diff --git a/src/SharpClient.Core/Connection/ITelnetConnection.cs b/src/SharpClient.Core/Connection/ITelnetConnection.cs
index e2d3b90..36408ff 100644
--- a/src/SharpClient.Core/Connection/ITelnetConnection.cs
+++ b/src/SharpClient.Core/Connection/ITelnetConnection.cs
@@ -21,6 +21,15 @@ public interface ITelnetConnection : IAsyncDisposable
 
     public ConnectionState State { get; }
 
+    /// <summary>Wrap the connection in TLS. Read on every connect and reconnect.</summary>
+    public bool UseTls { get; set; }
+
+    /// <summary>
+    /// Accept a TLS certificate that fails validation (self-signed, expired, wrong host). Many MUSHes
+    /// run TLS with a self-signed certificate, so this is a per-world opt-in, not the default.
+    /// </summary>
+    public bool AllowInvalidCertificate { get; set; }
+
     public Task ConnectAsync(string host, int port, CancellationToken cancellationToken = default);
 
     /// <summary>
diff --git a/src/SharpClient.Core/Connection/TelnetConnection.cs b/src/SharpClient.Core/Connection/TelnetConnection.cs
index 77f8560..25e300a 100644
--- a/src/SharpClient.Core/Connection/TelnetConnection.cs
+++ b/src/SharpClient.Core/Connection/TelnetConnection.cs
@@ -1,5 +1,7 @@
+using System.Net.Security;
 using System.Net.Sockets;
 using System.Text;
+using SharpClient.Core.Rendering;
 using TelnetNegotiationCore.Builders;
 using TelnetNegotiationCore.Interpreters;
 using TelnetNegotiationCore.Models;
@@ -13,6 +15,8 @@ public sealed class TelnetConnection : ITelnetConnection
     private readonly ReconnectOptions _reconnect;
 
     private TcpClient? _client;
+    // The client's stream, or the SslStream over it on a TLS world. Disposed with the client.
+    private Stream? _stream;
     private TelnetInterpreter? _interpreter;
     private Task? _readTask;
     private Task? _monitorTask;
@@ -34,6 +38,8 @@ public sealed class TelnetConnection : ITelnetConnection
     // long-running (e.g. in-car) connection, without meaningful battery cost.
     private static readonly TimeSpan HeartbeatInterval = TimeSpan.FromSeconds(45);
 
+    private static readonly TimeSpan TlsHandshakeTimeout = TimeSpan.FromSeconds(20);
+
     // TNC names nobody unless told to: without this, TTYPE answers UNKNOWN and NEW-ENVIRON sends no
     // CLIENT_NAME. MTTS claims what AnsiParser renders: 16, 256 and 24-bit colour over UTF-8.
     private static ClientIdentity Identity { get; } = new("SharpClient")
@@ -57,6 +63,12 @@ public TelnetConnection(ITelnetInterpreterFactory factory, ReconnectOptions? rec
 
     public ConnectionState State { get; private set; } = ConnectionState.Disconnected;
 
+    /// <inheritdoc />
+    public bool UseTls { get; set; }
+
+    /// <inheritdoc />
+    public bool AllowInvalidCertificate { get; set; }
+
     /// <summary>
     /// Telnet CHARSET (RFC 2066) preference order offered during negotiation, most
     /// preferred first: UTF-8, then Latin-1 (ISO-8859-1), then US-ASCII. The negotiated
@@ -82,8 +94,7 @@ public async Task ConnectAsync(string host, int port, CancellationToken cancella
         }
         catch
         {
-            _client?.Dispose();
-            _client = null;
+            ReleaseTransport();
             _interpreter = null;
             SetState(ConnectionState.Error);
             throw;
@@ -173,8 +184,7 @@ public async Task DisconnectAsync()
             _interpreter = null;
         }
 
-        _client?.Dispose();
-        _client = null;
+        ReleaseTransport();
 
         if (_readTask is not null)
         {
@@ -301,15 +311,59 @@ private async Task EstablishConnectionAsync(string host, int port, CancellationT
         // TCP would otherwise retransmit for ~15 min before failing, so the client sits "connected"
         // with no responses. This makes that surface in ~20s instead.
         TrySetTcpUserTimeout(client.Client);
-        await client.ConnectAsync(host, port, cancellationToken);
+        Stream? stream = null;
+        try
+        {
+            await client.ConnectAsync(host, port, cancellationToken);
+            stream = client.GetStream();
+            if (UseTls)
+            {
+                var ssl = new SslStream(stream, leaveInnerStreamOpen: false, ValidateCertificate);
+                stream = ssl;
+
+                // A peer that accepts the TCP connection but never answers the ClientHello (a plain
+                // telnet port, say) would otherwise hold the connect, or a reconnect attempt, forever.
+                using var handshake = CancellationTokenSource.CreateLinkedTokenSource(cancellationToken);
+                handshake.CancelAfter(TlsHandshakeTimeout);
+                await ssl.AuthenticateAsClientAsync(
+                    new SslClientAuthenticationOptions { TargetHost = host }, handshake.Token);
+            }
+
+            await StartInterpreterAsync(client, stream, host, port, cancellationToken);
+        }
+        catch
+        {
+            if (stream is not null)
+            {
+                await stream.DisposeAsync();
+            }
+
+            client.Dispose();
+            throw;
+        }
+    }
+
+    // Closes the TLS session (when there is one) and the socket under it.
+    private void ReleaseTransport()
+    {
+        _stream?.Dispose();
+        _stream = null;
+        _client?.Dispose();
+        _client = null;
+    }
 
+    private async Task StartInterpreterAsync(TcpClient client, Stream stream, string host, int port, CancellationToken cancellationToken)
+    {
         // The protocols AddDefaultMUDProtocols registers (NAWS, GMCP, MSDP, MSSP, TTYPE, CHARSET, EOR,
         // SGA, MXP), spelled out so NAWS can be WindowSizeProtocol: the helper always adds the base
-        // NAWSProtocol, and a second plugin for the same option is rejected. Plus Pueblo.
+        // NAWSProtocol, and a second plugin for the same option is rejected. Plus Pueblo, MCCP and
+        // NEW-ENVIRON.
         // Kept as locals because the server's banner (and so the Pueblo hello) can arrive before
         // BuildAndStartAsync returns and _interpreter is set.
         var mxp = new MXPProtocol();
-        mxp.OnMXPEnabled(OnMxpEnabledAsync);
+        mxp.OnMXPEnabled(OnMxpEnabledAsync)
+            .OnMxpSupportRequested(asked => OnMxpSupportRequestedAsync(mxp, asked))
+            .OnMxpVersionRequested(() => OnMxpVersionRequestedAsync(mxp));
         var pueblo = new PuebloProtocol();
         pueblo.OnPuebloOffered(() => OnPuebloOfferedAsync(pueblo, mxp)).OnPuebloEnabled(OnPuebloEnabledAsync);
 
