diff --git a/packages/app/src/api/index.ts b/packages/app/src/api/index.ts
index 2a806cafca..55c1fb24a4 100644
--- a/packages/app/src/api/index.ts
+++ b/packages/app/src/api/index.ts
@@ -111,16 +111,32 @@ export class Api {
     const smMetadata = getLightClientMetadata(this.#chainType, this.network);
     const { chainSpec: relayChainSpec } = await smMetadata.relay.fn();
 
+    // Filter non-encrypted boot nodes in production.
+    const wssRelayChainSpec =
+      import.meta.env.MODE === 'development'
+        ? relayChainSpec
+        : this.wssBootNodesOnly(relayChainSpec);
+
     let chain;
     if (this.#chainType === 'relay') {
-      chain = smoldot.addChain({ chainSpec: relayChainSpec });
+      chain = smoldot.addChain({
+        chainSpec: wssRelayChainSpec,
+      });
       this.#apiClient = createClient(getSmProvider(chain));
     } else {
       const { chainSpec: paraChainSpec } = await smMetadata!.para!.fn();
+      // Filter non-encrypted boot nodes in production.
+      const wssParaChainSpec =
+        import.meta.env.MODE === 'development'
+          ? paraChainSpec
+          : this.wssBootNodesOnly(paraChainSpec);
+
       chain = smoldot.addChain({
-        chainSpec: paraChainSpec,
+        chainSpec: this.wssBootNodesOnly(wssParaChainSpec),
         potentialRelayChains: [
-          await smoldot.addChain({ chainSpec: relayChainSpec }),
+          await smoldot.addChain({
+            chainSpec: wssRelayChainSpec,
+          }),
         ],
       });
       this.#apiClient = createClient(getSmProvider(chain));
@@ -261,4 +277,12 @@ export class Api {
       this.dispatchEvent(this.ensureEventStatus('disconnected'));
     }
   }
+
+  wssBootNodesOnly(spec: string) {
+    const filtered = Object.assign({}, JSON.parse(spec));
+    filtered.bootNodes = filtered.bootNodes.filter((node: string) =>
+      /\/wss\//.test(node)
+    );
+    return JSON.stringify(filtered);
+  }
 }