curl.patch

diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 0000000000..37a7786605
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,97 @@
+# Repository Guidelines
+
+## Project Structure & Module Organization
+`curl-chrome` follows curl's upstream layout.
+
+- `lib/`: libcurl core (protocols, connection logic, TLS in `lib/vtls/`, QUIC in `lib/vquic/`).
+- `src/`: curl CLI sources.
+- `include/curl/`: public headers installed for libcurl users.
+- `tests/`: regression and integration suites (`tests/data/`, `tests/libtest/`, `tests/unit/`, `tests/http/`).
+- `docs/`: user/developer docs (`docs/internals/` for contributor-facing internals).
+- `scripts/`: maintenance and lint helpers.
+- `CMake/` and top-level `CMakeLists.txt`: CMake build support.
+
+## Fork Delta (vs `curl-8_21_0`)
+Baseline check: `git diff --stat curl-8_21_0`.
+Current delta: **72 files changed, +7788/-462**.
+
+- Impersonation core: `lib/impersonate.c` + `lib/impersonate.h` with 38 preset targets (Chrome/Edge/Firefox/Safari/Tor/OkHttp variants).
+- Public API additions: `curl_easy_impersonate()` and new `CURLOPT_*` for TLS/HTTP2 fingerprints (`CURLOPT_IMPERSONATE`, `CURLOPT_HTTPBASEHEADER`, `CURLOPT_HTTP2_SETTINGS`, `CURLOPT_TLS_EXTENSION_ORDER`, etc.).
+- Tooling additions: `curl-impersonate` and tuning flags such as `--impersonate`, `--http2-pseudo-headers-order`, `--tls-permute-extensions`, and `--proxy-credential-no-reuse`.
+- Network behavior changes: HTTP/2 priority/pseudo-header ordering, browser-style header merge, WebSocket impersonation, HTTP/3 fingerprint switching, and QUIC-over-SOCKS5 UDP ASSOCIATE (`socks5h` included).
+- TLS/QUIC fingerprinting includes signature algorithms, extension order, ALPS codepoint selection, certificate compression, record/key-share limits, transport parameters, and session-cache separation for fingerprint-sensitive settings.
+- Build/package rename: artifacts are emitted as `curl-impersonate`, `libcurl-impersonate`, `curl-impersonate-config`, and `libcurl-impersonate.pc`.
+
+## Build, Test, and Development Commands
+
+Do not build unless the user explicitly requests it. The user normally builds
+and tests manually.
+
+The packaging build consumes this repository as a generated patch. Always
+propagate changes with `./export.sh`; never edit
+`../curl-impersonate/build/deps/src/curl` directly.
+
+```sh
+./export.sh
+cd ../curl-impersonate
+make build
+```
+
+An existing CMake ExternalProject source tree does not automatically reapply a
+changed patch. When a clean patch application is required, clean the generated
+outputs after exporting, then rebuild:
+
+```sh
+cd ../curl-impersonate
+make build CMAKE_BUILD_ARGS="--target clean"
+make build
+```
+
+## Coding Style & Naming Conventions
+- C code style is defined in `docs/internals/CODE_STYLE.md`.
+- Use spaces only, 2-space indentation, max 79 columns.
+- Keep to C89 style (`/* comments */`, not `//`).
+- Prefer clear lower-case names; make file-local helpers `static`.
+- Run `make checksrc` before submitting.
+
+## Testing Guidelines
+
+DO NOT TEST unless the user explicitly requests it; the user normally tests
+manually.
+
+## Commit & Pull Request Guidelines
+- Commit subject format: `[area]: short effect` (imperative, present tense, no trailing period).
+- Keep commit body wrapped at 72 columns and explain *why*.
+- Use relevant trailers when applicable: `Fixes #...`, `Closes #...`, `Ref: ...`, `Reviewed-by: ...`.
+- Keep PRs focused, include tests/docs updates for changed behavior, and ensure CI is green before requesting review.
+
+## Adding new options for impersonating
+
+For libcurl:
+
+- Add the field in `lib/impersonate.h` and preset values in
+  `lib/impersonate.c`.
+- Add `CURLOPT_XXX` in `include/curl/curl.h`.
+- Add storage in `lib/urldata.h`. For strings, also update `struct dupstring`.
+- Add the option to `lib/easyoptions.c` in alphabetical order and update the
+  option count at the end.
+- Implement it in `lib/setopt.c`: use `setopt_long` for integers/booleans and
+  `setopt_cptr` for strings.
+- Apply preset values in `lib/easy.c` and use `long` values for long options.
+- Implement protocol behavior in the appropriate layer, normally
+  `lib/vtls/openssl.c`, `lib/http2.c`, `lib/ws.c`, or `lib/vquic/`.
+- For TLS-affecting configuration, review copy, completeness, matching, free,
+  connection reuse, and session-cache key handling in `lib/vtls/`.
+
+For curl:
+
+- Add storage and cleanup in `src/tool_cfgable.h` and
+  `src/tool_cfgable.c`.
+- Add the option identifier in `src/tool_getparam.h`.
+- Add both the option-table entry and parser case in `src/tool_getparam.c`,
+  using the correct argument type such as `ARG_BOOL` or `ARG_STRG`.
+- Apply it in `src/config2setopts.c`. Use `my_setopt_long` for long/boolean
+  values and `MY_SETOPT_STR` for strings so errors are handled.
+- Touch `src/tool_operate.c` only when the option needs transfer-lifecycle
+  behavior; ordinary option application belongs in `config2setopts.c`.
+- Keep generated/help option lists in their required alphabetical order.
diff --git a/CMake/Macros.cmake b/CMake/Macros.cmake
index 953c1c6ee6..1174eb4181 100644
--- a/CMake/Macros.cmake
+++ b/CMake/Macros.cmake
@@ -45,7 +45,7 @@ macro(curl_internal_test _curl_test)
       ${PROJECT_BINARY_DIR}
       "${CMAKE_CURRENT_SOURCE_DIR}/CMake/CurlTests.c"
       COMPILE_DEFINITIONS "-D${_curl_test}" ${CURL_TEST_DEFINES} ${CMAKE_REQUIRED_FLAGS} ${CMAKE_REQUIRED_DEFINITIONS}
-      LINK_LIBRARIES "${CMAKE_REQUIRED_LIBRARIES}"
+      LINK_LIBRARIES ${CMAKE_REQUIRED_LIBRARIES}
       OUTPUT_VARIABLE CURL_TEST_OUTPUT)
     if(${_curl_test})
       set(${_curl_test} 1 CACHE INTERNAL "curl test")
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e459b3d076..1bc3795713 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -153,8 +153,8 @@ if(CURL_PATCHSTAMP)
   set(CURL_PATCHSTAMP "\"${CURL_PATCHSTAMP}\"")
 endif()
 