@@ -326,9 +380,14 @@ private async Task EstablishConnectionAsync(string host, int port, CancellationT
             .AddPlugin<SuppressGoAheadProtocol>()
             .AddPlugin(mxp)
             .AddPlugin(pueblo)
-            .BuildAndStartAsync(client, cancellationToken);
+            // Both only answer the server: MCCP2 starts on the server's WILL, NEW-ENVIRON on its DO,
+            // and NEW-ENVIRON sends only what WithClientIdentity says (CLIENT_NAME, TERMINAL_TYPE, MTTS).
+            .AddPlugin<MCCPProtocol>().OnCompressionEnabled(OnCompressionAsync)
+            .AddPlugin<NewEnvironProtocol>()
+            .BuildAndStartAsync(stream, cancellationToken);
 
         _client = client;
+        _stream = stream;
         _interpreter = interpreter;
         _readTask = readTask;
         _host = host;
@@ -373,8 +432,7 @@ private async Task ReconnectLoopAsync(CancellationToken token)
 
             // Tear down the dead client before the next attempt; keep the existing
             // state (Reconnecting) so we don't flicker through Disconnected.
-            _client?.Dispose();
-            _client = null;
+            ReleaseTransport();
             _interpreter = null;
 
             try
@@ -445,6 +503,44 @@ private static async ValueTask OnPuebloOfferedAsync(PuebloProtocol pueblo, MXPPr
         }
     }
 
+    private bool ValidateCertificate(
+        object sender,
+        System.Security.Cryptography.X509Certificates.X509Certificate? certificate,
+        System.Security.Cryptography.X509Certificates.X509Chain? chain,
+        SslPolicyErrors errors) =>
+        errors == SslPolicyErrors.None || AllowInvalidCertificate;
+
+    private static async ValueTask OnMxpSupportRequestedAsync(MXPProtocol mxp, IReadOnlyList<string> asked)
+    {
+        var (supported, unsupported) = MxpTags.Answer(asked);
+        try
+        {
+            await mxp.SendSupportsAsync(supported, unsupported);
+        }
+        catch (Exception ex) when (ex is IOException or InvalidOperationException or ObjectDisposedException)
+        {
+            // The connection went away mid-answer.
+        }
+    }
+
+    private static async ValueTask OnMxpVersionRequestedAsync(MXPProtocol mxp)
+    {
+        try
+        {
+            await mxp.SendVersionAsync(new MxpVersion(MxpTags.MxpRevision, null, Identity.Name, null, null));
+        }
+        catch (Exception ex) when (ex is IOException or InvalidOperationException or ObjectDisposedException)
+        {
+            // The connection went away mid-answer.
+        }
+    }
+
+    private ValueTask OnCompressionAsync(int version, bool enabled)
+    {
+        NegotiationReceived?.Invoke(new NegotiationEvent($"MCCP{version}", enabled ? "compressing" : "stopped"));
+        return ValueTask.CompletedTask;
+    }
+
     private ValueTask OnPuebloEnabledAsync(PuebloClient client)
     {
         PuebloEnabled?.Invoke();
diff --git a/src/SharpClient.Core/Domain/World.cs b/src/SharpClient.Core/Domain/World.cs
index 4678a46..7444174 100644
--- a/src/SharpClient.Core/Domain/World.cs
+++ b/src/SharpClient.Core/Domain/World.cs
@@ -6,6 +6,12 @@ public sealed class World
     public string Name { get; set; } = string.Empty;
     public string Host { get; set; } = string.Empty;
     public int Port { get; set; }
+
+    /// <summary>Connect over TLS.</summary>
+    public bool UseTls { get; set; }
+
+    /// <summary>With <see cref="UseTls"/>, accept a self-signed or otherwise invalid certificate.</summary>
+    public bool AllowInvalidCertificate { get; set; }
     public List<Character> Characters { get; set; } = [];
     public List<TriggerRule> Triggers { get; set; } = [];   // world-scope
     public List<AliasRule> Aliases { get; set; } = [];      // world-scope
diff --git a/src/SharpClient.Core/Presentation/SettingsViewModel.cs b/src/SharpClient.Core/Presentation/SettingsViewModel.cs
index 1d0c4d7..e994c88 100644
--- a/src/SharpClient.Core/Presentation/SettingsViewModel.cs
+++ b/src/SharpClient.Core/Presentation/SettingsViewModel.cs
@@ -48,6 +48,7 @@ public sealed class SettingsViewModel
     private string _accent;
     private bool   _glow;
     private bool   _scanlines;
+    private bool   _showImages;
 
     public event Action? Changed;
 
@@ -60,6 +61,7 @@ public SettingsViewModel(IPreferences prefs)
         _accent      = prefs.GetString("Accent",      "#9b7ed4");
         _glow        = prefs.GetBool  ("Glow",        true);
         _scanlines   = prefs.GetBool  ("Scanlines",   true);
+        _showImages  = prefs.GetBool  ("ShowImages",  true);
 
         // Clamp unknown accent to default so --acc2/soft/line don't desync.
         if (!s_accentMeta.ContainsKey(_accent))
@@ -105,6 +107,16 @@ public bool Scanlines
         set { _scanlines = value; _prefs.SetBool("Scanlines", value); Changed?.Invoke(); }
     }
 
+    /// <summary>
+    /// Load MXP/Pueblo inline images. Loading one tells the image host this device's address, so it
+    /// can be turned off; the image's name is shown in its place.
+    /// </summary>
+    public bool ShowImages
+    {
+        get => _showImages;
+        set { _showImages = value; _prefs.SetBool("ShowImages", value); Changed?.Invoke(); }
+    }
+
     public string FontFamily =>
         s_fontFamilies.TryGetValue(_outputFont, out var f) ? f
             : "'JetBrains Mono',ui-monospace,monospace";
diff --git a/src/SharpClient.Core/Presentation/WorldManagerViewModel.cs b/src/SharpClient.Core/Presentation/WorldManagerViewModel.cs
index aca7f15..fa890cd 100644
--- a/src/SharpClient.Core/Presentation/WorldManagerViewModel.cs
+++ b/src/SharpClient.Core/Presentation/WorldManagerViewModel.cs
@@ -44,9 +44,25 @@ public async Task LoadAsync(CancellationToken cancellationToken = default)
         RaiseChanged();
     }
 
