diff --git a/internal/controllers/constants/constants.go b/internal/controllers/constants/constants.go
index b95fb50c..af25d072 100644
--- a/internal/controllers/constants/constants.go
+++ b/internal/controllers/constants/constants.go
@@ -38,6 +38,7 @@ const (
 	OperatorNamePrefix         string = "cryostat-operator-"
 	OperatorDeploymentName     string = "cryostat-operator-controller"
 	HttpPortName               string = "http"
+	HttpsPortName              string = "https"
 	// CAKey is the key for a CA certificate within a TLS secret
 	CAKey = certMeta.TLSCAKey
 	// ALL capability to drop for restricted pod security. See:
diff --git a/internal/controllers/services.go b/internal/controllers/services.go
index bdbd2ff3..d6b16fd8 100644
--- a/internal/controllers/services.go
+++ b/internal/controllers/services.go
@@ -47,7 +47,10 @@ func (r *Reconciler) reconcileCoreService(ctx context.Context, cr *model.Cryosta
 			"app":       cr.Name,
 			"component": "cryostat",
 		}
-		appProtocol := "http"
+		appProtocol := constants.HttpPortName
+		if tls != nil {
+			appProtocol = constants.HttpsPortName
+		}
 		svc.Spec.Ports = []corev1.ServicePort{
 			{
 				Name:        constants.HttpPortName,
diff --git a/internal/test/resources.go b/internal/test/resources.go
index e07ced37..536e0630 100644
--- a/internal/test/resources.go
+++ b/internal/test/resources.go
@@ -1003,6 +1003,9 @@ func (r *TestResources) NewCryostatWithAgentHostnameVerifyDisabled() *model.Cryo
 
 func (r *TestResources) NewCryostatService() *corev1.Service {
 	appProtocol := "http"
+	if r.TLS {
+		appProtocol = "https"
+	}
 	return &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:      r.Name,