diff --git a/tests/dockerfiles/ConfigUrl.Dockerfile b/tests/dockerfiles/ConfigUrl.Dockerfile
new file mode 100644
index 0000000..3a17244
--- /dev/null
+++ b/tests/dockerfiles/ConfigUrl.Dockerfile
@@ -0,0 +1,14 @@
+FROM debian:trixie-slim AS target
+FROM interdiode/id-configurator:latest AS configuration
+ARG CONFIG_REPO_PORT
+ARG CONFIG_URL_CACERT_CONTENT
+COPY --from=target / /src/
+RUN id-configurator apply \
+    --config-url "https://host.docker.internal:${CONFIG_REPO_PORT}/config.yaml" \
+    --config-url-cacert-content "$CONFIG_URL_CACERT_CONTENT" \
+    --src /src --dst /dst
+FROM target AS runtime
+COPY --from=configuration /dst/ /
+RUN grep -qx \
+    'test-only certificate fetched via --config-url by the id-configurator integration tests' \
+    /usr/local/share/ca-certificates/config-url-marker.crt
diff --git a/tests/dockerfiles/repos/config-url-config.yaml b/tests/dockerfiles/repos/config-url-config.yaml
new file mode 100644
index 0000000..3231c32
--- /dev/null
+++ b/tests/dockerfiles/repos/config-url-config.yaml
@@ -0,0 +1,14 @@
+# Static id-configurator configuration served by the config-url-repo fixture,
+# to be downloaded (not copied in locally) via `id-configurator apply
+# --config-url ... --config-url-cacert-content ...`
+# (tests/dockerfiles/ConfigUrl.Dockerfile). No per-run templating is needed:
+# unlike the module-* fixtures, nothing in this document needs to reference
+# its own server's dynamic host:port.
+uuid: 8f3e4b2c-9a41-4d3e-8f1a-2b6c7d8e9f01
+organisation: InterDiode
+description: Configuration downloaded via --config-url
+configurations:
+  certificates:
+  - name: config-url-marker
+    content: |
+      test-only certificate fetched via --config-url by the id-configurator integration tests
diff --git a/tests/dockerfiles/repos/config-url-repo.Dockerfile b/tests/dockerfiles/repos/config-url-repo.Dockerfile
new file mode 100644
index 0000000..bc26ab9
--- /dev/null
+++ b/tests/dockerfiles/repos/config-url-repo.Dockerfile
@@ -0,0 +1,13 @@
+# Serves a static id-configurator configuration document over TLS, using the
+# same Test CA as the other *-repo fixtures, used by tox-docker to exercise
+# `id-configurator apply --config-url ... --config-url-cacert-content ...`
+# (tests/dockerfiles/ConfigUrl.Dockerfile).
+#
+# Built by tox-docker, whose build context is this directory (not the repo
+# root) - every COPY source below must live under tests/dockerfiles/repos/.
+FROM nginx:alpine
+COPY config-url-config.yaml /srv/config.yaml
+COPY repo-server.crt.pem /etc/nginx/certs/repo-server.crt.pem
+COPY repo-server.key.pem /etc/nginx/certs/repo-server.key.pem
+COPY config-url-repo.nginx.conf /etc/nginx/conf.d/default.conf
+EXPOSE 8443
diff --git a/tests/dockerfiles/repos/config-url-repo.nginx.conf b/tests/dockerfiles/repos/config-url-repo.nginx.conf
new file mode 100644
index 0000000..aafed09
--- /dev/null
+++ b/tests/dockerfiles/repos/config-url-repo.nginx.conf
@@ -0,0 +1,10 @@
+server {
+    listen 8443 ssl default_server;
+    server_name _;
+
+    ssl_certificate     /etc/nginx/certs/repo-server.crt.pem;
+    ssl_certificate_key /etc/nginx/certs/repo-server.key.pem;
+
+    root /srv;
+    autoindex off;
+}
diff --git a/tox.ini b/tox.ini
index 5187797..d6d6bc9 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,5 +1,5 @@
 [tox]
-env_list = py313,py314,coverage,packaging,packaging-amd64,packaging-arm64,publish,module-python,module-apt,module-yum,module-apk,module-java,module-certificates,module-php,module-npm,module-rust,module-go,module-ruby,module-nuget
+env_list = py313,py314,coverage,packaging,packaging-amd64,packaging-arm64,publish,module-python,module-apt,module-yum,module-apk,module-java,module-certificates,module-php,module-npm,module-rust,module-go,module-ruby,module-nuget,config-url
 isolated_build = true
 requires =
     tox>=4
@@ -387,3 +387,32 @@ commands =
     python3 -m id_tools test render-config {tox_root}/tests/configs/NuGet.yaml.j2 {env_dir}/configs/NuGet.yaml
     docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-context generated-config={env_dir}/configs -f {tox_root}/tests/dockerfiles/NuGet.Dockerfile -t id-configurator-nuget .
     docker rmi id-configurator-nuget
+
+[docker:config-url-repo]
+dockerfile = {tox_root}/tests/dockerfiles/repos/config-url-repo.Dockerfile
+expose =
+    CONFIG_REPO_PORT=8443/tcp
+healthcheck_cmd = wget --no-check-certificate -qO- https://127.0.0.1:8443/config.yaml || exit 1
+healthcheck_interval = 1
+healthcheck_retries = 30
+healthcheck_timeout = 2
+healthcheck_start_period = 1
+
+[testenv:config-url]
+package = skip
+labels = end-to-end
+change_dir = {tox_root}
+dependency_groups = dev
+docker =
+    config-url-repo
+allowlist_externals =
+    docker
+    sh
+description =
+    Verifies `id-configurator apply --config-url ... --config-url-cacert-content
+    ...`: the configuration itself is downloaded over HTTPS from the
+    config-url-repo fixture (trusting only the given root CA content, not the
+    system's trust store), rather than read from a local --config file.
+commands =
+    sh -c 'docker buildx build --platform linux/amd64 --add-host=host.docker.internal:host-gateway --build-arg CONFIG_REPO_PORT={env:CONFIG_REPO_PORT} --build-arg CONFIG_URL_CACERT_CONTENT="$(cat {tox_root}/tests/certs/test-ca.crt.pem)" -f {tox_root}/tests/dockerfiles/ConfigUrl.Dockerfile -t id-configurator-config-url .'
+    docker rmi id-configurator-config-url