diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,14 @@
 # ChangeLog
 
+## 3.4.16
+
+`tlsEarlyDataSize` defaults to 0, so 0-RTT is off unless a server asks for
+it: a request in early data is replayable and warp-tls has no RFC 8470
+handling.
+
+* Let a server say how much TLS early data it accepts.
+  [#1145](https://github.com/yesodweb/wai/pull/1145)
+
 ## 3.4.15
 
 * The first read of a connection is given up on when the handshake
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -47,6 +47,7 @@
     tlsServerDHEParams,
     tlsSessionManagerConfig,
     tlsSessionManager,
+    tlsEarlyDataSize,
     onInsecure,
     OnInsecure (..),
 
@@ -314,7 +315,7 @@
             , TLS.serverShared = shared
             , TLS.serverSupported = supported
 #if MIN_VERSION_tls(1,5,0)
-            , TLS.serverEarlyDataSize = 2018
+            , TLS.serverEarlyDataSize = tlsEarlyDataSize
 #endif
             }
     -- Adding alpn to user's tlsServerHooks.
diff --git a/Network/Wai/Handler/WarpTLS/Internal.hs b/Network/Wai/Handler/WarpTLS/Internal.hs
--- a/Network/Wai/Handler/WarpTLS/Internal.hs
+++ b/Network/Wai/Handler/WarpTLS/Internal.hs
@@ -124,6 +124,16 @@
     -- priority. See the "Network.TLS" module for details
     --
     --   Since 3.3.3
+    , tlsEarlyDataSize :: Int
+    -- ^ The largest TLS 1.3 early data this server accepts, 0 for none.
+    -- A request sent in early data can be replayed by anyone who
+    -- recorded it, and warp-tls does nothing about that: it has no RFC
+    -- 8470 handling and no 425 response. So 0-RTT is off unless this
+    -- says otherwise.
+    --
+    -- Default: 0
+    --
+    --   Since 3.4.16
     }
 
 -- Since 3.3.1
@@ -154,6 +164,7 @@
         , tlsCredentials = Nothing
         , tlsSessionManager = Nothing
         , tlsSupportedHashSignatures = TLS.supportedHashSignatures TLS.defaultSupported
+        , tlsEarlyDataSize = 0
         }
 
 -- taken from stunnel example in tls-extra
diff --git a/test/Spec.hs b/test/Spec.hs
--- a/test/Spec.hs
+++ b/test/Spec.hs
@@ -16,21 +16,28 @@
 import Test.Hspec
 
 main :: IO ()
-main = hspec $ describe "pre-TLS exception peer (#1113)" $ do
-    it "attributes sequential plaintext and premature-close failures to their sockets" $
-        exercise [1, 1] False
-    it "attributes concurrent plaintext and premature-close failures to their sockets" $
-        exercise [1, 1] True
+main = hspec $ do
+    describe "early data" $
+        -- A request in early data is replayable and warp-tls has no RFC
+        -- 8470 handling, so 0-RTT is off until a server asks for it.
+        it "is not accepted unless asked for" $
+            TLS.tlsEarlyDataSize TLS.defaultTlsSettings `shouldBe` 0
 
-    -- Linux provides the whole 127/8 loopback range without interface aliases.
-    -- Keep the original two-IP regression there; other platforms still check
-    -- exact socket addresses (including source ports) above. The maker tests
-    -- additionally check distinct IPs without binding sockets on every platform.
-    when (os == "linux") $ do
-        it "attributes sequential failures from distinct loopback IPs" $
-            exercise [1, 2] False
-        it "attributes concurrent failures from distinct loopback IPs" $
-            exercise [1, 2] True
+    describe "pre-TLS exception peer (#1113)" $ do
+        it "attributes sequential plaintext and premature-close failures to their sockets" $
+            exercise [1, 1] False
+        it "attributes concurrent plaintext and premature-close failures to their sockets" $
+            exercise [1, 1] True
+
+        -- Linux provides the whole 127/8 loopback range without interface aliases.
+        -- Keep the original two-IP regression there; other platforms still check
+        -- exact socket addresses (including source ports) above. The maker tests
+        -- additionally check distinct IPs without binding sockets on every platform.
+        when (os == "linux") $ do
+            it "attributes sequential failures from distinct loopback IPs" $
+                exercise [1, 2] False
+            it "attributes concurrent failures from distinct loopback IPs" $
+                exercise [1, 2] True
 
 -- These regressions deliberately leave Warp's accept and fork hooks alone.
 -- Keep both peers and failure kinds when changing the exception observer.
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.4.15
+Version:             3.4.16
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE