diff --git a/backend/internal/certificate/validation.go b/backend/internal/certificate/validation.go
index 6e5fbbe..78d296c 100644
--- a/backend/internal/certificate/validation.go
+++ b/backend/internal/certificate/validation.go
@@ -153,9 +153,9 @@ func (v RemoteValidator) validateHTTPS(ctx context.Context, endpoint, dialAddres
 	tlsDialer := &tls.Dialer{
 		NetDialer: dialer,
 		Config: &tls.Config{
-			ServerName:         parsed.Hostname(),
-			MinVersion:         tls.VersionTLS12,
-			InsecureSkipVerify: true,
+			ServerName: parsed.Hostname(),
+			RootCAs:    v.Roots,
+			MinVersion: tls.VersionTLS12,
 		},
 	}
 	connection, err := tlsDialer.DialContext(ctx, "tcp", address)
diff --git a/backend/internal/certificate/validation_test.go b/backend/internal/certificate/validation_test.go
index 9158891..626f034 100644
--- a/backend/internal/certificate/validation_test.go
+++ b/backend/internal/certificate/validation_test.go
@@ -13,6 +13,7 @@ import (
 	"net/http/httptest"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 )
@@ -81,6 +82,31 @@ func TestRemoteValidatorChecksPresentedCertificate(t *testing.T) {
 	}
 }
 
+func TestRemoteValidatorUsesAddressOverrideWithEndpointSNI(t *testing.T) {
+	certificateData, privateKeyData, leaf := validationTestCertificate(t, []string{"example.com", "127.0.0.1"})
+	pair, err := tls.X509KeyPair(certificateData, privateKeyData)
+	if err != nil {
+		t.Fatal(err)
+	}
+	server := httptest.NewUnstartedServer(nil)
+	server.TLS = &tls.Config{Certificates: []tls.Certificate{pair}}
+	server.StartTLS()
+	defer server.Close()
+
+	roots := x509.NewCertPool()
+	roots.AddCert(leaf)
+	endpoint := "https://example.com" + strings.TrimPrefix(server.URL, "https://127.0.0.1")
+	address := server.Listener.Addr().String()
+	result, err := (RemoteValidator{Roots: roots, Timeout: 5 * time.Second}).ValidateHTTPSAt(
+		context.Background(), endpoint, address, []string{"example.com"},
+	)
+	if err != nil {
+		t.Fatalf("address override with endpoint SNI should pass: %v", err)
+	}
+	if result.ChainLength != 1 || len(result.FingerprintSHA256) != 64 {
+		t.Fatalf("unexpected remote validation result: %+v", result)
+	}
+}
 func validationTestCertificate(t *testing.T, names []string) ([]byte, []byte, *x509.Certificate) {
 	t.Helper()
 	key, err := rsa.GenerateKey(rand.Reader, 2048)