diff --git a/packages/server/src/shared/daemon-endpoints.test.ts b/packages/server/src/shared/daemon-endpoints.test.ts
index 34522ff49..7f131eec0 100644
--- a/packages/server/src/shared/daemon-endpoints.test.ts
+++ b/packages/server/src/shared/daemon-endpoints.test.ts
@@ -9,6 +9,7 @@ import {
   parseConnectionUri,
   serializeConnectionUri,
   serializeConnectionUriForStorage,
+  shouldUseTlsForDefaultHostedRelay,
 } from "./daemon-endpoints.js";
 
 describe("connection URI parsing", () => {
@@ -188,3 +189,25 @@ describe("relay websocket URLs", () => {
     expect(extractHostPortFromWebSocketUrl(wsUrl)).toBe("[::1]:443");
   });
 });
+
+describe("shouldUseTlsForDefaultHostedRelay", () => {
+  test("returns true for the hosted Paseo relay on port 443", () => {
+    expect(shouldUseTlsForDefaultHostedRelay("relay.paseo.sh:443")).toBe(true);
+  });
+
+  test("returns true for any self-hosted relay on port 443", () => {
+    expect(shouldUseTlsForDefaultHostedRelay("relay.example.com:443")).toBe(true);
+  });
+
+  test("returns true for an IPv6 relay on port 443", () => {
+    expect(shouldUseTlsForDefaultHostedRelay("[::1]:443")).toBe(true);
+  });
+
+  test("returns false for a relay on a non-443 port", () => {
+    expect(shouldUseTlsForDefaultHostedRelay("relay.example.com:8080")).toBe(false);
+  });
+
+  test("returns false for malformed endpoints", () => {
+    expect(shouldUseTlsForDefaultHostedRelay("not-an-endpoint")).toBe(false);
+  });
+});
diff --git a/packages/server/src/shared/daemon-endpoints.ts b/packages/server/src/shared/daemon-endpoints.ts
index da98944a5..299abcab3 100644
--- a/packages/server/src/shared/daemon-endpoints.ts
+++ b/packages/server/src/shared/daemon-endpoints.ts
@@ -204,7 +204,8 @@ export function buildRelayWebSocketUrl(params: {
  */
 export function shouldUseTlsForDefaultHostedRelay(endpoint: string): boolean {
   try {
-    return normalizeHostPort(endpoint) === DEFAULT_RELAY_ENDPOINT;
+    const { port } = parseHostPort(endpoint);
+    return port === 443;
   } catch {
     return false;
   }