,https://baz.local"
+        ),
     )
     g.add_argument(
         "--tink-registry-username",
diff --git a/mkosi.extra/etc/systemd/system/tink-agent-setup.service b/mkosi.extra/etc/systemd/system/tink-agent-setup.service
index 6954014..b5724a7 100644
--- a/mkosi.extra/etc/systemd/system/tink-agent-setup.service
+++ b/mkosi.extra/etc/systemd/system/tink-agent-setup.service
@@ -6,6 +6,9 @@ Requires=containerd.service
 # Only start when Tinkerbell parameters are on the kernel command line
 ConditionKernelCommandLine=|tink_worker_image
 ConditionKernelCommandLine=|docker_registry
+# Allow up to 10 restart attempts within 10 minutes before giving up.
+StartLimitIntervalSec=600
+StartLimitBurst=10
 
 [Service]
 Type=oneshot
@@ -13,6 +16,16 @@ RemainAfterExit=yes
 ExecStart=/usr/local/bin/tink-agent-setup
 TimeoutStartSec=300
 
+# Retry to prevent transient failures from preventing tink-agent from starting
+# with exponential backoff between attempts.
+Restart=on-failure
+RestartSec=5
+RestartMaxDelaySec=60
+RestartSteps=5
+
+# When setup finally succeeds, explicitly restart tink-agent to get past tink-agent dependency error preventing it from starting
+ExecStartPost=-/bin/systemctl --no-block start tink-agent.service
+
 # Logging
 StandardOutput=journal
 StandardError=journal
diff --git a/mkosi.extra/usr/local/bin/tink-agent-setup b/mkosi.extra/usr/local/bin/tink-agent-setup
index bb51ee1..64ae064 100755
--- a/mkosi.extra/usr/local/bin/tink-agent-setup
+++ b/mkosi.extra/usr/local/bin/tink-agent-setup
@@ -9,7 +9,12 @@
 #   registry_password=<pass>        Registry auth password
 #   tinkerbell_tls=<bool>           Enable TLS for tink-server
 #   tinkerbell_insecure_tls=<bool>  Allow insecure TLS
-#   insecure_registries=<list>      Comma-separated insecure registries
+#   insecure_registries=<list>      Comma-separated insecure registries. Each
+#                                   registry may be prefixed with a scheme:
+#                                     http://host  -> plain HTTP (no TLS)
+#                                     https://host -> HTTPS with skip_verify
+#                                     host         -> plain HTTP (default,
+#                                                     matches prior behaviour)
 
 set -euo pipefail
 
@@ -83,15 +88,46 @@ configure_insecure_registries() {
     for registry in "${REGISTRIES[@]}"; do
         registry=$(echo "$registry" | xargs)  # trim whitespace
         [[ -z "$registry" ]] && continue
-        mkdir -p "${certs_dir}/${registry}"
-        cat > "${certs_dir}/${registry}/hosts.toml" <<EOF
-server = "http://${registry}"
 
-[host."http://${registry}"]
+        local scheme host port
+        case "$registry" in
+            https://*) scheme="https"; host="${registry#https://}" ;;
+            http://*)  scheme="http";  host="${registry#http://}"  ;;
+            *)         scheme="http";  host="$registry"            ;;
+        esac
+        host="${host%/}"  # strip any trailing slash
+
+        # If host has a port set, set the port var to that value otherwise use default 443 or 80 based on scheme
+        if [[ "$host" == *:* ]]; then
+            port="${host##*:}"
+            host="${host%:*}"
+        elif [[ "$scheme" == "https" ]]; then
+            port=443
+        else
+            port=80
+        fi
+
+        mkdir -p "${certs_dir}/${host}"
+        if [[ "$scheme" == "https" ]]; then
+            # HTTPS registry with an untrusted cert (private CA / self-signed).
+            cat > "${certs_dir}/${host}/hosts.toml" <<EOF
+server = "https://${host}"
+
+[host."https://${host}:${port}"]
   capabilities = ["pull", "resolve", "push"]
   skip_verify = true
 EOF
-        log_info "configured insecure registry" "registry" "${registry}"
+        else
+            # Plain HTTP: skip_verify is a TLS-only option and, on an http://
+            # server, makes containerd attempt HTTPS first and breaks login.
+            cat > "${certs_dir}/${host}/hosts.toml" <<EOF
+server = "http://${host}"
+
+[host."http://${host}:${port}"]
+  capabilities = ["pull", "resolve", "push"]
+EOF
+        fi
+        log_info "configured insecure registry" "host" "${host}" "port" "${port}" "scheme" "${scheme}"
     done
 }
 
@@ -112,6 +148,21 @@ wait_for_containerd() {
     log_info "containerd is ready"
 }
 
+# --- Log into the registry (if credentials were provided) ---
+registry_login() {
+    if [[ -z "${REGISTRY_USERNAME:-}" || -z "${REGISTRY_PASSWORD:-}" ]]; then
+        return
+    fi
+
+    local login_host="${DOCKER_REGISTRY:-${TINK_IMAGE%%/*}}"
+    log_info "logging into registry" "host" "${login_host}"
+    if ! printf '%s' "${REGISTRY_PASSWORD}" \
+        | nerdctl login "${login_host}" -u "${REGISTRY_USERNAME}" --password-stdin; then
+        log_error "registry login failed" "host" "${login_host}"
+        exit 1
+    fi
+}
+
 # --- Pull the tink-agent image ---
 pull_image() {
     log_info "pulling tink-agent image" "image" "${TINK_IMAGE}"
@@ -126,6 +177,8 @@ pull_image() {
         return
     fi
 
+    registry_login
+
     while true; do
         attempt=$((attempt + 1))
         if nerdctl pull -q "${TINK_IMAGE}" 2>&1; then