-    public async Task AddWorldAsync(string name, string host, int port, CancellationToken cancellationToken = default)
+    public Task AddWorldAsync(string name, string host, int port, CancellationToken cancellationToken = default) =>
+        AddWorldAsync(name, host, port, useTls: false, allowInvalidCertificate: false, cancellationToken);
+
+    public async Task AddWorldAsync(
+        string name,
+        string host,
+        int port,
+        bool useTls,
+        bool allowInvalidCertificate,
+        CancellationToken cancellationToken = default)
     {
-        var world = new World { Name = name, Host = host, Port = port };
+        var world = new World
+        {
+            Name = name,
+            Host = host,
+            Port = port,
+            UseTls = useTls,
+            AllowInvalidCertificate = allowInvalidCertificate,
+        };
         await _store.AddWorldAsync(world, cancellationToken);
         await LoadAsync(cancellationToken);
     }
diff --git a/src/SharpClient.Core/Rendering/MxpTags.cs b/src/SharpClient.Core/Rendering/MxpTags.cs
new file mode 100644
index 0000000..305cb6e
--- /dev/null
+++ b/src/SharpClient.Core/Rendering/MxpTags.cs
@@ -0,0 +1,80 @@
+namespace SharpClient.Core.Rendering;
+
+/// <summary>
+/// What SharpClient's MXP rendering (<see cref="AnsiParser"/>) acts on, for answering a server's
+/// <c>&lt;SUPPORT&gt;</c>. A tag or attribute is listed only when the parser does something with it:
+/// claiming more makes a server send markup that is then shown stripped.
+/// </summary>
+public static class MxpTags
+{
+    /// <summary>The MXP revision answered to <c>&lt;VERSION&gt;</c>.</summary>
+    public const string MxpRevision = "1.0";
+
+    // Each rendered tag with the attributes the parser reads from it.
+    private static readonly (string Tag, string[] Attributes)[] s_rendered =
+    [
+        ("send", ["href", "hint"]),
+        ("image", ["fname", "url", "t"]),
+    ];
+
+    public static IReadOnlyList<string> Supported { get; } = [.. s_rendered.Select(r => r.Tag)];
+
+    private static readonly Dictionary<string, string[]> s_attributes =
+        s_rendered.ToDictionary(r => r.Tag, r => r.Attributes, StringComparer.OrdinalIgnoreCase);
+
+    /// <summary>
+    /// The answer to a <c>&lt;SUPPORT&gt;</c> naming <paramref name="asked"/>: every supported tag when
+    /// it named nothing, otherwise each entry as supported or not. <c>tag.attr</c> is supported when the
+    /// parser reads that attribute; <c>tag.*</c> expands to each attribute of a supported tag, as the
+    /// specification asks, and is <c>-tag.*</c> for a tag this client does not render.
+    /// </summary>
+    public static (IReadOnlyList<string> Supported, IReadOnlyList<string> Unsupported) Answer(IReadOnlyList<string> asked)
+    {
+        if (asked.Count == 0)
+        {
+            return (Supported, []);
+        }
+
+        var supported = new List<string>();
+        var unsupported = new List<string>();
+        foreach (var entry in asked)
+        {
+            var name = entry.Trim('"', '\'');
+            if (name.Length == 0)
+            {
+                continue;
+            }
+
+            var dot = name.IndexOf('.', StringComparison.Ordinal);
+            if (dot < 0)
+            {
+                (IsSupported(name) ? supported : unsupported).Add(name);
+                continue;
+            }
+
+            var tag = name[..dot];
+            var attribute = name[(dot + 1)..];
+            var tagSupported = s_attributes.TryGetValue(tag, out var known);
+            var attributes = known ?? Array.Empty<string>();
+            if (attribute == "*")
+            {
+                if (tagSupported)
+                {
+                    supported.AddRange(attributes.Select(a => $"{tag}.{a}"));
+                }
+                else
+                {
+                    unsupported.Add(name);
+                }
+            }
+            else
+            {
+                (attributes.Contains(attribute, StringComparer.OrdinalIgnoreCase) ? supported : unsupported).Add(name);
+            }
+        }
+
+        return (supported, unsupported);
+    }
+
+    private static bool IsSupported(string tag) => s_attributes.ContainsKey(tag);
+}
diff --git a/src/SharpClient.Core/Sessions/TelnetSessionLauncher.cs b/src/SharpClient.Core/Sessions/TelnetSessionLauncher.cs
index cb4e9ca..303477b 100644
--- a/src/SharpClient.Core/Sessions/TelnetSessionLauncher.cs
+++ b/src/SharpClient.Core/Sessions/TelnetSessionLauncher.cs
@@ -46,6 +46,8 @@ public async Task<ISession> LaunchAsync(
         CancellationToken cancellationToken = default)
     {
         var connection = _connFactory.CreateConnection();
+        connection.UseTls = world.UseTls;
+        connection.AllowInvalidCertificate = world.UseTls && world.AllowInvalidCertificate;
 
