diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # ChangeLog
 
+## 3.4.10
+
+* Removed `data-default` dependency entirely. Does now require `>= tls-2.1.3`.
+  [#1011](https://github.com/yesodweb/wai/pull/1011)
+
 ## 3.4.9
 
 * Using `timeout` for `handshake` to prevent thread leaks.
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -59,7 +59,6 @@
 import Control.Monad (guard, void)
 import qualified Data.ByteString as S
 import qualified Data.ByteString.Lazy as L
-import Data.Default (def)
 import qualified Data.IORef as I
 import Data.Streaming.Network (bindPortTCP, safeRecv)
 import Data.Typeable (Typeable)
@@ -259,7 +258,7 @@
   where
     get = getter tlsset set sock params
     params =
-        def -- TLS.ServerParams
+        TLS.defaultParamsServer
             { TLS.serverWantClientCert = tlsWantClientCert
             , TLS.serverCACertificates = []
             , TLS.serverDHEParams = tlsServerDHEParams
@@ -278,12 +277,12 @@
                     <|> (if settingsHTTP2Enabled set then Just alpn else Nothing)
             }
     shared =
-        def
+        TLS.defaultShared
             { TLS.sharedCredentials = credentials
             , TLS.sharedSessionManager = mgr
             }
     supported =
-        def -- TLS.Supported
+        TLS.defaultSupported
             { TLS.supportedVersions = tlsAllowedVersions
             , TLS.supportedCiphers = tlsCiphers
             , TLS.supportedCompressions = [TLS.nullCompression]
diff --git a/Network/Wai/Handler/WarpTLS/Internal.hs b/Network/Wai/Handler/WarpTLS/Internal.hs
--- a/Network/Wai/Handler/WarpTLS/Internal.hs
+++ b/Network/Wai/Handler/WarpTLS/Internal.hs
@@ -12,7 +12,6 @@
 
 import qualified Data.ByteString as S
 import qualified Data.ByteString.Lazy as L
-import Data.Default (def)
 import qualified Data.IORef as I
 import qualified Network.TLS as TLS
 import qualified Network.TLS.Extra as TLSExtra
@@ -33,7 +32,7 @@
 instance Show CertSettings where
     show (CertFromFile a b c) = "CertFromFile " ++ show a ++ " " ++ show b ++ " " ++ show c
     show (CertFromMemory a b c) = "CertFromMemory " ++ show a ++ " " ++ show b ++ " " ++ show c
-    show (CertFromRef _ _ _) = "CertFromRef"
+    show CertFromRef{} = "CertFromRef"
 
 ----------------------------------------------------------------
 
@@ -91,7 +90,7 @@
     -- to take when a client certificate is received.  See the "Network.TLS"
     -- module for details.
     --
-    -- Default: def
+    -- Default: defaultServerHooks
     --
     -- Since 3.0.2
     , tlsServerDHEParams :: Maybe TLS.DHParams
@@ -145,16 +144,16 @@
     TLSSettings
         { certSettings = defaultCertSettings
         , onInsecure = DenyInsecure "This server only accepts secure HTTPS connections."
-        , tlsLogging = def
-        , tlsAllowedVersions = TLS.supportedVersions def
+        , tlsLogging = TLS.defaultLogging
+        , tlsAllowedVersions = TLS.supportedVersions TLS.defaultSupported
         , tlsCiphers = ciphers
         , tlsWantClientCert = False
-        , tlsServerHooks = def
+        , tlsServerHooks = TLS.defaultServerHooks
         , tlsServerDHEParams = Nothing
         , tlsSessionManagerConfig = Nothing
         , tlsCredentials = Nothing
         , tlsSessionManager = Nothing
-        , tlsSupportedHashSignatures = TLS.supportedHashSignatures def
+        , tlsSupportedHashSignatures = TLS.supportedHashSignatures TLS.defaultSupported
         }
 
 -- taken from stunnel example in tls-extra
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.4.9
+Version:             3.4.10
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE
@@ -22,8 +22,7 @@
                    , bytestring                    >= 0.9
                    , wai                           >= 3.2      && < 3.3
                    , warp                          >= 3.3.29   && < 3.5
-                   , data-default
-                   , tls                           >= 1.7      && < 2.2
+                   , tls                           >= 2.1.3    && < 2.2
                    , network                       >= 2.2.1
                    , streaming-commons
                    , tls-session-manager           >= 0.0.4