diff --git a/tracing/tracing.go b/tracing/tracing.go
index 65418d1214..932fab92b6 100644
--- a/tracing/tracing.go
+++ b/tracing/tracing.go
@@ -207,6 +207,14 @@ func getClient(tracingCfg config.TracingConfig) (otlptrace.Client, error) {
 		opts := []otlptracehttp.Option{otlptracehttp.WithEndpoint(tracingCfg.Endpoint)}
 		if tracingCfg.Insecure {
 			opts = append(opts, otlptracehttp.WithInsecure())
+		} else {
+			// Use of TLS Credentials forces the use of TLS. Therefore it can
+			// only be set when `insecure` is set to false.
+			tlsConf, err := config_util.NewTLSConfig(&tracingCfg.TLSConfig)
+			if err != nil {
+				return nil, err
+			}
+			opts = append(opts, otlptracehttp.WithTLSClientConfig(tlsConf))
 		}
 		// Currently, OTEL supports only gzip compression.
 		if tracingCfg.Compression == config.GzipCompression {
@@ -219,12 +227,6 @@ func getClient(tracingCfg config.TracingConfig) (otlptrace.Client, error) {
 			opts = append(opts, otlptracehttp.WithTimeout(time.Duration(tracingCfg.Timeout)))
 		}
 
-		tlsConf, err := config_util.NewTLSConfig(&tracingCfg.TLSConfig)
-		if err != nil {
-			return nil, err
-		}
-		opts = append(opts, otlptracehttp.WithTLSClientConfig(tlsConf))
-
 		client = otlptracehttp.NewClient(opts...)
 	}
 
diff --git a/tracing/tracing_test.go b/tracing/tracing_test.go
index 0840abafdf..da154326e6 100644
--- a/tracing/tracing_test.go
+++ b/tracing/tracing_test.go
@@ -117,6 +117,18 @@ func TestUninstallingTracerProvider(t *testing.T) {
 	require.Equal(t, noop.NewTracerProvider(), otel.GetTracerProvider())
 }
 
+func TestInstallingTracerProviderHTTPInsecure(t *testing.T) {
+	m := NewManager(promslog.NewNopLogger())
+	cfg := config.Config{
+		TracingConfig: config.TracingConfig{
+			Endpoint:   "localhost:4318",
+			ClientType: config.TracingClientHTTP,
+			Insecure:   true,
+		},
+	}
+	require.NoError(t, m.ApplyConfig(&cfg))
+}
+
 func TestTracerProviderShutdown(t *testing.T) {
 	m := NewManager(promslog.NewNopLogger())
 	cfg := config.Config{