diff --git a/dankclaw/Caddyfile b/dankclaw/Caddyfile
index 7494e4f..f7da7c2 100644
--- a/dankclaw/Caddyfile
+++ b/dankclaw/Caddyfile
@@ -190,11 +190,28 @@ pihole.franksdank.cloud {
 # Let's Encrypt cert for it. It stays plain-HTTP legacy; the canonical
 # name is plex.franksdank.cloud (HTTPS, below).
 http://plex.franksdank.casa {
-	reverse_proxy 192.168.0.235:32400
+	reverse_proxy 192.168.0.235:32400 {
+		transport http {
+			tls {
+				insecure_skip_verify
+			}
+		}
+	}
 }
 
+# PMS requires TLS from every non-loopback client: plain-HTTP off-loopback
+# is read and silently closed (diagnosed 2026-08-26), which surfaced as an
+# empty-body 502 here. Dial the upstream over TLS; PMS's self-signed cert is
+# skipped on this pinned-LAN hop only (client-facing LE TLS is untouched).
+# The web UI lives at /web/; / returns the XML MediaContainer index.
 plex.franksdank.cloud {
-	reverse_proxy 192.168.0.235:32400
+	reverse_proxy 192.168.0.235:32400 {
+		transport http {
+			tls {
+				insecure_skip_verify
+			}
+		}
+	}
 }
 
 # --- Calibre-Web ---
diff --git a/docs/Infrastructure/Caddy.md b/docs/Infrastructure/Caddy.md
index f029949..9061a4e 100644
--- a/docs/Infrastructure/Caddy.md
+++ b/docs/Infrastructure/Caddy.md
@@ -46,7 +46,7 @@ Every vhost uses the flat `franksdank.cloud` convention. The full list lives in
 | Dankclaw quadlet services | by published LAN port, e.g. `192.168.0.143:3000` (Gitea) |
 | Dankserver services | by published LAN port, e.g. `192.168.0.235:8085` (RomM) |
 
-The bare-IP catch-all `:80` 302-redirects to `https://dankclaw.franksdank.cloud/`. The legacy name `dankserver.franksdank.cloud` 302-redirects there too. `plex.franksdank.casa` is the only plain-HTTP vhost; it cannot get a DNS-01 cert because `franksdank.casa` is not in the Porkbun account. The canonical Plex name is `plex.franksdank.cloud`.
+The bare-IP catch-all `:80` 302-redirects to `https://dankclaw.franksdank.cloud/`. The legacy name `dankserver.franksdank.cloud` 302-redirects there too. `plex.franksdank.casa` is the only plain-HTTP vhost; it cannot get a DNS-01 cert because `franksdank.casa` is not in the Porkbun account. The canonical Plex name is `plex.franksdank.cloud`. Both Plex vhosts dial PMS **over TLS upstream** (`transport http { tls { insecure_skip_verify } }`): PMS 1.43.x silently closes plain-HTTP connections from non-loopback sources (diagnosed 2026-08-26 — it accepts, reads the request, and FINs without responding), which surfaced here as an empty-body 502 (blank page in browsers). `insecure_skip_verify` applies only to this pinned-LAN hop (PMS serves a self-signed cert); client-facing Let's Encrypt TLS is unchanged. The Plex web UI is at `/web/`; `/` returns the XML `MediaContainer` index.
 
 ## Basic auth
 
diff --git a/docs/log.md b/docs/log.md
index b231056..ce9d5ed 100644
--- a/docs/log.md
+++ b/docs/log.md
@@ -12,6 +12,9 @@ timestamp: 2026-08-26
 # Bundle Change Log
 
 ## 2026-08-26
+- `/dankclaw/Caddyfile` — Both Plex vhosts now proxy to PMS over a TLS upstream (`insecure_skip_verify`); PMS drops plain-HTTP connections from non-loopback sources, which produced empty-body 502s.
+- `/docs/Infrastructure/Caddy.md` — Documented the Plex TLS-upstream requirement and the `/web/` vs `/` distinction.
+- `/tests/caddyfile.bats` — Added a test pinning the TLS upstream transport on both Plex vhosts.
 - `/docs/Dankclaw/Gitea.md` — Documented migration of Gitea web proxy ownership to canonical Caddy and retirement of the standalone proxy.
 - `/docs/Dankclaw/Dankclaw Stack.md` — Updated boot-persistence and Caddy deployment descriptions for the two-unit Gitea stack.
 - `/docs/Architecture/Deployment Flow.md` — Replaced the split-proxy safety description with the canonical Caddy ownership model.