diff --git a/docker/telemetry/xrpld-telemetry-mainnet.cfg b/docker/telemetry/xrpld-telemetry-mainnet.cfg
index afca57e4fa..9bd8779483 100644
--- a/docker/telemetry/xrpld-telemetry-mainnet.cfg
+++ b/docker/telemetry/xrpld-telemetry-mainnet.cfg
@@ -105,8 +105,15 @@ data/logs/mainnet/debug.log
 
 # --- SSL --------------------------------------------------------------------
 
+# Keep the secure default (1). The Mainnet validator lists in
+# validators-mainnet.txt are fetched from public HTTPS publishers that present
+# valid CA certificates, so there is no self-signed cert to work around here.
+# Setting this to 0 would skip both the certificate chain check and the
+# hostname match on those fetches. The list blob's own signature is verified
+# against the pinned publisher keys either way; this adds TLS peer
+# authentication on top of that.
 [ssl_verify]
-0
+1
 
 # --- Insight (native OTel metrics via beast::insight) -----------------------