diff --git a/CHANGELOG.md b/CHANGELOG.md
index 271bd29..668e594 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,23 @@
 # Changelog
 
+## [Unreleased]
+
+### Changed
+
+- **Breaking:** Built-in shortcodes (`gh:`, `gl:`, `cb:`) now default to SSH
+  URLs instead of HTTPS. The `gh config get git_protocol` detection has been
+  removed — behavior is now consistent across all three vendors and independent
+  of the `gh` CLI.
+
+### Added
+
+- `--protocol <ssh|https>` flag on `diecut new` for per-invocation override of
+  shortcode protocol.
+- `DIECUT_GIT_PROTOCOL` environment variable for persistent shortcode protocol
+  preference.
+- Dry-run output now prints the resolved clone URL (or local path) before any
+  clone is attempted.
+
 ## [0.3.5](https://github.com/raiderrobert/diecut/compare/v0.3.4...v0.3.5) (2026-03-15)
 
 
diff --git a/Cargo.lock b/Cargo.lock
index ba4d69f..ed7c55b 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -461,6 +461,7 @@ dependencies = [
  "rstest",
  "serde",
  "serde_json",
+ "serial_test",
  "sha2",
  "tempfile",
  "tera",
@@ -1491,12 +1492,27 @@ dependencies = [
  "winapi-util",
 ]
 
+[[package]]
+name = "scc"
+version = "2.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "46e6f046b7fef48e2660c57ed794263155d713de679057f2d0c169bfc6e756cc"
+dependencies = [
+ "sdd",
+]
+
 [[package]]
 name = "scopeguard"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"
 
+[[package]]
+name = "sdd"
+version = "3.0.10"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "490dcfcbfef26be6800d11870ff2df8774fa6e86d047e3e8c8a76b25655e41ca"
+
 [[package]]
 name = "semver"
 version = "1.0.27"
@@ -1555,6 +1571,32 @@ dependencies = [
  "serde",
 ]
 
+[[package]]
+name = "serial_test"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "911bd979bf1070a3f3aa7b691a3b3e9968f339ceeec89e08c280a8a22207a32f"
+dependencies = [
+ "futures-executor",
+ "futures-util",
+ "log",
+ "once_cell",
+ "parking_lot",
+ "scc",
+ "serial_test_derive",
+]
+
+[[package]]
+name = "serial_test_derive"
+version = "3.4.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0a7d91949b85b0d2fb687445e448b40d322b6b3e4af6b44a29b21d9a5f33e6d9"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "sha2"
 version = "0.10.9"
diff --git a/Cargo.toml b/Cargo.toml
index 4f730dd..e8297e9 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -39,6 +39,7 @@ indexmap = { version = "2.11.4", features = ["serde"] }
 [dev-dependencies]
 rstest = "0.23"
 criterion = "0.5"
+serial_test = "3"
 
 [[bench]]
 name = "benchmarks"
diff --git a/README.md b/README.md
index bd8be97..201d17c 100644
--- a/README.md
+++ b/README.md
@@ -50,6 +50,12 @@ diecut list
 
 Example templates: [diecut-templates](https://github.com/raiderrobert/diecut-templates)
 
+### Protocol
+
+Built-in shortcodes resolve to SSH URLs by default (e.g., `gh:user/repo` →
+`git@github.com:user/repo.git`). To use HTTPS instead, pass `--protocol https`
+or set `DIECUT_GIT_PROTOCOL=https` in your shell environment.
+
 ## Documentation
 
 Full documentation: **[diecut.dev](https://diecut.dev/)**
diff --git a/docs/src/content/docs/reference/commands.md b/docs/src/content/docs/reference/commands.md
index e9b7818..99e17b7 100644
--- a/docs/src/content/docs/reference/commands.md
+++ b/docs/src/content/docs/reference/commands.md
@@ -25,6 +25,7 @@ diecut new <TEMPLATE> [OPTIONS]
 | `--no-hooks` | `false` | Skip running hooks |
 | `--dry-run` | `false` | Show what would be generated without writing files |
 | `-v, --verbose` | `false` | Show file contents (with `--dry-run`) or detailed output |
+| `--protocol <ssh\|https>` | `ssh` | Protocol for expanding built-in shortcodes (`gh:`, `gl:`, `cb:`) |
 
 ### Examples
 
@@ -51,6 +52,7 @@ diecut new ./my-template --dry-run --verbose
 - The `--data` flag can be repeated to set multiple variables.
 - When `--defaults` is set, any variable without a default value causes an error.
 - Subpaths let you point to a template inside a larger repo (e.g., `gh:user/templates/python-pkg`).
+- `DIECUT_GIT_PROTOCOL` sets the default shortcode protocol persistently (`ssh` or `https`). Overridden per-invocation by `--protocol`.
 
 ---
 
diff --git a/docs/src/content/docs/using-templates/index.mdx b/docs/src/content/docs/using-templates/index.mdx
index 5a85c59..02fb463 100644
--- a/docs/src/content/docs/using-templates/index.mdx
+++ b/docs/src/content/docs/using-templates/index.mdx
@@ -17,6 +17,12 @@ diecut pulls templates from local paths or any Git host.
 
 Git templates are cached at `~/.cache/diecut/templates/`. Override with `DIECUT_CACHE_DIR`.
 
