So I found a solution, although it feels a bit hackish. I’m now manually forcing PHP on HTTPS, before initializing Kirby:
<?php
include '../vendor/autoload.php';
$_SERVER['HTTPS'] = getenv('APP_ENV') == 'production';
echo (new Kirby)->render();
If anyone has a better solution, I’m all ears. For now, this seems to work as expected.