diff --git a/package-lock.json b/package-lock.json
index 12b88b084..7bedb42f1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -24,7 +24,7 @@
         "ipfs-utils": "^9.0.10",
         "ipfsd-ctl": "10.0.6",
         "it-last": "^1.0.6",
-        "kubo": "0.32.1",
+        "kubo": "0.33.0",
         "multiaddr": "10.0.1",
         "multiaddr-to-uri": "8.0.0",
         "portfinder": "^1.0.32",
@@ -9092,9 +9092,9 @@
       }
     },
     "node_modules/kubo": {
-      "version": "0.32.1",
-      "resolved": "https://registry.npmjs.org/kubo/-/kubo-0.32.1.tgz",
-      "integrity": "sha512-vXTprOeWACNpU86ldCBSBMRgq4MahLIr/YBn6DBb0SvHHVe4ZD8Djma6ncfVmxzrWxEiIMq9XOxJcQ27UOZ6kw==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/kubo/-/kubo-0.33.0.tgz",
+      "integrity": "sha512-5k4jX6wtqwvMMshfTAwtkiOe3KHvhXPjmkGegSxCFOGg5BhbAQUEpxlhu0DLSYPhlmMo55SSDMTvHZJeShSlwg==",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {
@@ -21943,9 +21943,9 @@
       }
     },
     "kubo": {
-      "version": "0.32.1",
-      "resolved": "https://registry.npmjs.org/kubo/-/kubo-0.32.1.tgz",
-      "integrity": "sha512-vXTprOeWACNpU86ldCBSBMRgq4MahLIr/YBn6DBb0SvHHVe4ZD8Djma6ncfVmxzrWxEiIMq9XOxJcQ27UOZ6kw==",
+      "version": "0.33.0",
+      "resolved": "https://registry.npmjs.org/kubo/-/kubo-0.33.0.tgz",
+      "integrity": "sha512-5k4jX6wtqwvMMshfTAwtkiOe3KHvhXPjmkGegSxCFOGg5BhbAQUEpxlhu0DLSYPhlmMo55SSDMTvHZJeShSlwg==",
       "requires": {
         "cachedir": "^2.3.0",
         "got": "^11.7.0",
diff --git a/package.json b/package.json
index 8346338bc..3fc725f7c 100644
--- a/package.json
+++ b/package.json
@@ -82,7 +82,7 @@
     "ipfs-utils": "^9.0.10",
     "ipfsd-ctl": "10.0.6",
     "it-last": "^1.0.6",
-    "kubo": "0.32.1",
+    "kubo": "0.33.0",
     "multiaddr": "10.0.1",
     "multiaddr-to-uri": "8.0.0",
     "portfinder": "^1.0.32",
diff --git a/src/daemon/config.js b/src/daemon/config.js
index 43efe53f1..fc5a110cd 100644
--- a/src/daemon/config.js
+++ b/src/daemon/config.js
@@ -93,13 +93,16 @@ function applyDefaults (ipfsd) {
   config.API = { HTTPHeaders: {} }
 
   config.Swarm = config.Swarm ?? {}
-  config.Swarm.DisableNatPortMap = false
+  config.Swarm.DisableNatPortMap = false // uPnP
   config.Swarm.ConnMgr = config.Swarm.ConnMgr ?? {}
 
   config.Discovery = config.Discovery ?? {}
   config.Discovery.MDNS = config.Discovery.MDNS ?? {}
   config.Discovery.MDNS.Enabled = true
 
+  config.AutoTLS = config.AutoTLS ?? {}
+  config.AutoTLS.Enabled = true
+
   writeConfigFile(ipfsd, config)
 }
 
@@ -150,7 +153,7 @@ const getGatewayPort = (config) => getHttpPort(config.Addresses.Gateway)
  */
 function migrateConfig (ipfsd) {
   // Bump revision number when new migration rule is added
-  const REVISION = 5
+  const REVISION = 6
   const REVISION_KEY = 'daemonConfigRevision'
   const CURRENT_REVISION = store.get(REVISION_KEY, 0)
 
@@ -231,6 +234,18 @@ function migrateConfig (ipfsd) {
     }
   }
 
+  if (CURRENT_REVISION < 6) {
+    // Enable AutoTLS if there is no explicit user preference
+    if (config.AutoTLS === undefined) {
+      config.AutoTLS = {}
+      changed = true
+    }
+    if (config.AutoTLS.Enabled === undefined) {
+      config.AutoTLS.Enabled = true
+      changed = true
+    }
+  }
+
   if (changed) {
     try {
       writeConfigFile(ipfsd, config)
diff --git a/test/e2e/launch.e2e.test.js b/test/e2e/launch.e2e.test.js
index fdf385c2b..b6d1922e2 100644
--- a/test/e2e/launch.e2e.test.js
+++ b/test/e2e/launch.e2e.test.js
@@ -220,6 +220,57 @@ test.describe.serial('Application launch', async () => {
     expect(config.Swarm.ConnMgr.HighWater).toEqual(undefined)
   })
 
+  test('applies config migration v6 (explicitly enable AutoTLS if upgrading from Kubo <0.33)', async () => {
+    // create preexisting, initialized repo and config
+    const { repoPath, configPath, peerId: expectedId } = await makeRepository({ start: false })
+
+    const initConfig = fs.readJsonSync(configPath)
+    initConfig.AutoTLS = undefined // simulate kubo <0.33, where there was no AutoTLS section
+    fs.writeJsonSync(configPath, initConfig, { spaces: 2 })
+
+    const { app } = await startApp({ repoPath })
+    const { peerId } = await daemonReady(app)
+    expect(peerId).toBe(expectedId)
+
+    const config = fs.readJsonSync(configPath)
+    // ensure app has migrated config and AutoTLS is explicitly enabled now
+    expect(config.AutoTLS.Enabled).toEqual(true)
+  })
+
+  test('applies config migration v6 (explicitly enable AutoTLS if Kubo >=0.33)', async () => {
+    // create preexisting, initialized repo and config
+    const { repoPath, configPath, peerId: expectedId } = await makeRepository({ start: false })
+
+    // just read config (it should have empty AutoTLS config)
+    const initConfig = fs.readJsonSync(configPath)
+    fs.writeJsonSync(configPath, initConfig, { spaces: 2 })
+
+    const { app } = await startApp({ repoPath })
+    const { peerId } = await daemonReady(app)
+    expect(peerId).toBe(expectedId)
+
+    const config = fs.readJsonSync(configPath)
+    // ensure ipfs-desktop migrated default Kubo config to explicitly enable AutoTLS
+    expect(config.AutoTLS.Enabled).toEqual(true)
+  })
+
+  test('applies config migration v6 (respect pre-existing AutoTLS user config)', async () => {
+    // create preexisting, initialized repo and config
+    const { repoPath, configPath, peerId: expectedId } = await makeRepository({ start: false })
+
+    const initConfig = fs.readJsonSync(configPath)
+    initConfig.AutoTLS = { Enabled: false } // user explicitly disabled it
+    fs.writeJsonSync(configPath, initConfig, { spaces: 2 })
+
+    const { app } = await startApp({ repoPath })
+    const { peerId } = await daemonReady(app)
+    expect(peerId).toBe(expectedId)
+
+    const config = fs.readJsonSync(configPath)
+    // ensure app respected and kept user choice
+    expect(config.AutoTLS.Enabled).toEqual(false)
+  })
+
   test('starts with repository with "IPFS_PATH/api" file and no daemon running', async () => {
     // create "remote" repo
     const { ipfsd } = await makeRepository({ start: true })