+## Protocol
+
+Built-in shortcodes (`gh:`, `gl:`, `cb:`) resolve to SSH URLs by default (e.g.,
+`gh:user/repo` → `git@github.com:user/repo.git`). To use HTTPS instead, pass
+`--protocol https` or set `DIECUT_GIT_PROTOCOL=https` in your shell environment.
+
 ## Multi-template repos (subpaths)
 
 A single repo can hold multiple templates in subdirectories. Add the subdirectory path after the repo:
diff --git a/src/cli.rs b/src/cli.rs
index ab84986..3dd2af8 100644
--- a/src/cli.rs
+++ b/src/cli.rs
@@ -1,4 +1,5 @@
 use clap::{Parser, Subcommand};
+use diecut::template::GitProtocol;
 
 #[derive(Parser)]
 #[command(
@@ -45,8 +46,56 @@ pub enum Commands {
         /// Show file contents (with --dry-run) or detailed output
         #[arg(short, long)]
         verbose: bool,
+
+        /// Protocol for expanding shortcodes (ssh or https).
+        /// Defaults to ssh. Override with DIECUT_GIT_PROTOCOL env var.
+        #[arg(long, value_enum)]
+        protocol: Option<GitProtocol>,
     },
 
     /// List cached templates
     List,
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use clap::Parser;
+    use diecut::template::GitProtocol;
+
+    #[test]
+    fn parses_new_without_protocol() {
+        let cli = Cli::parse_from(["diecut", "new", "gh:user/repo"]);
+        if let Commands::New { protocol, .. } = cli.command {
+            assert!(protocol.is_none());
+        } else {
+            panic!("expected New");
+        }
+    }
+
+    #[test]
+    fn parses_new_with_protocol_ssh() {
+        let cli = Cli::parse_from(["diecut", "new", "gh:user/repo", "--protocol", "ssh"]);
+        if let Commands::New { protocol, .. } = cli.command {
+            assert_eq!(protocol, Some(GitProtocol::Ssh));
+        } else {
+            panic!("expected New");
+        }
+    }
+
+    #[test]
+    fn parses_new_with_protocol_https() {
+        let cli = Cli::parse_from(["diecut", "new", "gh:user/repo", "--protocol", "https"]);
+        if let Commands::New { protocol, .. } = cli.command {
+            assert_eq!(protocol, Some(GitProtocol::Https));
+        } else {
+            panic!("expected New");
+        }
+    }
+
+    #[test]
+    fn rejects_invalid_protocol() {
+        let result = Cli::try_parse_from(["diecut", "new", "gh:user/repo", "--protocol", "ftp"]);
+        assert!(result.is_err());
+    }
+}
diff --git a/src/commands/new.rs b/src/commands/new.rs
index d78f9d3..50b6a49 100644
--- a/src/commands/new.rs
+++ b/src/commands/new.rs
@@ -1,4 +1,7 @@
 use console::style;
+use diecut::template::{
+    format_resolved_source, resolve_git_protocol, resolve_source, GitProtocol, ResolveOptions,
+};
 use diecut::GenerateOptions;
 use miette::Result;
 
@@ -12,6 +15,7 @@ pub fn run(
     no_hooks: bool,
     dry_run: bool,
     verbose: bool,
+    protocol: Option<GitProtocol>,
 ) -> Result<()> {
     let data_pairs: Vec<(String, String)> = data
         .into_iter()
@@ -23,6 +27,20 @@ pub fn run(
         })
         .collect();
 
+    let resolved_protocol = resolve_git_protocol(protocol)?;
+
+    if dry_run {
+        // Resolve the source first so the URL is visible even if clone fails.
+        let source = resolve_source(
+            &template,
+            ResolveOptions {
+                protocol: resolved_protocol,
+                ..Default::default()
+            },
+        )?;
+        println!("{}", format_resolved_source(&source));
+    }
+
     let options = GenerateOptions {
         template,
         output,
@@ -30,6 +48,7 @@ pub fn run(
         defaults,
         overwrite,
         no_hooks,
+        protocol: resolved_protocol,
     };
 
     if dry_run {
diff --git a/src/error.rs b/src/error.rs
index 834b7d2..5430e40 100644
--- a/src/error.rs
+++ b/src/error.rs
@@ -78,6 +78,13 @@ pub enum DicecutError {
         source: tera::Error,
     },
 
+    #[error("Invalid git protocol value '{value}' in {config_key}")]
+    #[diagnostic(help("Expected 'ssh' or 'https'"))]
+    InvalidProtocol {
+        value: String,
+        config_key: &'static str,
+    },
+
     #[error("Invalid template abbreviation: {input}")]
     #[diagnostic(help("Supported abbreviations: gh:user/repo, gl:user/repo, cb:user/repo"))]
     InvalidAbbreviation { input: String },
diff --git a/src/lib.rs b/src/lib.rs
index a57e60c..7c6ab7a 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -18,7 +18,7 @@ use crate::answers::TemplateOrigin;
 use crate::error::{DicecutError, Result};
 use crate::prompt::{collect_variables, PromptOptions};
 use crate::render::{build_context, execute_plan, plan_render, GeneratedProject, GenerationPlan};
-use crate::template::{get_or_clone, resolve_source, TemplateSource};
+use crate::template::{get_or_clone, resolve_source, GitProtocol, ResolveOptions, TemplateSource};
 
 pub struct GenerateOptions {
     pub template: String,
@@ -27,6 +27,7 @@ pub struct GenerateOptions {
     pub defaults: bool,
     pub overwrite: bool,
     pub no_hooks: bool,
+    pub protocol: GitProtocol,
 }
 
 /// Everything needed to execute a generation that has been planned but not yet written.
@@ -44,7 +45,13 @@ pub struct FullGenerationPlan {
 /// This performs all preparation (template resolution, variable collection, pre-generate
 /// hooks, and rendering) but does **not** write any files to disk.
 pub fn plan_generation(options: GenerateOptions) -> Result<FullGenerationPlan> {
-    let source = resolve_source(&options.template)?;
+    let source = resolve_source(
+        &options.template,
+        ResolveOptions {
+            protocol: options.protocol,
+            ..Default::default()
+        },
+    )?;
     let (template_dir, origin) = match &source {
         TemplateSource::Local(path) => (path.clone(), TemplateOrigin::Local),
         TemplateSource::Git {
@@ -222,6 +229,7 @@ default = "my-project"
             defaults: false,
             overwrite: false,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -240,6 +248,7 @@ default = "my-project"
             defaults: true,
             overwrite: false,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let result = plan_generation(options);
@@ -267,6 +276,7 @@ default = "my-project"
             defaults: true,
             overwrite,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let result = plan_generation(options);
@@ -294,6 +304,7 @@ default = "my-project"
             defaults: false,
             overwrite: false,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -326,6 +337,7 @@ default = "my-project"
             defaults: false,
             overwrite: true,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -368,6 +380,7 @@ default = "test"
             defaults: true,
             overwrite: true,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let plan = plan_generation(options).unwrap();
@@ -394,6 +407,7 @@ default = "test"
             defaults: false,
             overwrite: true,
             no_hooks: true,
+            protocol: GitProtocol::default(),
         };
 