         var aliasRules = MergeAliases(world.Aliases, character.Aliases);
         var triggerRules = MergeTriggers(world.Triggers, character.Triggers);
diff --git a/src/SharpClient.Data/WorldStore.cs b/src/SharpClient.Data/WorldStore.cs
index 8697dc3..4a5a24d 100644
--- a/src/SharpClient.Data/WorldStore.cs
+++ b/src/SharpClient.Data/WorldStore.cs
@@ -105,6 +105,75 @@ private async Task EnsureSchemaAsync(CancellationToken cancellationToken)
     {
         if (_schemaEnsured) return;
         await _db.Database.EnsureCreatedAsync(cancellationToken);
+        await AddMissingColumnsAsync(cancellationToken);
         _schemaEnsured = true;
     }
+
+    // The schema comes from EnsureCreated, which does nothing to a database that already exists, so a
+    // column added to the model after a user's database was created has to be added here. Each entry
+    // is NOT NULL with a default, so existing rows read as they did before the column existed.
+    private static readonly (string Table, string Column, string Definition)[] s_addedColumns =
+    [
+        ("Worlds", nameof(World.UseTls), "INTEGER NOT NULL DEFAULT 0"),
+        ("Worlds", nameof(World.AllowInvalidCertificate), "INTEGER NOT NULL DEFAULT 0"),
+    ];
+
+    private async Task AddMissingColumnsAsync(CancellationToken cancellationToken)
+    {
+        var connection = _db.Database.GetDbConnection();
+        var opened = connection.State != System.Data.ConnectionState.Open;
+        if (opened)
+        {
+            await connection.OpenAsync(cancellationToken);
+        }
+
+        try
+        {
+            foreach (var group in s_addedColumns.GroupBy(c => c.Table))
+            {
+                var existing = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
+                await using (var query = connection.CreateCommand())
+                {
+                    // Table names are the constants above, never input.
+#pragma warning disable CA2100
+                    query.CommandText = $"PRAGMA table_info(\"{group.Key}\")";
+#pragma warning restore CA2100
+                    await using var reader = await query.ExecuteReaderAsync(cancellationToken);
+                    while (await reader.ReadAsync(cancellationToken))
+                    {
+                        existing.Add(reader.GetString(1));
+                    }
+                }
+
+                foreach (var (table, column, definition) in group)
+                {
+                    if (existing.Contains(column))
+                    {
+                        continue;
+                    }
+
+                    await using var alter = connection.CreateCommand();
+#pragma warning disable CA2100
+                    alter.CommandText = $"ALTER TABLE \"{table}\" ADD COLUMN \"{column}\" {definition}";
+#pragma warning restore CA2100
+                    try
+                    {
+                        await alter.ExecuteNonQueryAsync(cancellationToken);
+                    }
+                    catch (System.Data.Common.DbException ex)
+                        when (ex.Message.Contains("duplicate column name", StringComparison.OrdinalIgnoreCase))
+                    {
+                        // Another store on the same database added it between the check and here.
+                    }
+                }
+            }
+        }
+        finally
+        {
+            if (opened)
+            {
+                await connection.CloseAsync();
+            }
+        }
+    }
 }
diff --git a/src/SharpClient.UI/Components/OutputView.razor b/src/SharpClient.UI/Components/OutputView.razor
index 90390be..fc8ecac 100644
--- a/src/SharpClient.UI/Components/OutputView.razor
+++ b/src/SharpClient.UI/Components/OutputView.razor
@@ -7,7 +7,7 @@
         <div class="sc-line">
             @foreach (var segment in line.Segments)
             {
-                @if (segment.ImageUrl is not null)
+                @if (segment.ImageUrl is not null && ShowImages)
                 {
                     @* no-referrer: the image host learns nothing about where it was shown. *@
                     @if (segment.Command is not null && OnSendCommand is not null)
@@ -43,4 +43,8 @@
     /// <summary>Invoked when a clickable MXP/Pueblo command-link is clicked.</summary>
     [Parameter]
     public Func<string, Task>? OnSendCommand { get; set; }
+
+    /// <summary>When false, an image segment renders as its text (its name or alt text) instead.</summary>
+    [Parameter]
+    public bool ShowImages { get; set; } = true;
 }
diff --git a/src/SharpClient.UI/Components/SessionScreen.razor b/src/SharpClient.UI/Components/SessionScreen.razor
index 9d76fe8..12882dd 100644
--- a/src/SharpClient.UI/Components/SessionScreen.razor
+++ b/src/SharpClient.UI/Components/SessionScreen.razor
@@ -60,7 +60,7 @@
         }
         else
         {
-            <OutputView Lines="Vm.Active.Scrollback" OnSendCommand="cmd => Vm.Active!.SendAsync(cmd)" />
+            <OutputView Lines="Vm.Active.Scrollback" OnSendCommand="cmd => Vm.Active!.SendAsync(cmd)" ShowImages="Settings.ShowImages" />
         }
     </div>
     @if (_showProtocol && ProtocolVm is not null)
diff --git a/src/SharpClient.UI/Components/SettingsView.razor b/src/SharpClient.UI/Components/SettingsView.razor
index 99e2c02..b8b58ff 100644
--- a/src/SharpClient.UI/Components/SettingsView.razor
+++ b/src/SharpClient.UI/Components/SettingsView.razor
@@ -87,6 +87,16 @@
         </div>
     </div>
 
+    <div class="sc-settings-section">
+        <div class="sc-settings-section-header">Content</div>
+        <label class="sc-setting">
+            <span class="sc-setting-label">Show images from worlds</span>
+            <input type="checkbox" class="sc-toggle sc-show-images"
+                   checked="@Vm.ShowImages"
+                   @onchange="e => Vm.ShowImages = (bool)e.Value!" />
+        </label>
+    </div>
+
     @if (LogReader.IsAvailable || LogExporter.IsAvailable)
     {
         <div class="sc-settings-section">
diff --git a/src/SharpClient.UI/Components/WorldEditor.razor b/src/SharpClient.UI/Components/WorldEditor.razor
index e843aed..5338f8d 100644
--- a/src/SharpClient.UI/Components/WorldEditor.razor
+++ b/src/SharpClient.UI/Components/WorldEditor.razor
@@ -23,6 +23,17 @@
             <span class="sc-field-label">port</span>
             <input class="sc-field-input" type="number" @bind="_port" @bind:event="oninput" placeholder="23" />
         </label>
+        <label class="sc-setting">
+            <span class="sc-setting-label">Use TLS</span>
+            <input type="checkbox" class="sc-toggle sc-world-tls" @bind="_useTls" />
+        </label>
+        @if (_useTls)
+        {
+            <label class="sc-setting">
+                <span class="sc-setting-label">Skip certificate checks (self-signed, expired or wrong host)</span>
+                <input type="checkbox" class="sc-toggle sc-world-invalid-cert" @bind="_allowInvalidCertificate" />
+            </label>
+        }
 
         <button type="button" class="sc-modal-submit" disabled="@(!CanSubmit)" @onclick="SubmitAsync">
             @(_isEdit ? "Save world" : "Add world")
@@ -39,6 +50,8 @@
     private string _name = string.Empty;
     private string _host = string.Empty;
     private int _port = 23;
+    private bool _useTls;
+    private bool _allowInvalidCertificate;
 
     private bool CanSubmit => !string.IsNullOrWhiteSpace(_name) && !string.IsNullOrWhiteSpace(_host);
 
