diff --git a/implementations/python/tests/test_issue_1217_bootstrap_profiles.py b/implementations/python/tests/test_issue_1217_bootstrap_profiles.py
index ab7512a63..2d8bcdffa 100644
--- a/implementations/python/tests/test_issue_1217_bootstrap_profiles.py
+++ b/implementations/python/tests/test_issue_1217_bootstrap_profiles.py
@@ -196,6 +196,7 @@ def test_curl_qualification_uses_fixed_hardened_argv() -> None:
     assert argv[:2] == ["/usr/bin/curl", "--disable"]
     assert argv[argv.index("--proto") : argv.index("--proto") + 2] == ["--proto", "=https"]
     assert argv[argv.index("--proto-redir") : argv.index("--proto-redir") + 2] == ["--proto-redir", "=https"]
+    assert [arg for arg in argv if arg.startswith("--http")] == ["--http1.1"]
     assert "--insecure" not in argv
     assert "--location-trusted" not in argv
     assert "--retry-all-errors" not in argv
@@ -859,6 +860,9 @@ def _https_fixture(tmp_path: Path) -> tuple[ThreadingHTTPServer, Path]:
     context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
     context.minimum_version = ssl.TLSVersion.TLSv1_2
     context.load_cert_chain(cert_path, key_path)
+    # Offer HTTP/2 first, as most download hosts do (#1475). http.server speaks only HTTP/1.x, so a client that
+    # accepted h2 would fail every transfer here.
+    context.set_alpn_protocols(["h2", "http/1.1"])
     server.socket = context.wrap_socket(server.socket, server_side=True)
     threading.Thread(target=server.serve_forever, daemon=True).start()
     return server, cert_path
diff --git a/specs/formal/participant-semantics/participant-opacity-proof-evidence.json b/specs/formal/participant-semantics/participant-opacity-proof-evidence.json
index c45029c26..434a2f029 100644
--- a/specs/formal/participant-semantics/participant-opacity-proof-evidence.json
+++ b/specs/formal/participant-semantics/participant-opacity-proof-evidence.json
@@ -301,7 +301,7 @@
       },
       {
         "path": "tools/maintained_client_acquisition.py",
-        "digest": "sha256:b8a538c975f054216cb54cb3f68163aa5dab642bc368a94db5d343732a67101a"
+        "digest": "sha256:0529ca32a87d33aeca570d659dec8d12d7f3227d38726077a39f344f7cbf2dc0"
       },
       {
         "path": "tools/tooling_installed_tree.py",
diff --git a/tools/maintained_client_acquisition.py b/tools/maintained_client_acquisition.py
index 1235768ed..92276980a 100644
--- a/tools/maintained_client_acquisition.py
+++ b/tools/maintained_client_acquisition.py
@@ -141,6 +141,9 @@ def curl_transfer_argv(
         "=https",
         "--proto-redir",
         "=https",
+        # Qualification covers HTTP/1.1. Over HTTP/2, macOS curl 8.7.1 exits 56 for a size
+        # breach and does not retry a 503 (#1475).
+        "--http1.1",
         "--max-redirs",
         "5",
         "--retry",