         let result = generate(options).unwrap();
diff --git a/src/main.rs b/src/main.rs
index 20cf462..282b8de 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -15,8 +15,9 @@ fn main() -> miette::Result<()> {
             no_hooks,
             dry_run,
             verbose,
+            protocol,
         } => commands::new::run(
-            template, output, data, defaults, overwrite, no_hooks, dry_run, verbose,
+            template, output, data, defaults, overwrite, no_hooks, dry_run, verbose, protocol,
         ),
         Commands::List => commands::list::run(),
     }
diff --git a/src/template/mod.rs b/src/template/mod.rs
index 87aeb39..8a3f04e 100644
--- a/src/template/mod.rs
+++ b/src/template/mod.rs
@@ -4,4 +4,7 @@ pub mod source;
 
 pub use cache::{clear_cache, get_or_clone, list_cached, CacheMetadata, CachedTemplate};
 pub use clone::{clone_template, CloneResult};
-pub use source::{resolve_source, resolve_source_full, resolve_source_with_ref, TemplateSource};
+pub use source::{
+    format_resolved_source, resolve_git_protocol, resolve_source, GitProtocol, ResolveOptions,
+    TemplateSource,
+};
diff --git a/src/template/source.rs b/src/template/source.rs
index 0801692..7266cda 100644
--- a/src/template/source.rs
+++ b/src/template/source.rs
@@ -1,9 +1,43 @@
 use std::collections::HashMap;
 use std::path::{Path, PathBuf};
-use std::process::Command;
 
 use crate::error::{DicecutError, Result};
 
+/// Protocol used when expanding built-in shortcodes (`gh:`/`gl:`/`cb:`).
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Default, clap::ValueEnum)]
+pub enum GitProtocol {
+    #[default]
+    Ssh,
+    Https,
+}
+
+impl std::str::FromStr for GitProtocol {
+    type Err = DicecutError;
+    fn from_str(s: &str) -> Result<Self> {
+        match s {
+            "ssh" => Ok(GitProtocol::Ssh),
+            "https" => Ok(GitProtocol::Https),
+            other => Err(DicecutError::InvalidProtocol {
+                value: other.to_string(),
+                config_key: "DIECUT_GIT_PROTOCOL",
+            }),
+        }
+    }
+}
+
+/// Resolve the git protocol to use for shortcode expansion.
+///
+/// Precedence: CLI flag > `DIECUT_GIT_PROTOCOL` env var > built-in default (SSH).
+pub fn resolve_git_protocol(cli_flag: Option<GitProtocol>) -> Result<GitProtocol> {
+    if let Some(p) = cli_flag {
+        return Ok(p);
+    }
+    match std::env::var("DIECUT_GIT_PROTOCOL") {
+        Ok(value) => value.parse(),
+        Err(_) => Ok(GitProtocol::default()),
+    }
+}
+
 /// Resolved template source.
 pub enum TemplateSource {
     Local(PathBuf),
@@ -15,35 +49,43 @@ pub enum TemplateSource {
     },
 }
 
-/// Built-in abbreviation prefixes and their expansion targets.
-const ABBREVIATIONS: &[(&str, &str, &str)] = &[
-    ("gh:", "https://github.com/", ".git"),
-    ("gl:", "https://gitlab.com/", ".git"),
-    ("cb:", "https://codeberg.org/", ".git"),
-];
+/// Options passed to [`resolve_source`].
+#[derive(Debug, Default)]
+pub struct ResolveOptions<'a> {
+    /// Optional git ref (branch, tag, or commit) to check out.
+    pub git_ref: Option<&'a str>,
+    /// Protocol to use when expanding built-in shortcodes.
+    pub protocol: GitProtocol,
+    /// Optional user-defined abbreviations to consult before built-in shortcodes.
+    pub user_abbreviations: Option<&'a HashMap<String, String>>,
+}
 
-fn detect_github_protocol() -> String {
-    Command::new("gh")
-        .args(["config", "get", "git_protocol", "-h", "github.com"])
-        .output()
-        .ok()
-        .and_then(|output| {
-            if output.status.success() {
-                let stdout = String::from_utf8_lossy(&output.stdout).trim().to_string();
-                if stdout == "ssh" {
-                    return Some("ssh".to_string());
-                }
-            }
-            None
-        })
-        .unwrap_or_else(|| "https".to_string())
+/// A built-in shortcode → host mapping.
+struct VendorShortcode {
+    prefix: &'static str,
+    host: &'static str,
 }
 
-fn build_github_url(rest: &str, protocol: &str) -> String {
-    if protocol == "ssh" {
-        format!("git@github.com:{rest}.git")
-    } else {
-        format!("https://github.com/{rest}.git")
+const SHORTCODES: &[VendorShortcode] = &[
+    VendorShortcode {
+        prefix: "gh:",
+        host: "github.com",
+    },
+    VendorShortcode {
+        prefix: "gl:",
+        host: "gitlab.com",
+    },
+    VendorShortcode {
+        prefix: "cb:",
+        host: "codeberg.org",
+    },
+];
+
+/// Build a clone URL for a given host, repo, and protocol.
+fn build_url(host: &str, repo: &str, protocol: GitProtocol) -> String {
+    match protocol {
+        GitProtocol::Ssh => format!("git@{host}:{repo}.git"),
+        GitProtocol::Https => format!("https://{host}/{repo}.git"),
     }
 }
 