@@ -50,6 +63,8 @@
             _name = World.Name;
             _host = World.Host;
             _port = World.Port;
+            _useTls = World.UseTls;
+            _allowInvalidCertificate = World.AllowInvalidCertificate;
         }
     }
 
@@ -62,13 +77,15 @@
 
         if (World is null)
         {
-            await Vm.AddWorldAsync(_name.Trim(), _host.Trim(), _port);
+            await Vm.AddWorldAsync(_name.Trim(), _host.Trim(), _port, _useTls, _useTls && _allowInvalidCertificate);
         }
         else
         {
             World.Name = _name.Trim();
             World.Host = _host.Trim();
             World.Port = _port;
+            World.UseTls = _useTls;
+            World.AllowInvalidCertificate = _useTls && _allowInvalidCertificate;
             await Vm.UpdateWorldAsync(World);
         }
 
diff --git a/tests/SharpClient.Data.Tests/WorldStoreTests.cs b/tests/SharpClient.Data.Tests/WorldStoreTests.cs
index b1ef00f..7979764 100644
--- a/tests/SharpClient.Data.Tests/WorldStoreTests.cs
+++ b/tests/SharpClient.Data.Tests/WorldStoreTests.cs
@@ -64,6 +64,45 @@ public async Task AddWorldThenGetWorldsReturnsFullyPopulatedGraph()
         await Assert.That(charB.Aliases).Count().IsEqualTo(0);
     }
 
