diff --git a/internal/home/home.go b/internal/home/home.go
index f114853a48e..995a3cfc1dd 100644
--- a/internal/home/home.go
+++ b/internal/home/home.go
@@ -870,8 +870,6 @@ func run(
 
 	sigHdlr.addWeb(web)
 
-	tlsMgr.setWebAPI(web)
-
 	statsDir, querylogDir, err := checkStatsAndQuerylogDirs(config, workDir)
 	fatalOnError(ctx, baseLogger, err)
 
diff --git a/internal/home/tls.go b/internal/home/tls.go
index e364b621573..b25182dcaf9 100644
--- a/internal/home/tls.go
+++ b/internal/home/tls.go
@@ -56,12 +56,6 @@ type tlsManager struct {
 	// nil.
 	extTLSConf *aghtls.ExtendedTLSConfig
 
-	// web is the web UI and API server.  It must not be nil.
-	//
-	// TODO(s.chzhen):  Temporary cyclic dependency due to ongoing refactoring.
-	// Resolve it.
-	web *webAPI
-
 	// rootCerts is a pool of root CAs for TLSv1.2.
 	rootCerts *x509.CertPool
 
@@ -106,8 +100,7 @@ type tlsManagerConfig struct {
 // newTLSManager initializes the manager of TLS configuration.  m is always
 // non-nil while any returned error indicates that the TLS configuration isn't
 // valid.  Thus TLS may be initialized later, e.g. via the web UI.  conf must
-// not be nil.  Note that [tlsManager.web] must be initialized later on by using
-// [tlsManager.setWebAPI].
+// not be nil.
 func newTLSManager(ctx context.Context, conf *tlsManagerConfig) (m *tlsManager, err error) {
 	m = &tlsManager{
 		logger:       conf.logger,
@@ -185,14 +178,6 @@ func newTLSManager(ctx context.Context, conf *tlsManagerConfig) (m *tlsManager,
 	return m, nil
 }
 
-// setWebAPI stores the provided web API.  It must be called before
-// [tlsManager.Start], [tlsManager.reload] or [webAPI.validateTLSSettings].
-//
-// TODO(s.chzhen):  Remove it once cyclic dependency is resolved.
-func (m *tlsManager) setWebAPI(webAPI *webAPI) {
-	m.web = webAPI
-}
-
 // setCertFileTime sets [tlsManager.certLastMod] from the certificate.  If there
 // are errors, setCertFileTime logs them.  m.mu is expected to be locked.
 func (m *tlsManager) setCertFileTime(ctx context.Context) {
@@ -1031,14 +1016,6 @@ var _ service.Interface = (*tlsManager)(nil)
 // Start implements the [service.Interface] interface for *tlsManager.  It
 // starts the TLS manager.
 func (m *tlsManager) Start(ctx context.Context) (err error) {
-	m.mu.Lock()
-	defer m.mu.Unlock()
-
-	// The background context is used because the TLSConfigChanged wraps context
-	// with timeout on its own and shuts down the server, which handles current
-	// request.
-	m.web.tlsConfigChanged(context.Background(), m.extTLSConf)
-
 	go m.handleCertFileChange(ctx)
 
 	return nil
diff --git a/internal/home/tls_internal_test.go b/internal/home/tls_internal_test.go
index bc0a335a222..973ea69a407 100644
--- a/internal/home/tls_internal_test.go
+++ b/internal/home/tls_internal_test.go
@@ -358,9 +358,6 @@ func TestTLSManager_Reload(t *testing.T) {
 	})
 	require.NoError(t, err)
 
-	web := newTestWeb(t, &webConfig{tlsManager: m})
-	m.setWebAPI(web)
-
 	extTLSConf := m.ExtendedTLSConfig()
 	assertCertSerialNumber(t, extTLSConf, snBefore)
 
diff --git a/internal/home/web.go b/internal/home/web.go
index 59a03c7d3f9..6cbb3cb3c83 100644
--- a/internal/home/web.go
+++ b/internal/home/web.go
@@ -340,8 +340,15 @@ func (web *webAPI) start(ctx context.Context) {
 
 	web.logger.InfoContext(ctx, "AdGuard Home is available at the following addresses:")
 
-	// For https, we have a separate goroutine loop.
-	go web.tlsServerLoop(ctx)
+	go func() {
+		// Apply the initial TLS configuration.  The background context is used
+		// because tlsConfigChanged wraps context with timeout on its own and shuts
+		// down the server, which handles current request.
+		web.tlsConfigChanged(context.Background(), web.tlsConfProvider.ExtendedTLSConfig())
+
+		// For https, we have a separate goroutine loop.
+		web.tlsServerLoop(ctx)
+	}()
 
 	// This loop is used as an ability to change listening host and/or port.
 	for !web.httpsServer.inShutdown() {
diff --git a/internal/home/web_internal_test.go b/internal/home/web_internal_test.go
index e273f1092e4..043e3049f02 100644
--- a/internal/home/web_internal_test.go
+++ b/internal/home/web_internal_test.go
@@ -91,7 +91,6 @@ func TestWebAPI_HandleTLSConfigure(t *testing.T) {
 	require.NoError(t, err)
 
 	web := newTestWeb(t, &webConfig{tlsManager: m})
-	m.setWebAPI(web)
 
 	extTLSConf := m.ExtendedTLSConfig()
 	assertCertSerialNumber(t, extTLSConf, wantSerialNumber)
@@ -176,7 +175,6 @@ func TestWebAPI_HandleTLSStatus(t *testing.T) {
 	require.NoError(t, err)
 
 	web := newTestWeb(t, &webConfig{tlsManager: m})
-	m.setWebAPI(web)
 
 	w := httptest.NewRecorder()
 	r := httptest.NewRequest(http.MethodGet, "/control/tls/status", nil)
@@ -209,7 +207,6 @@ func TestWebAPI_ValidateTLSSettings(t *testing.T) {
 	require.NoError(t, err)
 
 	web := newTestWeb(t, &webConfig{tlsManager: m})
-	m.setWebAPI(web)
 
 	tcpLn, err := net.Listen("tcp", ":0")
 	require.NoError(t, err)
@@ -310,7 +307,6 @@ func TestWebAPI_HandleTLSValidate(t *testing.T) {
 	require.NoError(t, err)
 
 	web := newTestWeb(t, &webConfig{tlsManager: m})
-	m.setWebAPI(web)
 
 	setts := &tlsConfigSettingsExt{
 		tlsConfigSettings: tlsConfigSettings{