@@ -79,24 +121,9 @@ struct ExpandedSource {
     subpath: Option<String>,
 }
 
-fn expand_abbreviation(input: &str) -> Result<ExpandedSource> {
-    // Special case: GitHub abbreviation with protocol detection
-    if let Some(rest) = input.strip_prefix("gh:") {
-        if rest.is_empty() {
-            return Err(DicecutError::InvalidAbbreviation {
-                input: input.to_string(),
-            });
-        }
-        let (repo, subpath) = split_repo_subpath(rest);
-        let protocol = detect_github_protocol();
-        return Ok(ExpandedSource {
-            url: build_github_url(repo, &protocol),
-            subpath: subpath.map(String::from),
-        });
-    }
-
-    // All other abbreviations use static expansion
-    for &(prefix, base_url, suffix) in ABBREVIATIONS {
+/// Expand a built-in shortcode (`gh:`/`gl:`/`cb:`) into a git URL.
+fn expand_abbreviation(input: &str, protocol: GitProtocol) -> Result<ExpandedSource> {
+    for VendorShortcode { prefix, host } in SHORTCODES {
         if let Some(rest) = input.strip_prefix(prefix) {
             if rest.is_empty() {
                 return Err(DicecutError::InvalidAbbreviation {
@@ -105,7 +132,7 @@ fn expand_abbreviation(input: &str) -> Result<ExpandedSource> {
             }
             let (repo, subpath) = split_repo_subpath(rest);
             return Ok(ExpandedSource {
-                url: format!("{base_url}{repo}{suffix}"),
+                url: build_url(host, repo, protocol),
                 subpath: subpath.map(String::from),
             });
         }
@@ -136,10 +163,9 @@ fn expand_user_abbreviation(
     }))
 }
 
+/// Check if an input string starts with any built-in shortcode prefix.
 fn is_abbreviation(input: &str) -> bool {
-    ABBREVIATIONS
-        .iter()
-        .any(|&(prefix, _, _)| input.starts_with(prefix))
+    SHORTCODES.iter().any(|s| input.starts_with(s.prefix))
 }
 
 fn is_git_url(input: &str) -> bool {
@@ -149,39 +175,49 @@ fn is_git_url(input: &str) -> bool {
         || input.ends_with(".git")
 }
 
-/// Resolve a template argument to a source: abbreviation -> git URL -> local path.
-pub fn resolve_source(template_arg: &str) -> Result<TemplateSource> {
-    resolve_source_with_ref(template_arg, None)
-}
-
-pub fn resolve_source_with_ref(
-    template_arg: &str,
-    git_ref: Option<&str>,
-) -> Result<TemplateSource> {
-    resolve_source_full(template_arg, git_ref, None)
+/// Format a [`TemplateSource`] for human-readable dry-run output.
+pub fn format_resolved_source(source: &TemplateSource) -> String {
+    match source {
+        TemplateSource::Local(path) => {
+            format!("Would use local path: {}", path.display())
+        }
+        TemplateSource::Git {
+            url,
+            git_ref,
+            subpath,
+        } => {
+            let mut out = format!("Would clone from: {url}");
+            if let Some(r) = git_ref {
+                out.push_str(&format!("\n  ref: {r}"));
+            }
+            if let Some(sp) = subpath {
+                out.push_str(&format!("\n  subpath: {sp}"));
+            }
+            out
+        }
+    }
 }
 
-pub fn resolve_source_full(
-    template_arg: &str,
-    git_ref: Option<&str>,
-    user_abbreviations: Option<&HashMap<String, String>>,
-) -> Result<TemplateSource> {
-    if let Some(abbrevs) = user_abbreviations {
+/// Resolve a template argument to a [`TemplateSource`].
+///
+/// Handles user abbreviations, built-in shortcodes, explicit git URLs, and local paths.
+pub fn resolve_source(template_arg: &str, opts: ResolveOptions<'_>) -> Result<TemplateSource> {
+    if let Some(abbrevs) = opts.user_abbreviations {
         if let Some(result) = expand_user_abbreviation(template_arg, abbrevs) {
             let expanded = result?;
             return Ok(TemplateSource::Git {
                 url: expanded.url,
-                git_ref: git_ref.map(String::from),
+                git_ref: opts.git_ref.map(String::from),
                 subpath: expanded.subpath,
             });
         }
     }
 
     if is_abbreviation(template_arg) {
-        let expanded = expand_abbreviation(template_arg)?;
+        let expanded = expand_abbreviation(template_arg, opts.protocol)?;
         return Ok(TemplateSource::Git {
             url: expanded.url,
-            git_ref: git_ref.map(String::from),
+            git_ref: opts.git_ref.map(String::from),
             subpath: expanded.subpath,
         });
     }
@@ -189,7 +225,7 @@ pub fn resolve_source_full(
     if is_git_url(template_arg) {
         return Ok(TemplateSource::Git {
             url: template_arg.to_string(),
-            git_ref: git_ref.map(String::from),
+            git_ref: opts.git_ref.map(String::from),
             subpath: None,
         });
     }
@@ -214,49 +250,6 @@ mod tests {
     use super::*;
     use rstest::rstest;
 
-    // ── Abbreviation expansion ──────────────────────────────────────────
-
-    #[test]
-    fn build_github_url_ssh() {
-        let url = build_github_url("user/repo", "ssh");
-        assert_eq!(url, "git@github.com:user/repo.git");
-    }
-
-    #[test]
-    fn build_github_url_https() {
-        let url = build_github_url("user/repo", "https");
-        assert_eq!(url, "https://github.com/user/repo.git");
-    }
-
-    #[test]
-    fn expand_github_abbreviation() {
-        let expanded = expand_abbreviation("gh:user/repo").unwrap();
-        assert!(
-            expanded.url == "https://github.com/user/repo.git"
-                || expanded.url == "git@github.com:user/repo.git",
-            "unexpected URL: {}",
-            expanded.url
-        );
-        assert!(expanded.subpath.is_none());
-    }
-
-    #[rstest]
-    #[case("gl:org/project", "https://gitlab.com/org/project.git")]
-    #[case("cb:user/repo", "https://codeberg.org/user/repo.git")]
-    fn expand_abbreviation_cases(#[case] input: &str, #[case] expected_url: &str) {
-        let expanded = expand_abbreviation(input).unwrap();
-        assert_eq!(expanded.url, expected_url);
-        assert!(expanded.subpath.is_none());
-    }
-
-    #[test]
-    fn expand_abbreviation_empty_remainder() {
-        let result = expand_abbreviation("gh:");
-        assert!(result.is_err());
-        let err = result.unwrap_err();
-        assert!(matches!(err, DicecutError::InvalidAbbreviation { ref input } if input == "gh:"));
-    }
-
     // ── Git URL detection ───────────────────────────────────────────────
 
