diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,6 +1,22 @@
-## 3.2.4.1
+## 3.2.5
 
+* When tls 1.5.0 is available, TLS 1.3 is automatically supported.
+
+## 3.2.4.3
+
+* Using warp >= 3.2.17.
+
+## 3.2.4.2
+
 * Ignore socket errors while sending `close_notify` [#640](https://github.com/yesodweb/wai/issues/640)
+
+## 3.2.4
+
+* Using tls-session-manager.
+
+## 3.2.3
+
+* Stop using obsoleted APIs of network.
 
 ## 3.2.2
 
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -90,19 +90,37 @@
     --
     -- Since 1.4.0
   , tlsAllowedVersions :: [TLS.Version]
+#if MIN_VERSION_tls(1,5,0)
     -- ^ The TLS versions this server accepts.
     --
     -- >>> tlsAllowedVersions defaultTlsSettings
+    -- [TLS13,TLS12,TLS11,TLS10]
+    --
+    -- Since 1.4.2
+#else
+    -- ^ The TLS versions this server accepts.
+    --
+    -- >>> tlsAllowedVersions defaultTlsSettings
     -- [TLS12,TLS11,TLS10]
     --
     -- Since 1.4.2
+#endif
   , tlsCiphers :: [TLS.Cipher]
+#if MIN_VERSION_tls(1,5,0)
     -- ^ The TLS ciphers this server accepts.
     --
     -- >>> tlsCiphers defaultTlsSettings
+    -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1,AES128GCM-SHA256,AES256GCM-SHA384]
+    --
+    -- Since 1.4.2
+#else
+    -- ^ The TLS ciphers this server accepts.
+    --
+    -- >>> tlsCiphers defaultTlsSettings
     -- [ECDHE-ECDSA-AES256GCM-SHA384,ECDHE-ECDSA-AES128GCM-SHA256,ECDHE-RSA-AES256GCM-SHA384,ECDHE-RSA-AES128GCM-SHA256,DHE-RSA-AES256GCM-SHA384,DHE-RSA-AES128GCM-SHA256,ECDHE-ECDSA-AES256CBC-SHA384,ECDHE-RSA-AES256CBC-SHA384,DHE-RSA-AES256-SHA256,ECDHE-ECDSA-AES256CBC-SHA,ECDHE-RSA-AES256CBC-SHA,DHE-RSA-AES256-SHA1,RSA-AES256GCM-SHA384,RSA-AES256-SHA256,RSA-AES256-SHA1]
     --
     -- Since 1.4.2
+#endif
   , tlsWantClientCert :: Bool
     -- ^ Whether or not to demand a certificate from the client.  If this
     -- is set to True, you must handle received certificates in a server hook
@@ -149,7 +167,11 @@
   , keyMemory = Nothing
   , onInsecure = DenyInsecure "This server only accepts secure HTTPS connections."
   , tlsLogging = def
+#if MIN_VERSION_tls(1,5,0)
+  , tlsAllowedVersions = [TLS.TLS13,TLS.TLS12,TLS.TLS11,TLS.TLS10]
+#else
   , tlsAllowedVersions = [TLS.TLS12,TLS.TLS11,TLS.TLS10]
+#endif
   , tlsCiphers = ciphers
   , tlsWantClientCert = False
   , tlsServerHooks = def
@@ -264,6 +286,9 @@
       , TLS.serverHooks          = hooks
       , TLS.serverShared         = shared
       , TLS.serverSupported      = supported
+#if MIN_VERSION_tls(1,5,0)
+      , TLS.serverEarlyDataSize  = 2018
+#endif
       }
     -- Adding alpn to user's tlsServerHooks.
     hooks = tlsServerHooks {
@@ -282,6 +307,9 @@
       , TLS.supportedClientInitiatedRenegotiation = False
       , TLS.supportedSession             = True
       , TLS.supportedFallbackScsv        = True
+#if MIN_VERSION_tls(1,5,0)
+      , TLS.supportedGroups              = [TLS.X25519,TLS.P256,TLS.P384]
+#endif
       }
 
 alpn :: [S.ByteString] -> IO S.ByteString
@@ -427,6 +455,9 @@
                     TLS.TLS10 -> (3,1)
                     TLS.TLS11 -> (3,2)
                     TLS.TLS12 -> (3,3)
+#if MIN_VERSION_tls(1,5,0)
+                    TLS.TLS13 -> (3,4)
+#endif
             return TLS {
                 tlsMajorVersion = major
               , tlsMinorVersion = minor
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.2.4.3
+Version:             3.2.5
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE