diff --git a/lib/git.js b/lib/git.js
index 077193a8..304c2cbe 100644
--- a/lib/git.js
+++ b/lib/git.js
@@ -19,7 +19,7 @@ const hashre = /^[a-f0-9]{40}$/
 // otherwise, prefer ssh if available (more secure).
 // We have to add the git+ back because npa suppresses it.
 const repoUrl = (h, opts) =>
-  h.sshurl && !(h.https && h.auth) && addGitPlus(h.sshurl(opts)) ||
+  h.sshurl && !(h.https && (h.auth || h.default === 'https')) && addGitPlus(h.sshurl(opts)) ||
   h.https && addGitPlus(h.https(opts))
 
 // add git+ to the url, but only one time.
diff --git a/lib/util/add-git-sha.js b/lib/util/add-git-sha.js
index 843fe5b6..d8e3d373 100644
--- a/lib/util/add-git-sha.js
+++ b/lib/util/add-git-sha.js
@@ -3,7 +3,7 @@ const addGitSha = (spec, sha) => {
   if (spec.hosted) {
     const h = spec.hosted
     const opt = { noCommittish: true }
-    const base = h.https && h.auth ? h.https(opt) : h.shortcut(opt)
+    const base = h.https && (h.auth || h.default === 'https') ? h.https(opt) : h.shortcut(opt)
 
     return `${base}#${sha}`
   } else {
diff --git a/test/git.js b/test/git.js
index d1d89d93..4fe5e9f7 100644
--- a/test/git.js
+++ b/test/git.js
@@ -670,13 +670,14 @@ t.test('repoUrl function', { skip: isWindows && 'posix only' }, async t => {
   const { hosted: ssh } = npa(`git+ssh://git@github.com/${proj}`)
   const { hosted: git } = npa(`git://github.com/${proj}`)
   const { repoUrl } = GitFetcher
-  const expectNoAuth = `git+ssh://git@github.com/${proj}`
+  const expectNoAuthSsh = `git+ssh://git@github.com/${proj}`
+  const expectNoAuthHttps = `git+https://github.com/${proj}`
   const expectAuth = `git+https://user:pass@github.com/${proj}`
-  t.match(repoUrl(shortcut), expectNoAuth)
+  t.match(repoUrl(shortcut), expectNoAuthSsh)
   t.match(repoUrl(hasAuth), expectAuth)
-  t.match(repoUrl(noAuth), expectNoAuth)
-  t.match(repoUrl(ssh), expectNoAuth)
-  t.match(repoUrl(git), expectNoAuth)
+  t.match(repoUrl(noAuth), expectNoAuthHttps)
+  t.match(repoUrl(ssh), expectNoAuthSsh)
+  t.match(repoUrl(git), expectNoAuthSsh)
 })
 
 t.test('handle it when prepared git deps depend on each other', { skip: isWindows && 'posix only' },
diff --git a/test/util/add-git-sha.js b/test/util/add-git-sha.js
index 30928295..64b443a9 100644
--- a/test/util/add-git-sha.js
+++ b/test/util/add-git-sha.js
@@ -28,9 +28,9 @@ const cases = [
     'sha',
     'https://git@github.com/user/repo.git#sha'],
   // github https no auth
-  ['git+https://github.com/user/repo', 'sha', 'github:user/repo#sha'],
-  ['git+https://github.com/user/repo#othersha', 'sha', 'github:user/repo#sha'],
-  ['git+https://github.com/user/repo#othersha#otherothersha', 'sha', 'github:user/repo#sha'],
+  ['git+https://github.com/user/repo', 'sha', 'https://github.com/user/repo.git#sha'],
+  ['git+https://github.com/user/repo#othersha', 'sha', 'https://github.com/user/repo.git#sha'],
+  ['git+https://github.com/user/repo#othersha#otherothersha', 'sha', 'https://github.com/user/repo.git#sha'],
   // github ssh
   ['git+ssh://git@github.com/user/repo', 'sha', 'github:user/repo#sha'],
   ['git+ssh://git@github.com/user/repo#othersha', 'sha', 'github:user/repo#sha'],