diff --git a/configuration.xml b/configuration.xml
index 593aae4..175690a 100644
--- a/configuration.xml
+++ b/configuration.xml
@@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <settings>
     <repositories>
-        <repository active="true" default="true">http://exist-db.org/exist/apps/public-repo</repository>
+        <repository active="true" default="true">https://exist-db.org/exist/apps/public-repo</repository>
     </repositories>
     <readonly>
         <package>http://exist-db.org/apps/existdb-packageservice</package>
diff --git a/modules/config.xqm b/modules/config.xqm
index 3cdec6d..a2623d6 100644
--- a/modules/config.xqm
+++ b/modules/config.xqm
@@ -40,8 +40,8 @@ declare variable $config:INSTALL-PACKAGE-PERMISSION := data(doc($config:app-root
 declare variable $config:REMOVE-PACKAGE-PERMISSION := data(doc($config:app-root || "/configuration.xml")/settings/authorization/action[@name eq "remove-package"]/@required-level);
 :)
 
-(: ### default to first found entry of repository element for now - to be extended for multiple repos ### :)
-declare variable $config:DEFAULT-REPO := xs:anyURI($config:SETTINGS//repository[1]);
+(: the highlander says: there can only be one default repo :)
+declare variable $config:DEFAULT-REPO := xs:anyURI($config:SETTINGS//repository[@default = "true"][1]);
 
 (:~
  : Resolve the given path using the current application context.
diff --git a/modules/packages.xqm b/modules/packages.xqm
index 7f2648c..b2b5c29 100644
--- a/modules/packages.xqm
+++ b/modules/packages.xqm
@@ -18,7 +18,7 @@ declare option output:method "html5";
 declare option output:media-type "text/html";
 
 declare variable $packages:configuration := doc($config:app-root || "/configuration.xml");
-
+declare variable $packages:repos := $packages:configuration//repository[@active='true'];
 declare variable $packages:DEFAULTS := doc($config:app-root || "/defaults.xml")/apps;
 declare variable $packages:ADMINAPPS := ["dashboard","backup"];
 declare variable $packages:HIDE := ("dashboard");
@@ -101,8 +101,9 @@ declare function packages:get-remote-packages(){
 };
 :)
 
+(:~ only return repos that are set to active :)
 declare function packages:get-repo-locations(){
-    data($packages:configuration//repository)
+    data($packages:configuration//repository[@active = 'true'])
 };
 
 
@@ -282,10 +283,12 @@ declare function packages:get-package-meta($app as xs:string, $name as xs:string
 (: should be private but there seems to be a bug :)
 declare function packages:public-repo-contents($installed as element(repo-app)*) {
     try {
-        let $url := $config:DEFAULT-REPO || "/public/apps.xml?version=" || packages:get-version() ||
+        for $pkgs in $packages:repos
+        let $urls := $pkgs || "/public/apps.xml?version=" || packages:get-version() ||
             "&amp;source=" || util:system-property("product-source")
         (: EXPath client module does not work properly. No idea why. :)
-        let $request :=
+        let $request := for $url in $urls
+            return
             <http:request method="get" href="{$url}" timeout="10">
                 <http:header name="Cache-Control" value="no-cache"/>
             </http:request>