diff --git a/contrib/completion/bash/devtools.in b/contrib/completion/bash/devtools.in
index 17f863f..3faad27 100644
--- a/contrib/completion/bash/devtools.in
+++ b/contrib/completion/bash/devtools.in
@@ -265,6 +265,7 @@ _pkgctl_repo_cmds=(
 
 _pkgctl_repo_clone_args=(
 	-m --maintainer
+	--protocol
 	--switch
 	-u --unprivileged
 	--universe
@@ -273,6 +274,7 @@ _pkgctl_repo_clone_args=(
 )
 _pkgctl_repo_clone_args__maintainer_opts() { :; }
 _pkgctl_repo_clone_args_m_opts() { _pkgctl_repo_clone_args__maintainer_opts; }
+_pkgctl_repo_clone_args__protocol_opts() { _devtools_completions_protocol; }
 _pkgctl_repo_clone_args__switch_opts() { :; }
 _pkgctl_repo_clone_args__jobs_opts() { :; }
 _pkgctl_repo_clone_args_j_opts() { _pkgctl_repo_clone_args__jobs_opts; }
@@ -280,9 +282,11 @@ _pkgctl_repo_clone_opts() { _devtools_completions_all_packages; }
 
 
 _pkgctl_repo_configure_args=(
+	--protocol
 	-j --jobs
 	-h --help
 )
+_pkgctl_repo_configure_args__protocol_opts() { _devtools_completions_protocol; }
 _pkgctl_repo_configure_args__jobs_opts() { :; }
 _pkgctl_repo_configure_args_j_opts() { _pkgctl_repo_clone_args__jobs_opts; }
 _pkgctl_repo_configure_opts() { _filedir -d; }
@@ -363,6 +367,9 @@ _devtools_completions_build_repo() {
 _devtools_completions_all_packages() {
 	mapfile -t COMPREPLY < <(compgen -W "$(pacman -Sql)" -- "$cur")
 }
+_devtools_completions_protocol() {
+	mapfile -t COMPREPLY < <(compgen -W "https" -- "$cur")
+}
 
 __devtools_complete() {
 	local service=$1
diff --git a/contrib/completion/zsh/_devtools.in b/contrib/completion/zsh/_devtools.in
index 240f781..a473bc2 100644
--- a/contrib/completion/zsh/_devtools.in
+++ b/contrib/completion/zsh/_devtools.in
@@ -108,6 +108,7 @@ _pkgctl_repo_switch_args=(
 
 _pkgctl_repo_clone_args=(
 	'(-m --maintainer=)'{-m,--maintainer=}'[Clone all packages of the named maintainer]:maintainer:'
+	'--protocol[Clone the repository over https]:proto:(https)'
 	'--switch=[Switch the current working tree to a specified version]'
 	'--universe[Clone all existing packages, useful for cache warming]'
 	'(-j --jobs)'{-j,--jobs}'[Run up to N jobs in parallel (default: number of processing units)]:jobs:'
@@ -116,6 +117,7 @@ _pkgctl_repo_clone_args=(
 )
 
 _pkgctl_repo_configure_args=(
+	'--protocol[Configure remote url to use https]:proto:(https)'
 	'(-j --jobs)'{-j,--jobs}'[Run up to N jobs in parallel (default: number of processing units)]:jobs:'
 	'(-h --help)'{-h,--help}'[Display usage]'
 	'*:git_dir:_files -/'
diff --git a/doc/man/pkgctl-repo-clone.1.asciidoc b/doc/man/pkgctl-repo-clone.1.asciidoc
index d6da062..421c71f 100644
--- a/doc/man/pkgctl-repo-clone.1.asciidoc
+++ b/doc/man/pkgctl-repo-clone.1.asciidoc
@@ -25,6 +25,9 @@ Options
 *-m, --maintainer* 'NAME'::
 	Clone all packages of the named maintainer
 
+*--protocol* 'https'::
+	Clone the repository over https
+
 *--universe*::
 	Clone all existing packages, useful for cache warming
 
diff --git a/doc/man/pkgctl-repo-configure.1.asciidoc b/doc/man/pkgctl-repo-configure.1.asciidoc
index 1b07dc7..6bdea93 100644
--- a/doc/man/pkgctl-repo-configure.1.asciidoc
+++ b/doc/man/pkgctl-repo-configure.1.asciidoc
@@ -25,6 +25,9 @@ read-only HTTPS otherwise.
 Options
 -------
 
