diff --git a/haproxy/haproxy.cfg b/haproxy/haproxy.cfg
index 3d18042..7f2f9c4 100644
--- a/haproxy/haproxy.cfg
+++ b/haproxy/haproxy.cfg
@@ -1,10 +1,11 @@
 global
     log stderr local0 err
     maxconn 4096
-    # Performance tuning
-    tune.ssl.default-dh-param 2048
+    # TLS configuration optimized for Cloudflare-to-origin connections
+    ssl-default-bind-curves X25519:prime256v1:secp384r1
+    ssl-default-bind-ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384
     ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256
-    ssl-default-bind-options prefer-client-ciphers no-sslv3 no-tlsv10 no-tlsv11
+    ssl-default-bind-options prefer-client-ciphers ssl-min-ver TLSv1.2 no-tls-tickets
 
 defaults
     log     global
@@ -18,7 +19,7 @@ defaults
     timeout http-keep-alive 5s
 
 frontend https_in
-    bind *:443 ssl crt /etc/haproxy/certs/origin.pem alpn h2,http/1.1
+    bind *:443 ssl crt /etc/haproxy/certs/origin.pem alpn h2,http/1.1 strict-sni
 
     # Gzip compression
     compression algo gzip