diff --git a/internal/dockeragent/agent.go b/internal/dockeragent/agent.go
index e7f741ba4..bac94cab9 100644
--- a/internal/dockeragent/agent.go
+++ b/internal/dockeragent/agent.go
@@ -999,6 +999,12 @@ func newHTTPClient(insecure bool) *http.Client {
 		Transport: &http.Transport{
 			TLSClientConfig: tlsConfig,
 		},
+		// Disallow redirects for agent API calls. If a reverse proxy redirects
+		// HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec),
+		// causing 405 errors. Return an error with guidance instead.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL)
+		},
 	}
 }
 
diff --git a/internal/hostagent/agent.go b/internal/hostagent/agent.go
index d3ccc0a33..502503bb2 100644
--- a/internal/hostagent/agent.go
+++ b/internal/hostagent/agent.go
@@ -184,6 +184,12 @@ func New(cfg Config) (*Agent, error) {
 			Proxy:           http.ProxyFromEnvironment,
 			TLSClientConfig: tlsConfig,
 		},
+		// Disallow redirects for agent API calls. If a reverse proxy redirects
+		// HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec),
+		// causing 405 errors. Return an error with guidance instead.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL)
+		},
 	}
 
 	trimmedTags := make([]string, 0, len(cfg.Tags))
diff --git a/internal/kubernetesagent/agent.go b/internal/kubernetesagent/agent.go
index 6d771e636..2c16795db 100644
--- a/internal/kubernetesagent/agent.go
+++ b/internal/kubernetesagent/agent.go
@@ -139,6 +139,12 @@ func New(cfg Config) (*Agent, error) {
 			Proxy:           http.ProxyFromEnvironment,
 			TLSClientConfig: tlsConfig,
 		},
+		// Disallow redirects for agent API calls. If a reverse proxy redirects
+		// HTTP to HTTPS, Go's default behavior converts POST to GET (per HTTP spec),
+		// causing 405 errors. Return an error with guidance instead.
+		CheckRedirect: func(req *http.Request, via []*http.Request) error {
+			return fmt.Errorf("server returned redirect to %s - if using a reverse proxy, ensure you use the correct protocol (https:// instead of http://) in your --url flag", req.URL)
+		},
 	}
 
 	clusterServer := strings.TrimSpace(restCfg.Host)