diff --git a/playwright/tests/setups/keyconnector.ts b/playwright/tests/setups/keyconnector.ts
index 341d5779..3de31a8d 100644
--- a/playwright/tests/setups/keyconnector.ts
+++ b/playwright/tests/setups/keyconnector.ts
@@ -1,4 +1,4 @@
-import { createServer, type Server } from 'node:http';
+import { createServer } from 'node:http';
 
 /**
  * Barebone in-memory key connector, just enough for the clients to enroll and unlock.
diff --git a/src/config.rs b/src/config.rs
index 8c57e0bd..a1e6789b 100644
--- a/src/config.rs
+++ b/src/config.rs
@@ -1104,8 +1104,9 @@ fn validate_config(cfg: &ConfigItems, on_update: bool) -> Result<(), Error> {
         if cfg.key_connector_url.is_empty() {
             err!("`KEY_CONNECTOR_URL` must be set when Key Connector is enabled")
         }
-        if Url::parse(&cfg.key_connector_url).is_err() {
-            err!("Invalid URL format for `KEY_CONNECTOR_URL`.");
+        let kc_url = cfg.key_connector_url.to_lowercase();
+        if !kc_url.starts_with("http://") && !kc_url.starts_with("https://") || Url::parse(&kc_url).is_err() {
+            err!("`KEY_CONNECTOR_URL` must be a valid URL containing the protocol (http, https)")
         }
     }
 
diff --git a/src/util.rs b/src/util.rs
index 0ce1a966..6fd68bfd 100644
--- a/src/util.rs
+++ b/src/util.rs
@@ -135,9 +135,11 @@ impl Fairing for AppHeaders {
                     allowed_iframe_ancestors = CONFIG.allowed_iframe_ancestors(),
                     allowed_connect_src = CONFIG.allowed_connect_src(),
                     // The web vault fetches the master key from the key connector, so it
-                    // has to be allowed to connect to it.
+                    // has to be allowed to connect to it. Only use the origin here, a
+                    // query or fragment in the URL would break the source expression.
                     key_connector_src = if CONFIG.key_connector_enabled() {
-                        CONFIG.key_connector_url()
+                        url::Url::parse(&CONFIG.key_connector_url())
+                            .map_or_else(|_| String::new(), |u| u.origin().ascii_serialization())
                     } else {
                         String::new()
                     },