     #[rstest]
@@ -269,39 +262,27 @@ mod tests {
         assert_eq!(is_git_url(input), expected);
     }
 
-    // ── resolve_source ──────────────────────────────────────────────────
+    // ── resolve_source with ResolveOptions ──────────────────────────────
 
     #[test]
-    fn resolve_abbreviation_to_git_source() {
-        let source = resolve_source("gh:user/repo").unwrap();
-        match source {
-            TemplateSource::Git {
-                url,
-                git_ref,
-                subpath,
-            } => {
-                assert!(
-                    url == "https://github.com/user/repo.git"
-                        || url == "git@github.com:user/repo.git",
-                    "unexpected URL: {url}"
-                );
-                assert!(git_ref.is_none());
-                assert!(subpath.is_none());
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn resolve_source_with_options_local() {
+        let dir = env!("CARGO_MANIFEST_DIR");
+        let opts = ResolveOptions::default();
+        let source = resolve_source(dir, opts).unwrap();
+        assert!(matches!(source, TemplateSource::Local(_)));
     }
 
     #[test]
-    fn resolve_explicit_https_to_git_source() {
-        let source = resolve_source("https://example.com/repo.git").unwrap();
+    fn resolve_source_with_options_shortcode_ssh_default() {
+        let opts = ResolveOptions::default();
+        let source = resolve_source("gh:user/repo", opts).unwrap();
         match source {
             TemplateSource::Git {
                 url,
                 git_ref,
                 subpath,
             } => {
-                assert_eq!(url, "https://example.com/repo.git");
+                assert_eq!(url, "git@github.com:user/repo.git");
                 assert!(git_ref.is_none());
                 assert!(subpath.is_none());
             }
@@ -310,34 +291,29 @@ mod tests {
     }
 
     #[test]
-    fn resolve_git_ssh_to_git_source() {
-        let source = resolve_source("git@github.com:user/repo.git").unwrap();
+    fn resolve_source_with_options_shortcode_https() {
+        let opts = ResolveOptions {
+            protocol: GitProtocol::Https,
+            ..Default::default()
+        };
+        let source = resolve_source("gh:user/repo", opts).unwrap();
         match source {
-            TemplateSource::Git {
-                url,
-                git_ref,
-                subpath,
-            } => {
-                assert_eq!(url, "git@github.com:user/repo.git");
-                assert!(git_ref.is_none());
-                assert!(subpath.is_none());
+            TemplateSource::Git { url, .. } => {
+                assert_eq!(url, "https://github.com/user/repo.git");
             }
             _ => panic!("expected Git source"),
         }
     }
 
-    // ── resolve_source_with_ref ─────────────────────────────────────────
-
     #[test]
-    fn resolve_with_ref_sets_git_ref() {
-        let source = resolve_source_with_ref("gh:user/repo", Some("v1.0")).unwrap();
+    fn resolve_source_with_options_ref() {
+        let opts = ResolveOptions {
+            git_ref: Some("v1.0"),
+            ..Default::default()
+        };
+        let source = resolve_source("gh:user/repo", opts).unwrap();
         match source {
-            TemplateSource::Git { url, git_ref, .. } => {
-                assert!(
-                    url == "https://github.com/user/repo.git"
-                        || url == "git@github.com:user/repo.git",
-                    "unexpected URL: {url}"
-                );
+            TemplateSource::Git { git_ref, .. } => {
                 assert_eq!(git_ref.as_deref(), Some("v1.0"));
             }
             _ => panic!("expected Git source"),
@@ -345,210 +321,278 @@ mod tests {
     }
 
     #[test]
-    fn resolve_with_ref_none_leaves_ref_none() {
-        let source = resolve_source_with_ref("gh:user/repo", None).unwrap();
+    fn resolve_source_with_options_shortcode_subpath() {
+        let opts = ResolveOptions::default();
+        let source = resolve_source("gh:user/repo/my-template", opts).unwrap();
         match source {
-            TemplateSource::Git { url, git_ref, .. } => {
-                assert!(
-                    url == "https://github.com/user/repo.git"
-                        || url == "git@github.com:user/repo.git",
-                    "unexpected URL: {url}"
-                );
-                assert!(git_ref.is_none());
+            TemplateSource::Git { url, subpath, .. } => {
+                assert_eq!(url, "git@github.com:user/repo.git");
+                assert_eq!(subpath.as_deref(), Some("my-template"));
             }
             _ => panic!("expected Git source"),
         }
     }
 
-    // ── Local path fallback ─────────────────────────────────────────────
-
     #[test]
-    fn resolve_existing_local_path() {
-        // Use the cargo manifest dir which is guaranteed to exist.
-        let dir = env!("CARGO_MANIFEST_DIR");
-        let source = resolve_source(dir).unwrap();
+    fn resolve_source_with_options_plain_url() {
+        let opts = ResolveOptions::default();
+        let source = resolve_source("https://example.com/repo.git", opts).unwrap();
         match source {
-            TemplateSource::Local(path) => {
-                assert!(path.exists());
+            TemplateSource::Git { url, subpath, .. } => {
+                assert_eq!(url, "https://example.com/repo.git");
+                assert!(subpath.is_none());
             }
-            _ => panic!("expected Local source"),
+            _ => panic!("expected Git source"),
         }
     }
 
