diff --git a/packages/web/src/Server.zig b/packages/web/src/Server.zig
index 8105d80..2ed0c3b 100644
--- a/packages/web/src/Server.zig
+++ b/packages/web/src/Server.zig
@@ -361,6 +361,10 @@ fn maybeInitSsl(self: *const Server, fd: FileDescriptor) !?*openssl.Ssl {
         log.debug("Accepting SSL layer.", .{});
         try ssl.accept();
         log.debug("Accepted SSL layer.", .{});
+        const opt = std.mem.toBytes(@as(c_int, 1));
+        if (fd.setsockopt(linux.SOL.TLS, 3, &opt)) { // TLS_TX_ZEROCOPY_RO
+            log.debug("Enabled zero-copy on sendfile.", .{});
+        } else |_| {}
         return ssl;
     } else {
         return null;
diff --git a/packages/web/src/main.zig b/packages/web/src/main.zig
index ae5a46b..445d21d 100644
--- a/packages/web/src/main.zig
+++ b/packages/web/src/main.zig
@@ -88,8 +88,13 @@ pub fn main(init: std.process.Init) !void {
     const ssl_ctx = try ssl.SslContext.new(.tlsServerMethod());
     defer ssl_ctx.free();
 
-    _ = ssl_ctx.setMinProtoVersion(ssl.c_ssl.TLS1_3_VERSION);
-    _ = ssl_ctx.setOptions(ssl.c_ssl.SSL_OP_NO_SSLv3 | ssl.c_ssl.SSL_OP_NO_TLSv1 | ssl.c_ssl.SSL_OP_NO_TLSv1_1 | ssl.c_ssl.SSL_OP_NO_TLSv1_2);
+    _ = ssl_ctx.setMinProtoVersion(ssl.c_ssl.TLS1_2_VERSION);
+    _ = ssl_ctx.setMaxProtoVersion(ssl.c_ssl.TLS1_2_VERSION);
+    _ = ssl_ctx.setOptions(ssl.c_ssl.SSL_OP_NO_SSLv3 |
+        ssl.c_ssl.SSL_OP_NO_TLSv1 |
+        ssl.c_ssl.SSL_OP_NO_TLSv1_1 |
+        ssl.c_ssl.SSL_OP_NO_TLSv1_3 |
+        ssl.c_ssl.SSL_OP_ENABLE_KTLS);
 
     try ssl_ctx.useCertificateFile("cert.pem", ssl.c_ssl.SSL_FILETYPE_PEM);
     try ssl_ctx.usePrivateKeyFile("key.pem", ssl.c_ssl.SSL_FILETYPE_PEM);