+    [Test]
+    public async Task TlsFlagsRoundTrip()
+    {
+        await using var db = new AppDbContext(_storage);
+        var store = new WorldStore(db);
+        await store.AddWorldAsync(new World { Name = "W", Host = "h", Port = 1, UseTls = true, AllowInvalidCertificate = true });
+
+        var loaded = (await store.GetWorldsAsync())[0];
+        await Assert.That(loaded.UseTls).IsTrue();
+        await Assert.That(loaded.AllowInvalidCertificate).IsTrue();
+    }
+
+    [Test]
+    public async Task DatabaseFromBeforeTlsColumnsIsUpgraded()
+    {
+        var id = Guid.NewGuid();
+        await using (var old = new AppDbContext(_storage))
+        {
+            await old.Database.EnsureCreatedAsync();
+            await old.Database.ExecuteSqlRawAsync("ALTER TABLE \"Worlds\" DROP COLUMN \"UseTls\"");
+            await old.Database.ExecuteSqlRawAsync("ALTER TABLE \"Worlds\" DROP COLUMN \"AllowInvalidCertificate\"");
+            await old.Database.ExecuteSqlRawAsync(
+                "INSERT INTO \"Worlds\" (\"Id\", \"Name\", \"Host\", \"Port\") VALUES ({0}, 'Old', 'old.example', 4201)", id.ToString().ToUpperInvariant());
+        }
+
+        await using var db = new AppDbContext(_storage);
+        var store = new WorldStore(db);
+        var worlds = await store.GetWorldsAsync();
+
+        await Assert.That(worlds).Count().IsEqualTo(1);
+        await Assert.That(worlds[0].Name).IsEqualTo("Old");
+        await Assert.That(worlds[0].UseTls).IsFalse();
+
+        var updated = worlds[0];
+        updated.UseTls = true;
+        await store.UpdateWorldAsync(updated);
+        await Assert.That((await store.GetWorldsAsync())[0].UseTls).IsTrue();
+    }
+
     [Test]
     public async Task AddWorldRoundTripsTriggerRuleFields()
     {
diff --git a/tests/SharpClient.Tests/Connection/ProtocolAnswerTests.cs b/tests/SharpClient.Tests/Connection/ProtocolAnswerTests.cs
new file mode 100644
index 0000000..b534b40
--- /dev/null
+++ b/tests/SharpClient.Tests/Connection/ProtocolAnswerTests.cs
@@ -0,0 +1,204 @@
+using System.IO.Compression;
+using System.Text;
+using Microsoft.Extensions.DependencyInjection;
+using SharpClient.Core.Connection;
+using TelnetNegotiationCore.Builders;
+
+namespace SharpClient.Tests.Connection;
+
+/// <summary>
+/// Wire-level checks for the options SharpClient answers but never starts: MCCP2, NEW-ENVIRON (MNES)
+/// and MXP's SUPPORT/VERSION queries.
+/// </summary>
+public sealed class ProtocolAnswerTests
+{
+    private const byte Iac = 255;
+    private const byte Will = 251;
+    private const byte Do = 253;
+    private const byte Sb = 250;
+    private const byte Se = 240;
+    private const byte Compress2 = 86;
+    private const byte NewEnviron = 39;
+    private const byte Mxp = 91;
+
+    private ServiceProvider? _serviceProvider;
+
+    private ITelnetInterpreterFactory CreateFactory()
+    {
+        var services = new ServiceCollection();
+        services.AddLogging();
+        services.AddTelnetClient();
+        _serviceProvider = services.BuildServiceProvider();
+        return _serviceProvider.GetRequiredService<ITelnetInterpreterFactory>();
+    }
+
+    [After(Test)]
+    public async Task TearDown()
+    {
+        if (_serviceProvider is not null)
+        {
+            await _serviceProvider.DisposeAsync();
+            _serviceProvider = null;
+        }
+    }
+
+    [Test]
+    public async Task ConnectingSendsNoOptionRequest()
+    {
+        await using var server = new LoopbackServer();
+        await using var connection = new TelnetConnection(CreateFactory());
+
+        var accept = server.AcceptAsync();
+        await connection.ConnectAsync("127.0.0.1", server.Port);
+        await accept;
+
+        // A DO the server never offered sits in a non-telnet server's line buffer and gets glued to
+        // the auto-login (the failure SharpMUTerm hit). Only WILLs for our own options may go out.
+        var sent = await WireHelpers.DrainAsync(server, TimeSpan.FromMilliseconds(400));
+        for (var i = 0; i + 1 < sent.Length; i++)
+        {
+            if (sent[i] == Iac)
+            {
+                await Assert.That(sent[i + 1]).IsNotEqualTo(Do);
+            }
+        }
+    }
+
+    [Test]
+    public async Task Mccp2CompressedOutputIsDecompressed()
+    {
+        await using var server = new LoopbackServer();
+        await using var connection = new TelnetConnection(CreateFactory());
+        var received = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        connection.LineReceived += line => received.TrySetResult(line);
+
+        var accept = server.AcceptAsync();
+        await connection.ConnectAsync("127.0.0.1", server.Port);
+        await accept;
+
+        await server.SendBytesAsync([Iac, Will, Compress2]);
+        var reply = await WireHelpers.ReadUntilAsync(server, [Iac, Do, Compress2], TimeSpan.FromSeconds(3));
+        await Assert.That(WireHelpers.IndexOf(reply, [Iac, Do, Compress2])).IsGreaterThanOrEqualTo(0);
+
+        using var compressed = new MemoryStream();
+        await using (var zlib = new ZLibStream(compressed, CompressionLevel.Optimal, leaveOpen: true))
+        {
+            await zlib.WriteAsync(Encoding.ASCII.GetBytes("compressed hello\r\n"));
+            await zlib.FlushAsync();
+        }
+
+        await server.SendBytesAsync([Iac, Sb, Compress2, Iac, Se, .. compressed.ToArray()]);
+
+        var line = await received.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        await Assert.That(line).IsEqualTo("compressed hello");
+    }
+
+    [Test]
+    public async Task NewEnvironAnswersWithClientName()
+    {
+        await using var server = new LoopbackServer();
+        await using var connection = new TelnetConnection(CreateFactory());
+
+        var accept = server.AcceptAsync();
+        await connection.ConnectAsync("127.0.0.1", server.Port);
+        await accept;
+
+        await server.SendBytesAsync([Iac, Do, NewEnviron]);
+        await WireHelpers.ReadUntilAsync(server, [Iac, Will, NewEnviron], TimeSpan.FromSeconds(3));
+        await server.SendBytesAsync([Iac, Sb, NewEnviron, 1, Iac, Se]); // SEND, everything
+
+        var reply = await WireHelpers.ReadUntilAsync(server, [Iac, Sb, NewEnviron, 0], TimeSpan.FromSeconds(3), requireEnd: true);
+        var start = WireHelpers.IndexOf(reply, [Iac, Sb, NewEnviron, 0]);
+        await Assert.That(start).IsGreaterThanOrEqualTo(0);
+
+        var text = Encoding.ASCII.GetString(reply, start, reply.Length - start);
+        await Assert.That(text).Contains("CLIENT_NAME\u0001SharpClient");
+        await Assert.That(text).Contains("TERMINAL_TYPE\u0001XTERM");
+    }
+
+    [Test]
+    public async Task MxpSupportAndVersionAreAnswered()
+    {
+        await using var server = new LoopbackServer();
+        await using var connection = new TelnetConnection(CreateFactory());
+
+        var accept = server.AcceptAsync();
+        await connection.ConnectAsync("127.0.0.1", server.Port);
+        await accept;
+
+        await server.SendBytesAsync([Iac, Will, Mxp]);
+        await WireHelpers.ReadUntilAsync(server, [Iac, Do, Mxp], TimeSpan.FromSeconds(3));
+        await server.SendBytesAsync([Iac, Sb, Mxp, Iac, Se]);
+        await server.SendBytesAsync(Encoding.ASCII.GetBytes("\e[1z<SUPPORT>\r\n"));
+
+        var supports = Encoding.ASCII.GetString(
+            await WireHelpers.ReadUntilAsync(server, Encoding.ASCII.GetBytes("+image"), TimeSpan.FromSeconds(3)));
+        await Assert.That(supports).Contains("<SUPPORTS");
+        await Assert.That(supports).Contains("+send");
+        await Assert.That(supports).Contains("+image");
+
+        await server.SendBytesAsync(Encoding.ASCII.GetBytes("\e[1z<VERSION>\r\n"));
+        var version = Encoding.ASCII.GetString(
+            await WireHelpers.ReadUntilAsync(server, Encoding.ASCII.GetBytes("CLIENT=SharpClient>"), TimeSpan.FromSeconds(3)));
+        await Assert.That(version).Contains("<VERSION MXP=1.0 CLIENT=SharpClient>");
+    }
+}
+
+/// <summary>Byte helpers shared by the loopback wire tests.</summary>
+internal static class WireHelpers
+{
+    private const byte Iac = 255;
+    private const byte Se = 240;
+
+    public static async Task<byte[]> ReadUntilAsync(
+        LoopbackServer server, byte[] marker, TimeSpan timeout, bool requireEnd = false)
+    {
+        var buffer = new List<byte>();
+        var deadline = DateTime.UtcNow + timeout;
+        while (DateTime.UtcNow < deadline)
+        {
+            var at = IndexOf([.. buffer], marker);
+            if (at >= 0 && (!requireEnd || IndexOf([.. buffer.Skip(at + marker.Length)], [Iac, Se]) >= 0))
+            {
+                return [.. buffer];
+            }
+
+            try
+            {
+                buffer.AddRange(await server.ReadAvailableBytesAsync(TimeSpan.FromMilliseconds(200)));
+            }
+            catch (OperationCanceledException) { }
+        }
+
+        return [.. buffer];
+    }
+
+    public static async Task<byte[]> DrainAsync(LoopbackServer server, TimeSpan window)
+    {
