diff --git a/go.mod b/go.mod
index 4333e56e3650626017bc4f3e50c7ff9a49f6c276..798d5bf0339a1c9fd126416e16e7a08c4ee4b631 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module git.autistici.org/id/keystore
 go 1.15
 
 require (
-	git.autistici.org/ai3/go-common v0.0.0-20221125154433-06304016b1da
+	git.autistici.org/ai3/go-common v0.0.0-20230201225947-3ffd6ec2b357
 	git.autistici.org/id/go-sso v0.0.0-20221216110623-a98dfc78fec5
 	github.com/coreos/go-systemd/v22 v22.5.0
 	github.com/go-ldap/ldap/v3 v3.4.4
@@ -12,5 +12,6 @@ require (
 	github.com/mattn/go-sqlite3 v1.14.16
 	github.com/prometheus/client_golang v1.12.2
 	golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
+	golang.org/x/sync v0.1.0
 	gopkg.in/yaml.v3 v3.0.1
 )
diff --git a/go.sum b/go.sum
index 714c2c242b86b9cef9d3cb1c520e0854921c3aae..929dea8d318d5d4c9f8467126ed46bf358487cba 100644
--- a/go.sum
+++ b/go.sum
@@ -64,6 +64,8 @@ git.autistici.org/ai3/go-common v0.0.0-20220912095004-9a984189694c h1:2pWrPn8FRa
 git.autistici.org/ai3/go-common v0.0.0-20220912095004-9a984189694c/go.mod h1:E//kc9AgsYrMeaF/eKqNxESnQHEW4Dif0sODQA3Osi4=
 git.autistici.org/ai3/go-common v0.0.0-20221125154433-06304016b1da h1:fizdAjFv2vWz+83IoeRW2L0Shyo3dDquXyQKWRGs4jc=
 git.autistici.org/ai3/go-common v0.0.0-20221125154433-06304016b1da/go.mod h1:FTGqOGPpuoFg7TiHshYCyp5j1Ab3ek0J0KcS++vEjxw=
+git.autistici.org/ai3/go-common v0.0.0-20230201225947-3ffd6ec2b357 h1:kXIwZ3SJ8r2dvBMAnuQ8QbDiR651rg/O150iTRxKkcA=
+git.autistici.org/ai3/go-common v0.0.0-20230201225947-3ffd6ec2b357/go.mod h1:FTGqOGPpuoFg7TiHshYCyp5j1Ab3ek0J0KcS++vEjxw=
 git.autistici.org/id/auth v0.0.0-20210308184238-f16e8b49025a/go.mod h1:hBHeDUrpFwhpP3HUFOglAYNEnrNzf0tN66VJTz+pw5Y=
 git.autistici.org/id/go-sso v0.0.0-20181118174541-ad4e62357912 h1:1amb0pZr7c44TXSpFyb8q4J1+Ie+l7K1hYuXVD4zFrY=
 git.autistici.org/id/go-sso v0.0.0-20181118174541-ad4e62357912/go.mod h1:B9omXX7rw0qgWdBoF4RZnM7clwEVejoAe8oNJWETBZ0=
diff --git a/vendor/git.autistici.org/ai3/go-common/serverutil/tls.go b/vendor/git.autistici.org/ai3/go-common/serverutil/tls.go
index 21c002b8baaae892f04f481b84a23e1aa7a34067..b81b0470dc296240ac81c734791e080f8b5416dd 100644
--- a/vendor/git.autistici.org/ai3/go-common/serverutil/tls.go
+++ b/vendor/git.autistici.org/ai3/go-common/serverutil/tls.go
@@ -123,6 +123,7 @@ func (c *TLSServerConfig) TLSConfig() (*tls.Config, error) {
 		CipherSuites:             serverCiphers,
 		MinVersion:               tls.VersionTLS12,
 		PreferServerCipherSuites: true,
+		NextProtos:               []string{"h2", "http/1.1"},
 	}
 
 	// Require client certificates if a CA is specified.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index dfaf0384e0d844b9c380b261ae112d5bd6440ada..46a566857ca5e427e6026e6161e008f631468365 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,6 +1,6 @@
 # cloud.google.com/go v0.81.0
 cloud.google.com/go/compute/metadata
-# git.autistici.org/ai3/go-common v0.0.0-20221125154433-06304016b1da
+# git.autistici.org/ai3/go-common v0.0.0-20230201225947-3ffd6ec2b357
 ## explicit
 git.autistici.org/ai3/go-common
 git.autistici.org/ai3/go-common/clientutil
@@ -442,6 +442,7 @@ golang.org/x/oauth2/internal
 golang.org/x/oauth2/jws
 golang.org/x/oauth2/jwt
 # golang.org/x/sync v0.1.0
+## explicit
 golang.org/x/sync/singleflight
 # golang.org/x/sys v0.0.0-20220114195835-da31bd327af9
 golang.org/x/sys/cpu