+*--protocol* 'https'::
+	Configure remote url to use https
+
 *-j, --jobs* 'N'::
 	Run up to N jobs in parallel. By default the number of jobs is equal to the
 	number of available processing units. For sequential processing this option
diff --git a/src/lib/repo/clone.sh b/src/lib/repo/clone.sh
index a02d799..08bded4 100644
--- a/src/lib/repo/clone.sh
+++ b/src/lib/repo/clone.sh
@@ -26,12 +26,13 @@ pkgctl_repo_clone_usage() {
 		Clone Git packaging repositories from the canonical namespace.
 
 		The configure command is subsequently invoked to synchronize the distro
-		specs and makepkg.conf settings. The unprivileged option can be used
+		specs and makepkg.conf settings. The protocol option can be used
 		for cloning packaging repositories without SSH access using read-only
 		HTTPS.
 
 		OPTIONS
 		    -m, --maintainer=NAME  Clone all packages of the named maintainer
+		    --protocol https       Clone the repository over https
 		    --switch VERSION       Switch the current working tree to a specified version
 		    --universe             Clone all existing packages, useful for cache warming
 		    -j, --jobs N           Run up to N jobs in parallel (default: $(nproc))
@@ -69,11 +70,21 @@ pkgctl_repo_clone() {
 				pkgctl_repo_clone_usage
 				exit 0
 				;;
-			-u|--unprivileged)
+			--protocol=https)
 				GIT_REPO_BASE_URL=${GIT_PACKAGING_URL_HTTPS}
 				CONFIGURE_OPTIONS+=("$1")
 				shift
 				;;
+			--protocol)
+				(( $# <= 1 )) && die "missing argument for %s" "$1"
+				if [[ $2 == https ]]; then
+					GIT_REPO_BASE_URL=${GIT_PACKAGING_URL_HTTPS}
+				else
+					die "unsupported protocol: %s" "$2"
+				fi
+				CONFIGURE_OPTIONS+=("$1" "$2")
+				shift 2
+				;;
 			-m|--maintainer)
 				(( $# <= 1 )) && die "missing argument for %s" "$1"
 				MAINTAINER="$2"
diff --git a/src/lib/repo/configure.sh b/src/lib/repo/configure.sh
index a5708a0..81b7d19 100644
--- a/src/lib/repo/configure.sh
+++ b/src/lib/repo/configure.sh
@@ -33,6 +33,7 @@ pkgctl_repo_configure_usage() {
 		read-only HTTPS otherwise.
 
 		OPTIONS
+		    --protocol https     Configure remote url to use https
 		    -j, --jobs N         Run up to N jobs in parallel (default: $(nproc))
 		    -h, --help           Show this help text
 
@@ -94,6 +95,7 @@ pkgctl_repo_configure() {
 	local GIT_REPO_BASE_URL=${GIT_PACKAGING_URL_HTTPS}
 	local official=0
 	local proto=https
+	local proto_force=0
 	local jobs=
 	jobs=$(nproc)
 	local paths=()
@@ -109,6 +111,19 @@ pkgctl_repo_configure() {
 				pkgctl_repo_configure_usage
 				exit 0
 				;;
+			--protocol=https)
+				proto_force=1
+				shift
+				;;
+			--protocol)
+				(( $# <= 1 )) && die "missing argument for %s" "$1"
+				if [[ $2 == https ]]; then
+					proto_force=1
+				else
+					die "unsupported protocol: %s" "$2"
+				fi
+				shift 2
+				;;
 			-j|--jobs)
 				(( $# <= 1 )) && die "missing argument for %s" "$1"
 				jobs=$2
@@ -152,8 +167,10 @@ pkgctl_repo_configure() {
 		fi
 		if is_packager_email_official "${packager_email}"; then
 			official=1
-			proto=ssh
-			GIT_REPO_BASE_URL=${GIT_PACKAGING_URL_SSH}
+			if (( ! proto_force )); then
+				proto=ssh
+				GIT_REPO_BASE_URL=${GIT_PACKAGING_URL_SSH}
+			fi
 		fi
 	fi