+        var buffer = new List<byte>();
+        var deadline = DateTime.UtcNow + window;
+        while (DateTime.UtcNow < deadline)
+        {
+            try
+            {
+                buffer.AddRange(await server.ReadAvailableBytesAsync(TimeSpan.FromMilliseconds(100)));
+            }
+            catch (OperationCanceledException) { }
+        }
+
+        return [.. buffer];
+    }
+
+    public static int IndexOf(byte[] haystack, byte[] needle)
+    {
+        for (var i = 0; i + needle.Length <= haystack.Length; i++)
+        {
+            if (haystack.AsSpan(i, needle.Length).SequenceEqual(needle))
+            {
+                return i;
+            }
+        }
+
+        return -1;
+    }
+}
diff --git a/tests/SharpClient.Tests/Connection/TlsConnectionTests.cs b/tests/SharpClient.Tests/Connection/TlsConnectionTests.cs
new file mode 100644
index 0000000..053a503
--- /dev/null
+++ b/tests/SharpClient.Tests/Connection/TlsConnectionTests.cs
@@ -0,0 +1,117 @@
+using System.Net;
+using System.Net.Security;
+using System.Net.Sockets;
+using System.Security.Authentication;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using System.Text;
+using Microsoft.Extensions.DependencyInjection;
+using SharpClient.Core.Connection;
+using TelnetNegotiationCore.Builders;
+
+namespace SharpClient.Tests.Connection;
+
+/// <summary>TLS worlds against a loopback server holding a self-signed certificate.</summary>
+public sealed class TlsConnectionTests
+{
+    private ServiceProvider? _serviceProvider;
+
+    private ITelnetInterpreterFactory CreateFactory()
+    {
+        var services = new ServiceCollection();
+        services.AddLogging();
+        services.AddTelnetClient();
+        _serviceProvider = services.BuildServiceProvider();
+        return _serviceProvider.GetRequiredService<ITelnetInterpreterFactory>();
+    }
+
+    [After(Test)]
+    public async Task TearDown()
+    {
+        if (_serviceProvider is not null)
+        {
+            await _serviceProvider.DisposeAsync();
+            _serviceProvider = null;
+        }
+    }
+
+    [Test]
+    public async Task SelfSignedCertificateIsAcceptedWhenAllowed()
+    {
+        using var certificate = CreateSelfSigned();
+        using var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        await using var connection = new TelnetConnection(CreateFactory())
+        {
+            UseTls = true,
+            AllowInvalidCertificate = true,
+        };
+        var received = new TaskCompletionSource<string>(TaskCreationOptions.RunContinuationsAsynchronously);
+        connection.LineReceived += line => received.TrySetResult(line);
+
+        var server = ServeOneLineAsync(listener, certificate, "Hello over TLS");
+        await connection.ConnectAsync("127.0.0.1", ((IPEndPoint)listener.LocalEndpoint).Port);
+
+        var line = await received.Task.WaitAsync(TimeSpan.FromSeconds(5));
+        await Assert.That(line).IsEqualTo("Hello over TLS");
+        await Assert.That(connection.State).IsEqualTo(ConnectionState.Connected);
+        await connection.DisconnectAsync();
+        await server.WaitAsync(TimeSpan.FromSeconds(5));
+    }
+
+    [Test]
+    public async Task SelfSignedCertificateIsRejectedByDefault()
+    {
+        using var certificate = CreateSelfSigned();
+        using var listener = new TcpListener(IPAddress.Loopback, 0);
+        listener.Start();
+        await using var connection = new TelnetConnection(CreateFactory()) { UseTls = true };
+
+        var server = ServeOneLineAsync(listener, certificate, "unreachable");
+        await Assert.That(async () => await connection.ConnectAsync("127.0.0.1", ((IPEndPoint)listener.LocalEndpoint).Port))
+            .Throws<AuthenticationException>();
+        await Assert.That(connection.State).IsEqualTo(ConnectionState.Error);
+
+        // The server's handshake fails once the client gives up; that is the expected outcome here.
+        try
+        {
+            await server.WaitAsync(TimeSpan.FromSeconds(5));
+        }
+        catch (Exception ex) when (ex is AuthenticationException or IOException)
+        {
+        }
+    }
+
+    private static async Task ServeOneLineAsync(TcpListener listener, X509Certificate2 certificate, string line)
+    {
+        using var client = await listener.AcceptTcpClientAsync();
+        await using var ssl = new SslStream(client.GetStream(), leaveInnerStreamOpen: false);
+        await ssl.AuthenticateAsServerAsync(new SslServerAuthenticationOptions { ServerCertificate = certificate });
+        await ssl.WriteAsync(Encoding.ASCII.GetBytes(line + "\r\n"));
+        await ssl.FlushAsync();
+
+        // Hold the connection until the client closes it, so the line is not raced by EOF.
+        var buffer = new byte[256];
+        try
+        {
+            while (await ssl.ReadAsync(buffer) > 0)
+            {
+            }
+        }
+        catch (IOException)
+        {
+        }
+    }
+
+    private static X509Certificate2 CreateSelfSigned()
+    {
+        using var key = RSA.Create(2048);
+        var request = new CertificateRequest("CN=127.0.0.1", key, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
+        var san = new SubjectAlternativeNameBuilder();
+        san.AddIpAddress(IPAddress.Loopback);
+        request.CertificateExtensions.Add(san.Build());
+        using var created = request.CreateSelfSigned(DateTimeOffset.UtcNow.AddMinutes(-5), DateTimeOffset.UtcNow.AddDays(1));
+        // Round-trip through PKCS#12 so the private key is usable by SslStream on every platform.
+        return X509CertificateLoader.LoadPkcs12(created.Export(X509ContentType.Pfx), null);
+    }
+}
diff --git a/tests/SharpClient.Tests/Presentation/SettingsViewModelTests.cs b/tests/SharpClient.Tests/Presentation/SettingsViewModelTests.cs
index 3c5b004..2348d1d 100644
--- a/tests/SharpClient.Tests/Presentation/SettingsViewModelTests.cs
+++ b/tests/SharpClient.Tests/Presentation/SettingsViewModelTests.cs
@@ -198,4 +198,19 @@ public async Task UnknownAccentIsClampedToDefaultOnConstruction()
         // RootStyleVariables must not contain the unknown accent.
         await Assert.That(vm.RootStyleVariables).DoesNotContain("#badbad");
     }
+
+    [Test]
+    public async Task ShowImagesDefaultsOnAndPersists()
+    {
+        var (vm, prefs) = Build();
+        await Assert.That(vm.ShowImages).IsTrue();
+
+        var fired = 0;
+        vm.Changed += () => fired++;
+        vm.ShowImages = false;
+
+        await Assert.That(prefs.GetBool("ShowImages", true)).IsFalse();
+        await Assert.That(fired).IsEqualTo(1);
+        await Assert.That(new SettingsViewModel(prefs).ShowImages).IsFalse();
+    }
 }
diff --git a/tests/SharpClient.Tests/Rendering/MxpTagsTests.cs b/tests/SharpClient.Tests/Rendering/MxpTagsTests.cs
new file mode 100644
index 0000000..2f86f5b
--- /dev/null
+++ b/tests/SharpClient.Tests/Rendering/MxpTagsTests.cs
@@ -0,0 +1,46 @@
+using SharpClient.Core.Rendering;
+
+namespace SharpClient.Tests.Rendering;
+
+public sealed class MxpTagsTests
+{
+    [Test]
+    public async Task EmptyRequestListsEverySupportedTag()
+    {
+        var (supported, unsupported) = MxpTags.Answer([]);
+        await Assert.That(string.Join(",", supported)).IsEqualTo("send,image");
+        await Assert.That(unsupported).IsEmpty();
+    }
+
+    [Test]
+    public async Task TagsAreSortedIntoSupportedAndNot()
+    {
+        var (supported, unsupported) = MxpTags.Answer(["SEND", "frame", "image"]);
+        await Assert.That(string.Join(",", supported)).IsEqualTo("SEND,image");
+        await Assert.That(string.Join(",", unsupported)).IsEqualTo("frame");
+    }
+
+    [Test]
+    public async Task AttributesAreAnsweredPerAttribute()
+    {
+        var (supported, unsupported) = MxpTags.Answer(["send.href", "send.prompt", "image.url", "color.fore"]);
+        await Assert.That(string.Join(",", supported)).IsEqualTo("send.href,image.url");
+        await Assert.That(string.Join(",", unsupported)).IsEqualTo("send.prompt,color.fore");
+    }
+
+    [Test]
+    public async Task WildcardExpandsForSupportedTagOnly()
+    {
+        var (supported, unsupported) = MxpTags.Answer(["send.*", "frame.*"]);
+        await Assert.That(string.Join(",", supported)).IsEqualTo("send.href,send.hint");
+        await Assert.That(string.Join(",", unsupported)).IsEqualTo("frame.*");
+    }
+
+    [Test]
+    public async Task QuotedEntriesAreUnquoted()
+    {
+        var (supported, unsupported) = MxpTags.Answer(["\"send\"", "''"]);
+        await Assert.That(string.Join(",", supported)).IsEqualTo("send");
+        await Assert.That(unsupported).IsEmpty();
+    }
+}
diff --git a/tests/SharpClient.Tests/Sessions/FakeTelnetConnection.cs b/tests/SharpClient.Tests/Sessions/FakeTelnetConnection.cs
index 7f1b5d1..f882db8 100644
--- a/tests/SharpClient.Tests/Sessions/FakeTelnetConnection.cs
+++ b/tests/SharpClient.Tests/Sessions/FakeTelnetConnection.cs
@@ -12,6 +12,8 @@ public sealed class FakeTelnetConnection : ITelnetConnection
     public event Action? PuebloEnabled;
 
