diff --git a/crates/openshell-isolation-interface/src/linux/child_seccomp.rs b/crates/openshell-isolation-interface/src/linux/child_seccomp.rs
index b73fbf35c..a895e2e65 100644
--- a/crates/openshell-isolation-interface/src/linux/child_seccomp.rs
+++ b/crates/openshell-isolation-interface/src/linux/child_seccomp.rs
@@ -193,6 +193,7 @@ pub fn prepare(sandbox_tgid: u32) -> io::Result<ChildHardeningProgram> {
     for syscall in [
         libc::SYS_prlimit64,
         libc::SYS_sched_setaffinity,
+        libc::SYS_sched_setattr,
         libc::SYS_sched_setparam,
         libc::SYS_sched_setscheduler,
     ] {
@@ -418,6 +419,18 @@ mod tests {
             {
                 unsafe { libc::_exit(5) };
             }
+            if unsafe {
+                libc::syscall(
+                    libc::SYS_sched_setattr,
+                    sandbox_tgid,
+                    std::ptr::null::<libc::c_void>(),
+                    0,
+                )
+            } != -1
+                || io::Error::last_os_error().raw_os_error() != Some(libc::EPERM)
+            {
+                unsafe { libc::_exit(11) };
+            }
             if unsafe { libc::fcntl(libc::STDIN_FILENO, libc::F_SETOWN, sandbox_tgid) } != -1
                 || io::Error::last_os_error().raw_os_error() != Some(libc::EPERM)
             {
diff --git a/crates/openshell-sandbox-backend/src/runtime.rs b/crates/openshell-sandbox-backend/src/runtime.rs
index 2927312ff..e9b9eb1a9 100644
--- a/crates/openshell-sandbox-backend/src/runtime.rs
+++ b/crates/openshell-sandbox-backend/src/runtime.rs
@@ -235,7 +235,7 @@ fn tls_client_config(tls: &BoundaryClientTls) -> Result<rustls::ClientConfig, Ba
                 "supervisor TLS private-key PEM contains no private key".to_string(),
             )
         })?;
-    rustls::ClientConfig::builder()
+    rustls::ClientConfig::builder_with_protocol_versions(&[&rustls::version::TLS13])
         .with_root_certificates(roots)
         .with_client_auth_cert(certificate_chain, private_key)
         .map_err(|error| {
@@ -1733,6 +1733,12 @@ mod tests {
     }
 
     fn test_certificate() -> TestCertificate {
+        test_certificate_with_protocol_versions(&[&rustls::version::TLS13])
+    }
+
+    fn test_certificate_with_protocol_versions(
+        protocol_versions: &[&'static rustls::SupportedProtocolVersion],
+    ) -> TestCertificate {
         let _ = rustls::crypto::ring::default_provider().install_default();
         let material = generate_boundary_mutual_tls_material().expect("generate test material");
         let certificates = rustls_pemfile::certs(&mut material.sandbox_certificate_pem.as_bytes())
@@ -1752,7 +1758,7 @@ mod tests {
         let verifier = rustls::server::WebPkiClientVerifier::builder(Arc::new(client_roots))
             .build()
             .expect("build client verifier");
-        let server_config = rustls::ServerConfig::builder()
+        let server_config = rustls::ServerConfig::builder_with_protocol_versions(protocol_versions)
             .with_client_cert_verifier(verifier)
             .with_single_cert(certificates, private_key)
             .expect("build test TLS server config");
@@ -2015,6 +2021,27 @@ mod tests {
         server.abort();
     }
 
+    #[tokio::test]
+    async fn tls_tcp_rejects_tls12_only_server() {
+        let certificate = test_certificate_with_protocol_versions(&[&rustls::version::TLS12]);
+        let (address, server) = spawn_tls_boundary(certificate.server_config, "a".repeat(32)).await;
+        let client_config = tls_client_config(&certificate.client_tls).expect("client TLS config");
+        let server_name =
+            rustls::pki_types::ServerName::try_from(certificate.client_tls.server_name.clone())
+                .expect("server name");
+        let stream = tokio::net::TcpStream::connect(address)
+            .await
+            .expect("connect to TLS test server");
+
+        assert!(
+            tokio_rustls::TlsConnector::from(Arc::new(client_config))
+                .connect(server_name, stream)
+                .await
+                .is_err()
+        );
+        server.await.expect("TLS test server task");
+    }
+
     #[tokio::test]
     async fn exec_wait_survives_output_loss_and_reattachment() {
         let certificate = test_certificate();