diff --git a/config.go b/config.go
index edba183..1fc82e2 100644
--- a/config.go
+++ b/config.go
@@ -640,6 +640,7 @@ func (uc *UpstreamConfig) newDOHTransport(addrs []string) *http.Transport {
 	transport.TLSClientConfig = &tls.Config{
 		RootCAs:            uc.certPool,
 		ClientSessionCache: tls.NewLRUClientSessionCache(0),
+		MinVersion:         tls.VersionTLS12,
 	}
 
 	// Prevent bad tcp connection hanging the requests for too long.
diff --git a/config_quic.go b/config_quic.go
index 237bb82..819fe9f 100644
--- a/config_quic.go
+++ b/config_quic.go
@@ -18,7 +18,7 @@ func (uc *UpstreamConfig) newDOH3Transport(addrs []string) http.RoundTripper {
 		return nil
 	}
 	rt := &http3.Transport{}
-	rt.TLSClientConfig = &tls.Config{RootCAs: uc.certPool}
+	rt.TLSClientConfig = &tls.Config{RootCAs: uc.certPool, MinVersion: tls.VersionTLS12}
 	rt.Dial = func(ctx context.Context, addr string, tlsCfg *tls.Config, cfg *quic.Config) (*quic.Conn, error) {
 		_, port, _ := net.SplitHostPort(addr)
 		// if we have a bootstrap ip set, use it to avoid DNS lookup
diff --git a/doh_test.go b/doh_test.go
index 92fa79f..b62ac76 100644
--- a/doh_test.go
+++ b/doh_test.go
@@ -196,6 +196,7 @@ func testTLSServer(t *testing.T, handler http.Handler) (*httptest.Server, *x509.
 	server := httptest.NewUnstartedServer(handler)
 	server.TLS = &tls.Config{
 		Certificates: []tls.Certificate{testCert.tlsCert},
+		MinVersion:   tls.VersionTLS12,
 	}
 	server.StartTLS()
 
@@ -232,6 +233,7 @@ func newTestHTTP3Server(t *testing.T, handler http.Handler) *testHTTP3Server {
 	tlsConfig := &tls.Config{
 		Certificates: []tls.Certificate{testCert.tlsCert},
 		NextProtos:   []string{"h3"}, // HTTP/3 protocol identifier
+		MinVersion:   tls.VersionTLS12,
 	}
 
 	// Create HTTP/3 server
diff --git a/doq.go b/doq.go
index 9729607..1aa1fb3 100644
--- a/doq.go
+++ b/doq.go
@@ -64,6 +64,7 @@ func newDOQConnPool(uc *UpstreamConfig, addrs []string) *doqConnPool {
 		NextProtos: []string{"doq"},
 		RootCAs:    uc.certPool,
 		ServerName: uc.Domain,
+		MinVersion: tls.VersionTLS12,
 	}
 
 	quicConfig := &quic.Config{
diff --git a/doq_test.go b/doq_test.go
index 14055dd..a6a1c54 100644
--- a/doq_test.go
+++ b/doq_test.go
@@ -99,6 +99,7 @@ func newTestQUICServer(t *testing.T) *testQUICServer {
 	tlsConfig := &tls.Config{
 		Certificates: []tls.Certificate{testCert.tlsCert},
 		NextProtos:   []string{"doq"},
+		MinVersion:   tls.VersionTLS12,
 	}
 
 	// Create QUIC listener
diff --git a/dot.go b/dot.go
index 654fa86..ff0aac2 100644
--- a/dot.go
+++ b/dot.go
@@ -64,7 +64,8 @@ func newDOTClientPool(uc *UpstreamConfig, addrs []string) *dotConnPool {
 	dialer := newDialer(net.JoinHostPort(controldPublicDns, "53"))
 
 	tlsConfig := &tls.Config{
-		RootCAs: uc.certPool,
+		RootCAs:    uc.certPool,
+		MinVersion: tls.VersionTLS12,
 	}
 
 	if uc.BootstrapIP != "" {
diff --git a/internal/certs/root_ca_test.go b/internal/certs/root_ca_test.go
index fcfd16e..295be56 100644
--- a/internal/certs/root_ca_test.go
+++ b/internal/certs/root_ca_test.go
@@ -11,7 +11,8 @@ func TestCACertPool(t *testing.T) {
 	c := &http.Client{
 		Transport: &http.Transport{
 			TLSClientConfig: &tls.Config{
-				RootCAs: CACertPool(),
+				RootCAs:    CACertPool(),
+				MinVersion: tls.VersionTLS12,
 			},
 		},
 		Timeout: 2 * time.Second,
diff --git a/internal/controld/config.go b/internal/controld/config.go
index 436d22d..181358c 100644
--- a/internal/controld/config.go
+++ b/internal/controld/config.go
@@ -293,7 +293,7 @@ func apiTransport(cdDev bool) *http.Transport {
 		return dial(ctx, "tcp6", addrsFromPort(apiIpsV6, port))
 	}
 	if router.Name() == ddwrt.Name || runtime.GOOS == "android" {
-		transport.TLSClientConfig = &tls.Config{RootCAs: certs.CACertPool()}
+		transport.TLSClientConfig = &tls.Config{RootCAs: certs.CACertPool(), MinVersion: tls.VersionTLS12}
 	}
 	return transport
 }