diff --git a/services/harbor/hermes-agent-base-mirror-job.yaml b/services/harbor/hermes-agent-base-mirror-job.yaml
index fc7995c8..d587b79c 100644
--- a/services/harbor/hermes-agent-base-mirror-job.yaml
+++ b/services/harbor/hermes-agent-base-mirror-job.yaml
@@ -108,6 +108,11 @@ spec:
               src="docker://nousresearch/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973"
               dst="docker://harbor-core.harbor.svc.cluster.local:80/mirror/hermes-agent@sha256:9c841866021c54c4596849f6135717e8a4d52ba510b7f52c50aef1de1a283973"
               pw="$(cat /vault/secrets/harbor-admin-password)"
+              # harbor-core serves the registry + token service over plain HTTP on
+              # :80; mark it insecure so skopeo (and the token request it derives
+              # from the auth challenge) use HTTP instead of defaulting to HTTPS.
+              printf '[[registry]]\nlocation = "harbor-core.harbor.svc.cluster.local:80"\ninsecure = true\n' > /tmp/registries.conf
+              export CONTAINERS_REGISTRIES_CONF=/tmp/registries.conf
               exec skopeo copy --all \
                 --src-tls-verify=true \
                 --dest-tls-verify=false \