diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,7 @@
+## Version 1.5.6
+
+- Dynamically setting enctypted extensions [#444](https://github.com/vincenthz/hs-tls/pull/444)
+
 ## Version 1.5.5
 
 - QUIC support
diff --git a/Network/TLS/Handshake/Server.hs b/Network/TLS/Handshake/Server.hs
--- a/Network/TLS/Handshake/Server.hs
+++ b/Network/TLS/Handshake/Server.hs
@@ -942,7 +942,8 @@
                                    ,sniExtension
                                    ]
                       ++ protoExt
-        loadPacket13 ctx $ Handshake13 [EncryptedExtensions13 extensions]
+        extensions' <- liftIO $ onEncryptedExtensionsCreating (serverHooks sparams) extensions
+        loadPacket13 ctx $ Handshake13 [EncryptedExtensions13 extensions']
 
     sendNewSessionTicket applicationSecret sfSentTime = when sendNST $ do
         cfRecvTime <- getCurrentTimeFromBase
diff --git a/Network/TLS/Parameters.hs b/Network/TLS/Parameters.hs
--- a/Network/TLS/Parameters.hs
+++ b/Network/TLS/Parameters.hs
@@ -612,6 +612,11 @@
       --
       -- Default: 'Nothing'
     , onALPNClientSuggest     :: Maybe ([B.ByteString] -> IO B.ByteString)
+      -- | Allow to modify extensions to be sent in EncryptedExtensions
+      --  of TLS 1.3.
+      --
+      -- Default: 'return . id'
+    , onEncryptedExtensionsCreating :: [ExtensionRaw] -> IO [ExtensionRaw]
     }
 
 defaultServerHooks :: ServerHooks
@@ -622,6 +627,7 @@
     , onServerNameIndication = \_ -> return mempty
     , onNewHandshake         = \_ -> return True
     , onALPNClientSuggest    = Nothing
+    , onEncryptedExtensionsCreating = return . id
     }
 
 instance Show ServerHooks where
diff --git a/Network/TLS/Struct.hs b/Network/TLS/Struct.hs
--- a/Network/TLS/Struct.hs
+++ b/Network/TLS/Struct.hs
@@ -255,6 +255,7 @@
 showEID 0x31 = "PostHandshakeAuth"
 showEID 0x32 = "SignatureAlgorithmsCert"
 showEID 0x33 = "KeyShare"
+showEID 0x39 = "QuicTransportParameters"
 showEID 0xff01 = "SecureRenegotiation"
 showEID 0xffa5 = "QuicTransportParameters"
 showEID x      = show x
diff --git a/tls.cabal b/tls.cabal
--- a/tls.cabal
+++ b/tls.cabal
@@ -1,5 +1,5 @@
 Name:                tls
-Version:             1.5.5
+Version:             1.5.6
 Description:
    Native Haskell TLS and SSL protocol implementation for server and client.
    .