     #[test]
-    fn resolve_nonexistent_local_path_errors() {
-        let result = resolve_source("/nonexistent/path/that/does/not/exist");
+    fn resolve_source_nonexistent_local_path_errors() {
+        let opts = ResolveOptions::default();
+        let result = resolve_source("/nonexistent/path/that/does/not/exist", opts);
         assert!(result.is_err());
     }
 
-    // ── User abbreviations ──────────────────────────────────────────────
+    // ── Subpath parsing ────────────────────────────────────────────────
 
-    #[test]
-    fn user_abbreviation_expands_correctly() {
-        let mut abbrevs = HashMap::new();
-        abbrevs.insert(
-            "company".to_string(),
-            "https://git.company.com/{}.git".to_string(),
-        );
-        let source = resolve_source_full("company:team/project", None, Some(&abbrevs)).unwrap();
-        match source {
-            TemplateSource::Git {
-                url,
-                git_ref,
-                subpath,
-            } => {
-                assert_eq!(url, "https://git.company.com/team/project.git");
-                assert!(git_ref.is_none());
-                assert!(subpath.is_none());
-            }
-            _ => panic!("expected Git source"),
-        }
+    #[rstest]
+    #[case("user/repo", "user/repo", None)]
+    #[case("user/repo/template-a", "user/repo", Some("template-a"))]
+    #[case("user/repo/templates/python", "user/repo", Some("templates/python"))]
+    #[case("user/repo/", "user/repo", None)]
+    fn split_repo_subpath_cases(
+        #[case] input: &str,
+        #[case] exp_repo: &str,
+        #[case] exp_sub: Option<&str>,
+    ) {
+        let (repo, sub) = split_repo_subpath(input);
+        assert_eq!(repo, exp_repo);
+        assert_eq!(sub, exp_sub);
     }
 
+    // ── GitProtocol ────────────────────────────────────────────────────
+
     #[test]
-    fn user_abbreviation_with_ref() {
-        let mut abbrevs = HashMap::new();
-        abbrevs.insert(
-            "corp".to_string(),
-            "https://git.corp.com/{}.git".to_string(),
-        );
-        let source = resolve_source_full("corp:myrepo", Some("v2.0"), Some(&abbrevs)).unwrap();
-        match source {
-            TemplateSource::Git { url, git_ref, .. } => {
-                assert_eq!(url, "https://git.corp.com/myrepo.git");
-                assert_eq!(git_ref.as_deref(), Some("v2.0"));
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn git_protocol_parses_ssh() {
+        let p: GitProtocol = "ssh".parse().unwrap();
+        assert_eq!(p, GitProtocol::Ssh);
     }
 
     #[test]
-    fn user_abbreviation_takes_priority_over_builtin() {
-        let mut abbrevs = HashMap::new();
-        abbrevs.insert(
-            "gh".to_string(),
-            "https://custom-github.example.com/{}.git".to_string(),
-        );
-        let source = resolve_source_full("gh:user/repo", None, Some(&abbrevs)).unwrap();
-        match source {
-            TemplateSource::Git { url, .. } => {
-                assert_eq!(url, "https://custom-github.example.com/user/repo.git");
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn git_protocol_parses_https() {
+        let p: GitProtocol = "https".parse().unwrap();
+        assert_eq!(p, GitProtocol::Https);
     }
 
     #[test]
-    fn user_abbreviation_empty_remainder_errors() {
-        let mut abbrevs = HashMap::new();
-        abbrevs.insert(
-            "company".to_string(),
-            "https://git.company.com/{}.git".to_string(),
-        );
-        let result = resolve_source_full("company:", None, Some(&abbrevs));
+    fn git_protocol_rejects_unknown() {
+        let result: Result<GitProtocol> = "http".parse();
         assert!(result.is_err());
+        let err = result.unwrap_err();
+        assert!(matches!(
+            err,
+            DicecutError::InvalidProtocol { ref value, .. } if value == "http"
+        ));
     }
 
     #[test]
-    fn unknown_user_abbreviation_falls_through_to_builtin() {
-        let mut abbrevs = HashMap::new();
-        abbrevs.insert(
-            "company".to_string(),
-            "https://git.company.com/{}.git".to_string(),
-        );
-        let source = resolve_source_full("gh:user/repo", None, Some(&abbrevs)).unwrap();
-        match source {
-            TemplateSource::Git { url, .. } => {
-                assert!(
-                    url == "https://github.com/user/repo.git"
-                        || url == "git@github.com:user/repo.git",
-                    "unexpected URL: {url}"
-                );
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn git_protocol_default_is_ssh() {
+        assert_eq!(GitProtocol::default(), GitProtocol::Ssh);
     }
 
-    #[test]
-    fn no_user_abbreviations_behaves_as_before() {
-        let source = resolve_source_full("gh:user/repo", None, None).unwrap();
-        match source {
-            TemplateSource::Git { url, .. } => {
-                assert!(
-                    url == "https://github.com/user/repo.git"
-                        || url == "git@github.com:user/repo.git",
-                    "unexpected URL: {url}"
-                );
-            }
-            _ => panic!("expected Git source"),
-        }
-    }
+    // ── Shortcode expansion (protocol-aware) ───────────────────────────
 
-    // ── Subpath parsing ────────────────────────────────────────────────
+    #[rstest]
+    #[case("gh:user/repo", GitProtocol::Ssh, "git@github.com:user/repo.git")]
+    #[case("gh:user/repo", GitProtocol::Https, "https://github.com/user/repo.git")]
+    #[case("gl:org/project", GitProtocol::Ssh, "git@gitlab.com:org/project.git")]
+    #[case(
+        "gl:org/project",
+        GitProtocol::Https,
+        "https://gitlab.com/org/project.git"
+    )]
+    #[case("cb:user/repo", GitProtocol::Ssh, "git@codeberg.org:user/repo.git")]
+    #[case(
+        "cb:user/repo",
+        GitProtocol::Https,
+        "https://codeberg.org/user/repo.git"
+    )]
+    fn expand_shortcode_per_protocol(
+        #[case] input: &str,
+        #[case] protocol: GitProtocol,
+        #[case] expected_url: &str,
+    ) {
+        let expanded = expand_abbreviation(input, protocol).unwrap();
+        assert_eq!(expanded.url, expected_url);
+        assert!(expanded.subpath.is_none());
+    }
 
