diff --git a/backend/cmd/server/main.go b/backend/cmd/server/main.go
index c17acd3..1dad850 100644
--- a/backend/cmd/server/main.go
+++ b/backend/cmd/server/main.go
@@ -51,7 +51,6 @@ func main() {
 		SecretKey:      cfg.StorageSecretKey,
 		Bucket:         cfg.StorageBucket,
 		UseSSL:         cfg.StorageUseSSL,
-		PublicUseSSL:   true,
 	})
 	if err != nil {
 		log.Fatalf("storage unavailable: %v", err)
diff --git a/backend/internal/storage/storage.go b/backend/internal/storage/storage.go
index 3ee4dbd..223163b 100644
--- a/backend/internal/storage/storage.go
+++ b/backend/internal/storage/storage.go
@@ -4,6 +4,8 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net/url"
+	"strings"
 	"time"
 
 	"github.com/minio/minio-go/v7"
@@ -17,7 +19,6 @@ type Config struct {
 	SecretKey      string
 	Bucket         string
 	UseSSL         bool
-	PublicUseSSL   bool
 }
 
 type ObjectInfo struct {
@@ -57,9 +58,13 @@ func NewMinIO(config Config) (*MinIO, error) {
 
 	publicClient := client
 	if config.PublicEndpoint != "" {
-		publicClient, err = minio.New(config.PublicEndpoint, &minio.Options{
+		publicEndpoint, secure, err := parseEndpoint(config.PublicEndpoint)
+		if err != nil {
+			return nil, fmt.Errorf("parse public endpoint: %w", err)
+		}
+		publicClient, err = minio.New(publicEndpoint, &minio.Options{
 			Creds:  credentials.NewStaticV4(config.AccessKey, config.SecretKey, ""),
-			Secure: config.PublicUseSSL,
+			Secure: secure,
 		})
 		if err != nil {
 			return nil, fmt.Errorf("create public object storage client: %w", err)
@@ -136,3 +141,16 @@ func (s *MinIO) Put(ctx context.Context, key string, reader io.Reader, size int6
 }
 
 var _ Storage = (*MinIO)(nil)
+
+func parseEndpoint(raw string) (host string, secure bool, err error) {
+	if !strings.Contains(raw, "://") {
+		raw = "http://" + raw
+	}
+	u, err := url.Parse(raw)
+	if err != nil {
+		return "", false, err
+	}
+	host = u.Host
+	secure = u.Scheme == "https"
+	return host, secure, nil
+}