diff --git a/jetty-client/src/main/java/org/eclipse/jetty/client/DuplexHttpDestination.java b/jetty-client/src/main/java/org/eclipse/jetty/client/DuplexHttpDestination.java
index 3ced3d688f3..1a20940912f 100644
--- a/jetty-client/src/main/java/org/eclipse/jetty/client/DuplexHttpDestination.java
+++ b/jetty-client/src/main/java/org/eclipse/jetty/client/DuplexHttpDestination.java
@@ -22,6 +22,6 @@ public class DuplexHttpDestination extends HttpDestination
 {
     public DuplexHttpDestination(HttpClient client, Origin origin)
     {
-        super(client, origin);
+        super(client, origin, false);
     }
 }
diff --git a/jetty-client/src/main/java/org/eclipse/jetty/client/HttpDestination.java b/jetty-client/src/main/java/org/eclipse/jetty/client/HttpDestination.java
index d2cff000d38..1294cddf6be 100644
--- a/jetty-client/src/main/java/org/eclipse/jetty/client/HttpDestination.java
+++ b/jetty-client/src/main/java/org/eclipse/jetty/client/HttpDestination.java
@@ -62,7 +62,7 @@ public abstract class HttpDestination extends ContainerLifeCycle implements Dest
     private final RequestTimeouts requestTimeouts;
     private ConnectionPool connectionPool;
 
-    public HttpDestination(HttpClient client, Origin origin)
+    public HttpDestination(HttpClient client, Origin origin, boolean intrinsicallySecure)
     {
         this.client = client;
         this.origin = origin;
@@ -85,12 +85,12 @@ public abstract class HttpDestination extends ContainerLifeCycle implements Dest
         if (proxy != null)
         {
             connectionFactory = proxy.newClientConnectionFactory(connectionFactory);
-            if (proxy.isSecure())
+            if (!intrinsicallySecure && proxy.isSecure())
                 connectionFactory = newSslClientConnectionFactory(proxy.getSslContextFactory(), connectionFactory);
         }
         else
         {
-            if (isSecure())
+            if (!intrinsicallySecure && isSecure())
                 connectionFactory = newSslClientConnectionFactory(null, connectionFactory);
         }
         Object tag = origin.getTag();
@@ -142,9 +142,7 @@ public abstract class HttpDestination extends ContainerLifeCycle implements Dest
 
     public boolean isSecure()
     {
-        return false;
-        // TODO: restore this, but ATM this breaks cleartext HTTP over QUIC
-//        return HttpClient.isSchemeSecure(getScheme());
+        return HttpClient.isSchemeSecure(getScheme());
     }
 
     public HttpClient getHttpClient()
diff --git a/jetty-client/src/main/java/org/eclipse/jetty/client/MultiplexHttpDestination.java b/jetty-client/src/main/java/org/eclipse/jetty/client/MultiplexHttpDestination.java
index cd42b25cfad..4f2bc87d6c7 100644
--- a/jetty-client/src/main/java/org/eclipse/jetty/client/MultiplexHttpDestination.java
+++ b/jetty-client/src/main/java/org/eclipse/jetty/client/MultiplexHttpDestination.java
@@ -28,7 +28,12 @@ public class MultiplexHttpDestination extends HttpDestination implements HttpDes
 {
     public MultiplexHttpDestination(HttpClient client, Origin origin)
     {
-        super(client, origin);
+        this(client, origin, false);
+    }
+
+    public MultiplexHttpDestination(HttpClient client, Origin origin, boolean intrinsicallySecure)
+    {
+        super(client, origin, intrinsicallySecure);
     }
 
     @ManagedAttribute(value = "The maximum number of concurrent requests per connection")
diff --git a/jetty-http3/http3-client/src/main/java/org/eclipse/jetty/http3/client/HttpClientTransportOverQuic.java b/jetty-http3/http3-client/src/main/java/org/eclipse/jetty/http3/client/HttpClientTransportOverQuic.java
index 722f50f102b..3c3527280d6 100644
--- a/jetty-http3/http3-client/src/main/java/org/eclipse/jetty/http3/client/HttpClientTransportOverQuic.java
+++ b/jetty-http3/http3-client/src/main/java/org/eclipse/jetty/http3/client/HttpClientTransportOverQuic.java
@@ -69,7 +69,7 @@ public class HttpClientTransportOverQuic extends AbstractHttpClientTransport
     @Override
     public HttpDestination newHttpDestination(Origin origin)
     {
-        return new MultiplexHttpDestination(getHttpClient(), origin);
+        return new MultiplexHttpDestination(getHttpClient(), origin, true);
     }
 
     @Override
diff --git a/tests/jetty-jmh/src/main/java/org/eclipse/jetty/client/jmh/ConnectionPoolsBenchmark.java b/tests/jetty-jmh/src/main/java/org/eclipse/jetty/client/jmh/ConnectionPoolsBenchmark.java
index 0a8fdc0fcd7..b66fa5ff7eb 100644
--- a/tests/jetty-jmh/src/main/java/org/eclipse/jetty/client/jmh/ConnectionPoolsBenchmark.java
+++ b/tests/jetty-jmh/src/main/java/org/eclipse/jetty/client/jmh/ConnectionPoolsBenchmark.java
@@ -64,7 +64,7 @@ public class ConnectionPoolsBenchmark
                 promise.succeeded(new MockConnection());
             }
         };
-        HttpDestination httpDestination = new HttpDestination(httpClient, new Origin("http", "localhost", 8080))
+        HttpDestination httpDestination = new HttpDestination(httpClient, new Origin("http", "localhost", 8080), false)
         {
         };