diff --git a/lib/private/Collaboration/Collaborators/LookupPlugin.php b/lib/private/Collaboration/Collaborators/LookupPlugin.php
index 29915625e1ad1..6e8a0bbb25922 100644
--- a/lib/private/Collaboration/Collaborators/LookupPlugin.php
+++ b/lib/private/Collaboration/Collaborators/LookupPlugin.php
@@ -52,11 +52,16 @@ public function search($search, $limit, $offset, ISearchResult $searchResult): b
 
 		try {
 			$client = $this->clientService->newClient();
+			/**
+			 * @psalm-suppress TypeDoesNotContainType - $isGlobalScaleEnabled always true at this point
+			 * @psalm-suppress RedundantCondition - guard rail in case we re-activate LUS out of GlobalScale
+			 */
 			$response = $client->get(
 				$lookupServerUrl . '/users?search=' . urlencode($search),
 				[
 					'timeout' => 10,
 					'connect_timeout' => 3,
+					'verify' => !($isGlobalScaleEnabled && $this->config->getSystemValueBool('gss.selfsigned.allow', false) === true)
 				]
 			);
 
diff --git a/tests/lib/Collaboration/Collaborators/LookupPluginTest.php b/tests/lib/Collaboration/Collaborators/LookupPluginTest.php
index 5fc218dc6d80e..ee386b6b074ef 100644
--- a/tests/lib/Collaboration/Collaborators/LookupPluginTest.php
+++ b/tests/lib/Collaboration/Collaborators/LookupPluginTest.php
@@ -140,11 +140,12 @@ public function testSearch(array $searchParams): void {
 			->method('getAppValue')
 			->with('files_sharing', 'lookupServerEnabled', 'no')
 			->willReturn('yes');
-		$this->config->expects($this->exactly(2))
+		$this->config->expects($this->exactly(3))
 			->method('getSystemValueBool')
 			->willReturnMap([
 				['gs.enabled', false, true],
 				['has_internet_connection', true, true],
+				['gss.selfsigned.allow', false, false],
 			]);
 
 		$this->config->expects($this->once())
@@ -202,11 +203,12 @@ public function testSearchEnableDisableLookupServer(array $searchParams, $GSEnab
 				->method('addResultSet')
 				->with($type, $searchParams['expectedResult'], []);
 
-			$this->config->expects($this->exactly(2))
+			$this->config->expects($this->exactly(3))
 				->method('getSystemValueBool')
 				->willReturnMap([
 					['gs.enabled', false, $GSEnabled],
 					['has_internet_connection', true, true],
+					['gss.selfsigned.allow', false, false],
 				]);
 			$this->config->expects($this->once())
 				->method('getSystemValueString')