diff --git a/core/modules/update/src/UpdateFetcher.php b/core/modules/update/src/UpdateFetcher.php
index b005ad6..d6101b7 100644
--- a/core/modules/update/src/UpdateFetcher.php
+++ b/core/modules/update/src/UpdateFetcher.php
@@ -4,6 +4,7 @@
 
 use Drupal\Core\Config\ConfigFactoryInterface;
 use Drupal\Core\DependencyInjection\DependencySerializationTrait;
+use Drupal\Core\Site\Settings;
 use GuzzleHttp\ClientInterface;
 use GuzzleHttp\Exception\RequestException;
 
@@ -41,17 +42,27 @@ class UpdateFetcher implements UpdateFetcherInterface {
   protected $httpClient;
 
   /**
+   * Whether to use http fallback if https fails.
+   *
+   * @var bool
+   */
+  protected $withHttpFallback;
+
+  /**
    * Constructs a UpdateFetcher.
    *
    * @param \Drupal\Core\Config\ConfigFactoryInterface $config_factory
    *   The config factory.
    * @param \GuzzleHttp\ClientInterface $http_client
    *   A Guzzle client object.
+   * @param \Drupal\Core\Site\Settings
+   *   The settings instance.
    */
-  public function __construct(ConfigFactoryInterface $config_factory, ClientInterface $http_client) {
+  public function __construct(ConfigFactoryInterface $config_factory, ClientInterface $http_client, Settings $settings) {
     $this->fetchUrl = $config_factory->get('update.settings')->get('fetch.url');
     $this->httpClient = $http_client;
     $this->updateSettings = $config_factory->get('update.settings');
+    $this->withHttpFallback = $settings->get('update_fetch_with_http_fallback', FALSE);
   }
 
   /**
@@ -59,7 +70,7 @@ public function __construct(ConfigFactoryInterface $config_factory, ClientInterf
    */
   public function fetchProjectData(array $project, $site_key = '') {
     $url = $this->buildFetchUrl($project, $site_key);
-    return $this->doRequestWithHTTPFallback($url, ['headers' => ['Accept' => 'text/xml']], TRUE);
+    return $this->doRequestWithHTTPFallback($url, ['headers' => ['Accept' => 'text/xml']], $this->withHttpFallback);
   }
 
   /**
@@ -73,7 +84,7 @@ public function fetchProjectData(array $project, $site_key = '') {
    * @param array $options.
    *   The guzzle client options.
    * @param bool $with_http_fallback
-   *   Should the function callback to http.
+   *   Should the function fall back to http.
    *
    * @return string
    */
diff --git a/core/modules/update/update.services.yml b/core/modules/update/update.services.yml
index fc176d6..cbbd498 100644
--- a/core/modules/update/update.services.yml
+++ b/core/modules/update/update.services.yml
@@ -12,7 +12,7 @@ services:
     arguments: ['@config.factory', '@queue', '@update.fetcher', '@state', '@private_key', '@keyvalue', '@keyvalue.expirable']
   update.fetcher:
     class: Drupal\update\UpdateFetcher
-    arguments: ['@config.factory', '@http_client']
+    arguments: ['@config.factory', '@http_client', '@settings']
   update.root:
     class: SplString
     factory: update.root.factory:get