diff --git a/bogo/config.json.in b/bogo/config.json.in
index 04d406fbb..43ae390c3 100644
--- a/bogo/config.json.in
+++ b/bogo/config.json.in
@@ -264,8 +264,6 @@
     "RenegotiationInfo-Forbidden-TLS13": ":UNEXPECTED_EXTENSION:",
     "RequestContextInHandshake-TLS13": ":BAD_HANDSHAKE_MSG:",
     "Resume-Client-Mismatch-TLS13-TLS12-TLS": ":WRONG_CIPHER_RETURNED:",
-    "SecondServerHelloNoVersion-TLS13": ":WRONG_CIPHER_RETURNED:",
-    "SecondServerHelloWrongVersion-TLS13": ":INCOMPATIBLE:",
     "SendBogusAlertType": ":BAD_ALERT:",
     "SendInvalidRecordType": ":GARBAGE:",
     "SendPostHandshakeChangeCipherSpec-TLS13": ":ILLEGAL_MIDDLEBOX_CHANGE_CIPHER_SPEC:",
diff --git a/bogo/src/main.rs b/bogo/src/main.rs
index 2b273eae6..c8736cf29 100644
--- a/bogo/src/main.rs
+++ b/bogo/src/main.rs
@@ -1008,6 +1008,9 @@ fn handle_err(opts: &Options, err: Error) -> ! {
         Error::PeerMisbehaved(PeerMisbehaved::SelectedDifferentCipherSuiteAfterRetry) => {
             quit(":SELECTED_DIFFERENT_CIPHERSUITE_AFTER_RETRY:")
         }
+        Error::PeerMisbehaved(PeerMisbehaved::SelectedDifferentProtocolVersionAfterRetry) => {
+            quit(":SECOND_SERVERHELLO_VERSION_MISMATCH:")
+        }
         Error::PeerMisbehaved(
             PeerMisbehaved::ResumptionAttemptedWithVariedEms
             | PeerMisbehaved::ResumptionOfferedWithVariedEms,
diff --git a/rustls/src/client/hs.rs b/rustls/src/client/hs.rs
index 75c185992..22af16822 100644
--- a/rustls/src/client/hs.rs
+++ b/rustls/src/client/hs.rs
@@ -215,6 +215,11 @@ impl ExpectServerHello {
         )?;
         trace!("We got ServerHello {server_hello:#?}");
 
+        // HelloRetryRequest selected TLS 1.3, so ServerHello must retain it.
+        if self.done_retry && server_hello.selected_version != Some(ProtocolVersion::TLSv1_3) {
+            return Err(PeerMisbehaved::SelectedDifferentProtocolVersionAfterRetry.into());
+        }
+
         let config = &self.input.config;
 
         let server_version = if server_hello.legacy_version == ProtocolVersion::TLSv1_2 {
diff --git a/rustls/src/error/mod.rs b/rustls/src/error/mod.rs
index 040b9ee94..ba4434c37 100644
--- a/rustls/src/error/mod.rs
+++ b/rustls/src/error/mod.rs
@@ -1224,6 +1224,7 @@ pub enum PeerMisbehaved {
     ResumptionOfferedWithVariedEms,
     ResumptionOfferedWithIncompatibleCipherSuite,
     SelectedDifferentCipherSuiteAfterRetry,
+    SelectedDifferentProtocolVersionAfterRetry,
     SelectedInvalidPsk,
     SelectedTls12UsingTls13VersionExtension,
     SelectedUnofferedApplicationProtocol,