diff --git a/cbits/setcap.c b/cbits/setcap.c
deleted file mode 100644
--- a/cbits/setcap.c
+++ /dev/null
@@ -1,53 +0,0 @@
-#if defined(__linux__)
-#include <linux/securebits.h>
-#include <signal.h>
-#include <stdio.h>
-#include <string.h>
-#include <sys/capability.h>
-#include <sys/prctl.h>
-#include <sys/syscall.h>
-#include <sys/types.h>
-#include <unistd.h>
-
-#include "Rts.h"
-
-void set_capabilities (uint32_t cap) {
-  cap_user_header_t header = malloc(sizeof(*header));
-  header->version = _LINUX_CAPABILITY_VERSION_3;
-  header->pid = 0;
-
-  cap_user_data_t data = malloc(sizeof(*data));
-  data->effective   = cap;
-  data->permitted   = cap;
-  data->inheritable = 0;
-
-  capset(header,data);
-
-  free(header);
-  free(data);
-}
-
-void handler(int signum) {
-  uint32_t cap = 1 << CAP_NET_BIND_SERVICE;
-  set_capabilities (cap);
-}
-
-void FlagDefaultsHook () {
-  if (geteuid() == 0) {
-    prctl(PR_SET_SECUREBITS, SECBIT_KEEP_CAPS, 0L, 0L, 0L);
-
-    struct sigaction sa;
-    memset(&sa, 0, sizeof(sa));
-    sa.sa_handler = handler;
-    sa.sa_flags = SA_RESTART;
-    sigaction(SIGUSR1, &sa, NULL);
-  }
-}
-
-void send_signal (int tid, int sig) {
-  int tgid = getpid();
-  syscall(SYS_tgkill, tgid, tid, sig);
-}
-#else
-void send_signal (int tid, int sig) {}
-#endif
diff --git a/mighttpd2.cabal b/mighttpd2.cabal
--- a/mighttpd2.cabal
+++ b/mighttpd2.cabal
@@ -1,6 +1,6 @@
 cabal-version:      >=1.10
 name:               mighttpd2
-version:            4.0.6
+version:            4.0.7
 license:            BSD3
 license-file:       LICENSE
 maintainer:         Kazu Yamamoto <kazu@iij.ad.jp>
@@ -134,10 +134,6 @@
             async,
             base16-bytestring
 
-        if os(linux)
-            cpp-options: -DDROP_EXCEPT_BIND
-            c-sources:   cbits/setcap.c
-
     if flag(dhall)
         cpp-options:   -DDHALL
         build-depends: dhall
@@ -149,8 +145,8 @@
 
     if flag(quic)
         build-depends:
-            quic,
-            warp-quic
+            quic >= 0.2 && < 0.3,
+            warp-quic >= 0.0.1
 
     if impl(ghc >=8)
         default-extensions: Strict StrictData
diff --git a/src/Server.hs b/src/Server.hs
--- a/src/Server.hs
+++ b/src/Server.hs
@@ -9,7 +9,7 @@
 import Control.Monad (unless, when)
 import Data.Either (fromRight)
 import qualified Data.ByteString.Char8 as BS
-import Data.Streaming.Network (bindPortTCP)
+import Data.Streaming.Network (bindPortTCP, bindPortUDP)
 import qualified Network.HTTP.Client as H
 import Network.Socket (Socket, close)
 import Network.Wai.Application.Classic hiding ((</>))
@@ -41,13 +41,7 @@
 import Data.Maybe (fromJust)
 import qualified Network.QUIC.Internal as Q
 import Network.Wai.Handler.WarpQUIC
-#ifdef DROP_EXCEPT_BIND
-import Control.Monad (forM_)
-import Foreign.C.Types (CInt(..))
-import System.Directory (listDirectory)
-import System.Posix.Signals (sigUSR1)
 #endif
-#endif
 #else
 data Credentials
 data SessionManager
@@ -85,9 +79,6 @@
     tmgr <- T.initialize (naturalToInt (opt_connection_timeout opt) * 1000000)
     (mcred, smgr) <- setup opt
     _changed <- setGroupUser (opt_user opt) (opt_group opt)
-#ifdef DROP_EXCEPT_BIND
-    when _changed dropExceptBind
-#endif
     logCheck logtype
     (zdater,_) <- clockDateCacher
     ap <- initLogger FromSocket logtype zdater
@@ -187,7 +178,7 @@
         (runSettingsSocket setting s1 app)
         (runTLSSocket tlsSetting setting s2 app)
 #ifdef HTTP_OVER_QUIC
-    QUIC s1 s2 -> do
+    QUIC s1 s2 s3 -> do
         let quicPort' = BS.pack $ show quicPort
             strver Q.Version1 = ""
             strver Q.Version2 = ""
@@ -198,7 +189,7 @@
             settingT = setAltSvc altsvc setting
         mapConcurrently_ id [runSettingsSocket        setting  s1 app
                             ,runTLSSocket  tlsSetting settingT s2 app
-                            ,runQUIC       qconf      setting     app
+                            ,runQUICSocket qconf      setting  s3 app
                             ]
 #else
     _ -> error "never reach"
@@ -281,7 +272,7 @@
 data Service = HttpOnly Socket
              | HttpsOnly Socket
              | HttpAndHttps Socket Socket
-             | QUIC Socket Socket
+             | QUIC Socket Socket Socket
 
 instance Show Service where
     show HttpOnly{}     = "HttpOnly"
@@ -306,10 +297,11 @@
   | service == 3 = do
       s1 <- bindPortTCP httpPort hostpref
       s2 <- bindPortTCP httpsPort hostpref
+      s3 <- bindPortUDP quicPort hostpref
       debugMessage $ urlForHTTP httpPort
       debugMessage $ urlForHTTPS httpsPort
       debugMessage "QUIC is also available via Alt-Svc"
-      return $ QUIC s1 s2
+      return $ QUIC s1 s2 s3
   | otherwise = do
       s <- bindPortTCP httpPort hostpref
       debugMessage $ urlForHTTP httpPort
@@ -317,6 +309,7 @@
   where
     httpPort  = naturalToInt $ opt_port opt
     httpsPort = naturalToInt $ opt_tls_port opt
+    quicPort = naturalToInt $ opt_quic_port opt
     hostpref  = fromString $ opt_host opt
     service = opt_service opt
     debug = opt_debug_mode opt
@@ -335,7 +328,7 @@
 closeService (HttpOnly s)         = close s
 closeService (HttpsOnly s)        = close s
 closeService (HttpAndHttps s1 s2) = close s1 >> close s2
-closeService (QUIC s1 s2)         = close s1 >> close s2
+closeService (QUIC s1 s2 s3)      = close s1 >> close s2 >> close s3
 
 ----------------------------------------------------------------
 
@@ -350,18 +343,6 @@
     responseTimeout
       | opt_proxy_timeout opt == 0 = H.managerResponseTimeout H.defaultManagerSettings
       | otherwise                  = H.responseTimeoutMicro (naturalToInt $ opt_proxy_timeout opt * 1000000) -- micro seconds
-
-#ifdef DROP_EXCEPT_BIND
-foreign import ccall unsafe "send_signal"
-  c_send_signal :: CInt -> CInt -> IO ()
-
-dropExceptBind :: IO ()
-dropExceptBind = do
-    pid <- getProcessID
-    strtids <- listDirectory ("/proc/" ++ show pid ++ "/task")
-    let tids = map read strtids :: [Int]
-    forM_ tids $ \tid -> c_send_signal (fromIntegral tid) sigUSR1
-#endif
 
 ----------------------------------------------------------------