diff --git a/test/test_helper.rb b/test/test_helper.rb
index 17d3c8a5d..8701a43f4 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -40,7 +40,11 @@ def setup
 
   def launch(protocol: 'https', plugins: [], settings: {})
     port = 0
-    @settings = Proxy::Settings::Global.new(settings.merge("#{protocol}_port" => port))
+    # Pin tls_ciphers to OpenSSL defaults unless a test overrides it, so HTTPS
+    # integration tests don't depend on the host's crypto-policies/OpenSSL
+    # combination (tests shouldn't rely on where they happen to run).
+    default_settings = (protocol == 'https') ? { tls_ciphers: '' } : {}
+    @settings = Proxy::Settings::Global.new(default_settings.merge(settings).merge("#{protocol}_port" => port))
     @t = Thread.new do
       launcher = Proxy::Launcher.new(@settings)
       app = launcher.public_send("#{protocol}_app", port, plugins)