diff --git a/cmd/tip/Dockerfile b/cmd/tip/Dockerfile
index 8364cdb8a3..d258f7f733 100644
--- a/cmd/tip/Dockerfile
+++ b/cmd/tip/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.5
+FROM golang:1.6
 
 RUN apt-get update && apt-get install --no-install-recommends -y -q build-essential git
 
@@ -10,4 +10,4 @@ ADD . /go/src/tip
 RUN go install tip
 ENTRYPOINT ["/go/bin/tip"]
 # Kubernetes expects us to listen on port 8080
-EXPOSE 8080 
+EXPOSE 8080
diff --git a/cmd/tip/tip.go b/cmd/tip/tip.go
index 43894144d6..e521024fe6 100644
--- a/cmd/tip/tip.go
+++ b/cmd/tip/tip.go
@@ -44,7 +44,7 @@ func main() {
 
 	p := &Proxy{builder: b}
 	go p.run()
-	http.Handle("/", p)
+	http.Handle("/", httpsOnlyHandler{p})
 	http.HandleFunc("/_ah/health", p.serveHealthCheck)
 
 	log.Print("Starting up")
@@ -323,3 +323,19 @@ func getOK(url string) (body []byte, err error) {
 	}
 	return body, nil
 }
+
+// httpsOnlyHandler redirects requests to "http://example.com/foo?bar"
+// to "https://example.com/foo?bar"
+type httpsOnlyHandler struct {
+	h http.Handler
+}
+
+func (h httpsOnlyHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Header.Get("X-Appengine-Https") == "off" {
+		r.URL.Scheme = "https"
+		r.URL.Host = r.Host
+		http.Redirect(w, r, r.URL.String(), http.StatusFound)
+		return
+	}
+	h.h.ServeHTTP(w, r)
+}