     #[rstest]
-    #[case("user/repo", "user/repo", None)]
-    #[case("user/repo/template-a", "user/repo", Some("template-a"))]
-    #[case("user/repo/templates/python", "user/repo", Some("templates/python"))]
-    #[case("user/repo/", "user/repo", None)]
-    fn split_repo_subpath_cases(
+    #[case(
+        "gh:user/repo/templates/py",
+        GitProtocol::Ssh,
+        "git@github.com:user/repo.git",
+        "templates/py"
+    )]
+    #[case(
+        "gl:org/repo/templates/python",
+        GitProtocol::Https,
+        "https://gitlab.com/org/repo.git",
+        "templates/python"
+    )]
+    #[case(
+        "cb:user/repo/sub",
+        GitProtocol::Ssh,
+        "git@codeberg.org:user/repo.git",
+        "sub"
+    )]
+    fn expand_shortcode_with_subpath(
         #[case] input: &str,
-        #[case] exp_repo: &str,
-        #[case] exp_sub: Option<&str>,
+        #[case] protocol: GitProtocol,
+        #[case] expected_url: &str,
+        #[case] expected_subpath: &str,
     ) {
-        let (repo, sub) = split_repo_subpath(input);
-        assert_eq!(repo, exp_repo);
-        assert_eq!(sub, exp_sub);
+        let expanded = expand_abbreviation(input, protocol).unwrap();
+        assert_eq!(expanded.url, expected_url);
+        assert_eq!(expanded.subpath.as_deref(), Some(expected_subpath));
     }
 
     #[test]
-    fn resolve_abbreviation_with_subpath() {
-        let source = resolve_source("gh:user/repo/my-template").unwrap();
-        match source {
-            TemplateSource::Git {
-                url,
-                subpath,
-                git_ref,
-            } => {
-                assert!(
-                    url == "https://github.com/user/repo.git"
-                        || url == "git@github.com:user/repo.git",
-                    "unexpected URL: {url}"
-                );
-                assert_eq!(subpath.as_deref(), Some("my-template"));
-                assert!(git_ref.is_none());
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn expand_shortcode_empty_remainder_errors() {
+        let result = expand_abbreviation("gh:", GitProtocol::Ssh);
+        assert!(result.is_err());
+        assert!(matches!(
+            result.unwrap_err(),
+            DicecutError::InvalidAbbreviation { ref input } if input == "gh:"
+        ));
     }
 
     #[test]
-    fn resolve_abbreviation_with_nested_subpath() {
-        let source = resolve_source("gl:org/repo/templates/python").unwrap();
-        match source {
-            TemplateSource::Git { url, subpath, .. } => {
-                assert_eq!(url, "https://gitlab.com/org/repo.git");
-                assert_eq!(subpath.as_deref(), Some("templates/python"));
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn expand_shortcode_unknown_prefix_errors() {
+        let result = expand_abbreviation("xx:user/repo", GitProtocol::Ssh);
+        assert!(result.is_err());
     }
 
