diff --git a/.changes/updater-warn-insecure-download.md b/.changes/updater-warn-insecure-download.md
new file mode 100644
index 000000000..5b5448a11
--- /dev/null
+++ b/.changes/updater-warn-insecure-download.md
@@ -0,0 +1,6 @@
+---
+updater: patch
+updater-js: patch
+---
+
+Log a warning when the download URL of an update does not use `https` and `dangerousInsecureTransportProtocol` is not enabled.
diff --git a/plugins/updater/src/updater.rs b/plugins/updater/src/updater.rs
index 71e124b0e..ca456b0a8 100644
--- a/plugins/updater/src/updater.rs
+++ b/plugins/updater/src/updater.rs
@@ -821,6 +821,18 @@ impl Update {
         mut on_chunk: C,
         on_download_finish: D,
     ) -> Result<Vec<u8>> {
+        // not enforced (unlike for the endpoints) as that would break existing releases, but the
+        // artifact then travels in plaintext: only its signature protects it
+        // TODO(v3): enforce it
+        if self.download_url.scheme() != "https"
+            && !self.context.config.dangerous_insecure_transport_protocol
+        {
+            log::warn!(
+                "the update download URL {} does not use the `https` protocol",
+                self.download_url
+            );
+        }
+
         // set our headers
         let mut headers = self.headers.clone();
         if !headers.contains_key(ACCEPT) {