     public ConnectionState State { get; private set; } = ConnectionState.Disconnected;
+    public bool UseTls { get; set; }
+    public bool AllowInvalidCertificate { get; set; }
     public List<string> Sent { get; } = [];
     public List<(int Width, int Height)> NawsSent { get; } = [];
 
diff --git a/tests/SharpClient.UI.Tests/OutputViewLinkTests.cs b/tests/SharpClient.UI.Tests/OutputViewLinkTests.cs
index 22449aa..734e6ee 100644
--- a/tests/SharpClient.UI.Tests/OutputViewLinkTests.cs
+++ b/tests/SharpClient.UI.Tests/OutputViewLinkTests.cs
@@ -72,4 +72,18 @@ public async Task ImageInsideCommandLinkIsAClickableButton()
         cut.Find("button.sc-image-link").Click();
         await Assert.That(sent).IsEqualTo("look map");
     }
+
+    [Test]
+    public async Task ImagesOffRendersTheTextInstead()
+    {
+        using var ctx = new BunitContext();
+        var line = Line(new StyledSegment("a cat", TextStyle.Default) { ImageUrl = "https://h.example/cat.gif" });
+
+        var cut = ctx.Render<OutputView>(p => p
+            .Add(c => c.Lines, new[] { line })
+            .Add(c => c.ShowImages, false));
+
+        await Assert.That(cut.FindAll("img").Count).IsEqualTo(0);
+        await Assert.That(cut.Markup).Contains("a cat");
+    }
 }
diff --git a/tests/SharpClient.UI.Tests/WorldEditorTests.cs b/tests/SharpClient.UI.Tests/WorldEditorTests.cs
new file mode 100644
index 0000000..5b3b001
--- /dev/null
+++ b/tests/SharpClient.UI.Tests/WorldEditorTests.cs
@@ -0,0 +1,50 @@
+using Bunit;
+using SharpClient.Core.Presentation;
+using SharpClient.Core.Sessions;
+using SharpClient.UI.Components;
+
+namespace SharpClient.UI.Tests;
+
+public sealed class WorldEditorTests
+{
+    [Test]
+    public async Task SelfSignedOptionAppearsOnlyWithTlsAndIsSaved()
+    {
+        var store = new UiFakeWorldStore();
+        var vm = new WorldManagerViewModel(store, new UiFakeSecretStore(), new SessionManager(), new UiFakeSessionLauncher());
+        using var ctx = new BunitContext();
+        var cut = ctx.Render<WorldEditor>(p => p.Add(c => c.Vm, vm));
+
+        cut.Find("input.sc-field-input").Input("Secure");
+        cut.FindAll("input.sc-field-input")[1].Input("tls.example");
+        await Assert.That(cut.FindAll(".sc-world-invalid-cert").Count).IsEqualTo(0);
+
+        cut.Find(".sc-world-tls").Change(true);
+        cut.Find(".sc-world-invalid-cert").Change(true);
+        cut.Find(".sc-modal-submit").Click();
+
+        var saved = (await store.GetWorldsAsync()).Single();
+        await Assert.That(saved.UseTls).IsTrue();
+        await Assert.That(saved.AllowInvalidCertificate).IsTrue();
+    }
+
+    [Test]
+    public async Task TurningTlsOffDropsTheSelfSignedAllowance()
+    {
+        var store = new UiFakeWorldStore();
+        var vm = new WorldManagerViewModel(store, new UiFakeSecretStore(), new SessionManager(), new UiFakeSessionLauncher());
+        using var ctx = new BunitContext();
+        var cut = ctx.Render<WorldEditor>(p => p.Add(c => c.Vm, vm));
+
+        cut.Find("input.sc-field-input").Input("Plain");
+        cut.FindAll("input.sc-field-input")[1].Input("plain.example");
+        cut.Find(".sc-world-tls").Change(true);
+        cut.Find(".sc-world-invalid-cert").Change(true);
+        cut.Find(".sc-world-tls").Change(false);
+        cut.Find(".sc-modal-submit").Click();
+
+        var saved = (await store.GetWorldsAsync()).Single();
+        await Assert.That(saved.UseTls).IsFalse();
+        await Assert.That(saved.AllowInvalidCertificate).IsFalse();
+    }
+}