+    // ── format_resolved_source ─────────────────────────────────────────
+
     #[test]
-    fn user_abbreviation_with_subpath() {
-        let mut abbrevs = HashMap::new();
-        abbrevs.insert(
-            "company".to_string(),
-            "https://git.company.com/{}.git".to_string(),
-        );
-        let source =
-            resolve_source_full("company:team/project/subdir", None, Some(&abbrevs)).unwrap();
-        match source {
-            TemplateSource::Git { url, subpath, .. } => {
-                assert_eq!(url, "https://git.company.com/team/project.git");
-                assert_eq!(subpath.as_deref(), Some("subdir"));
-            }
-            _ => panic!("expected Git source"),
-        }
+    fn format_resolved_source_git_url_only() {
+        let source = TemplateSource::Git {
+            url: "git@github.com:user/repo.git".to_string(),
+            git_ref: None,
+            subpath: None,
+        };
+        let s = format_resolved_source(&source);
+        assert!(s.contains("Would clone from: git@github.com:user/repo.git"));
+        assert!(!s.contains("ref:"));
+        assert!(!s.contains("subpath:"));
+    }
+
+    #[test]
+    fn format_resolved_source_git_full() {
+        let source = TemplateSource::Git {
+            url: "https://github.com/user/repo.git".to_string(),
+            git_ref: Some("main".to_string()),
+            subpath: Some("templates/py".to_string()),
+        };
+        let s = format_resolved_source(&source);
+        assert!(s.contains("Would clone from: https://github.com/user/repo.git"));
+        assert!(s.contains("ref: main"));
+        assert!(s.contains("subpath: templates/py"));
+    }
+
+    #[test]
+    fn format_resolved_source_local() {
+        let source = TemplateSource::Local(std::path::PathBuf::from("/tmp/templates/foo"));
+        let s = format_resolved_source(&source);
+        assert!(s.contains("Would use local path: /tmp/templates/foo"));
+    }
+}
+
+#[cfg(test)]
+mod protocol_resolution_tests {
+    use super::*;
+    use serial_test::serial;
+
+    fn clear_env() {
+        std::env::remove_var("DIECUT_GIT_PROTOCOL");
+    }
+
+    #[test]
+    #[serial]
+    fn no_flag_no_env_defaults_to_ssh() {
+        clear_env();
+        let result = resolve_git_protocol(None).unwrap();
+        assert_eq!(result, GitProtocol::Ssh);
+    }
+
+    #[test]
+    #[serial]
+    fn flag_ssh_returns_ssh() {
+        clear_env();
+        let result = resolve_git_protocol(Some(GitProtocol::Ssh)).unwrap();
+        assert_eq!(result, GitProtocol::Ssh);
+    }
+
+    #[test]
+    #[serial]
+    fn flag_https_returns_https() {
+        clear_env();
+        let result = resolve_git_protocol(Some(GitProtocol::Https)).unwrap();
+        assert_eq!(result, GitProtocol::Https);
+    }
+
+    #[test]
+    #[serial]
+    fn env_https_returns_https_when_no_flag() {
+        clear_env();
+        std::env::set_var("DIECUT_GIT_PROTOCOL", "https");
+        let result = resolve_git_protocol(None).unwrap();
+        clear_env();
+        assert_eq!(result, GitProtocol::Https);
+    }
+
+    #[test]
+    #[serial]
+    fn env_ssh_returns_ssh_when_no_flag() {
+        clear_env();
+        std::env::set_var("DIECUT_GIT_PROTOCOL", "ssh");
+        let result = resolve_git_protocol(None).unwrap();
+        clear_env();
+        assert_eq!(result, GitProtocol::Ssh);
+    }
+
+    #[test]
+    #[serial]
+    fn flag_overrides_env() {
+        clear_env();
+        std::env::set_var("DIECUT_GIT_PROTOCOL", "ssh");
+        let result = resolve_git_protocol(Some(GitProtocol::Https)).unwrap();
+        clear_env();
+        assert_eq!(result, GitProtocol::Https);
+    }
+
+    #[test]
+    #[serial]
+    fn invalid_env_value_errors() {
+        clear_env();
+        std::env::set_var("DIECUT_GIT_PROTOCOL", "tcp");
+        let result = resolve_git_protocol(None);
+        clear_env();
+        assert!(result.is_err());
+        assert!(matches!(
+            result.unwrap_err(),
+            DicecutError::InvalidProtocol { ref value, .. } if value == "tcp"
+        ));
+    }
+
+    #[test]
+    #[serial]
+    fn empty_env_value_errors() {
+        clear_env();
+        std::env::set_var("DIECUT_GIT_PROTOCOL", "");
+        let result = resolve_git_protocol(None);
+        clear_env();
+        assert!(result.is_err());
     }
 }
diff --git a/tests/integration.rs b/tests/integration.rs
index 4005080..8eb83ec 100644
--- a/tests/integration.rs
+++ b/tests/integration.rs
@@ -5,7 +5,7 @@ use diecut::adapter;
 use diecut::config::load_config;
 use diecut::prompt::PromptOptions;
 use diecut::render::{build_context, execute_plan, plan_render, walk_and_render};
-use diecut::template::source::{resolve_source, resolve_source_full};
+use diecut::template::source::{resolve_source, ResolveOptions};
 use rstest::rstest;
 
 fn fixture_path(name: &str) -> PathBuf {
@@ -268,14 +268,7 @@ name = "missing-template-dir"
 #[case("gl:")]
 #[case("cb:")]
 fn test_resolve_source_rejects_empty_abbreviation_remainder(#[case] input: &str) {
-    assert!(resolve_source(input).is_err());
-}
-
-#[test]
-fn test_resolve_source_user_abbreviation_empty_remainder() {
-    let mut abbrevs = std::collections::HashMap::new();
-    abbrevs.insert("co".to_string(), "https://git.co.com/{}.git".to_string());
-    assert!(resolve_source_full("co:", None, Some(&abbrevs)).is_err());
+    assert!(resolve_source(input, ResolveOptions::default()).is_err());
 }
 
 // --- Deprecated .tera suffix fallback ---
@@ -440,6 +433,7 @@ fn test_plan_generation_dry_run_no_files_written() {
         defaults: true,
         overwrite: false,
         no_hooks: true,
+        protocol: diecut::template::GitProtocol::default(),
     };
 
     // plan_generation should succeed
@@ -588,6 +582,7 @@ fn test_plan_generation_verbose_has_content() {
         defaults: true,
         overwrite: false,
         no_hooks: true,
+        protocol: diecut::template::GitProtocol::default(),
     };
 
     let plan = diecut::plan_generation(options).unwrap();
@@ -622,3 +617,61 @@ fn test_plan_generation_verbose_has_content() {
         "at least one rendered file should contain the resolved project name"
     );
 }
+
+// --- End-to-end binary test: dry-run prints resolved source ---
+
+#[test]
+fn dry_run_prints_resolved_local_source() {
+    use std::process::Command;
+    use tempfile::tempdir;
+
+    let tmp = tempdir().unwrap();
+    let template_dir = tmp.path().join("my-template");
+    std::fs::create_dir_all(&template_dir).unwrap();
+    std::fs::write(
+        template_dir.join("diecut.toml"),
+        r#"[template]
+name = "dry-run-test"
+
+[variables.project_name]
+type = "string"
+prompt = "Project name"
+default = "demo"
+"#,
+    )
+    .unwrap();
+    // Template files must live under a `template/` subdirectory
+    std::fs::create_dir_all(template_dir.join("template").join("{{ project_name }}")).unwrap();
+    std::fs::write(
+        template_dir
+            .join("template")
+            .join("{{ project_name }}")
+            .join("README.md.die"),
+        "# {{ project_name }}\n",
+    )
+    .unwrap();
+
+    let output_dir = tmp.path().join("out");
+
+    let output = Command::new(env!("CARGO_BIN_EXE_diecut"))
+        .arg("new")
+        .arg(template_dir.to_str().unwrap())
+        .arg("--dry-run")
+        .arg("--defaults")
+        .arg("-o")
+        .arg(output_dir.to_str().unwrap())
+        .output()
+        .expect("failed to run diecut binary");
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let stderr = String::from_utf8_lossy(&output.stderr);
+
+    assert!(
+        output.status.success(),
+        "diecut new exited with failure.\nstdout: {stdout}\nstderr: {stderr}"
+    );
+    assert!(
+        stdout.contains("Would use local path:"),
+        "expected 'Would use local path:' in stdout, got: {stdout}"
+    );
+}