-set(LIB_NAME "libcurl")
-set(EXE_NAME "curl")
+set(LIB_NAME "libcurl-impersonate")
+set(EXE_NAME "curl-impersonate")
 
 set_property(DIRECTORY APPEND PROPERTY INCLUDE_DIRECTORIES "${PROJECT_SOURCE_DIR}/include")
 
@@ -858,9 +858,15 @@ if(CURL_USE_OPENSSL)
         message(WARNING "AWS-LC/BoringSSL requires POSIX Threads.")
       endif()
     endif()
-    if(OPENSSL_USE_STATIC_LIBS AND CMAKE_C_COMPILER_ID MATCHES "Clang")
-      list(APPEND CURL_LIBS "stdc++")
-      list(APPEND CMAKE_REQUIRED_LIBRARIES "stdc++")
+    if(OPENSSL_USE_STATIC_LIBS AND
+       CMAKE_C_COMPILER_ID MATCHES "Clang" AND NOT MSVC)
+      if(APPLE OR BSD OR ANDROID)
+        set(_cxx_runtime_lib "c++")
+      else()
+        set(_cxx_runtime_lib "stdc++")
+      endif()
+      list(APPEND CURL_LIBS "${_cxx_runtime_lib}")
+      list(APPEND CMAKE_REQUIRED_LIBRARIES "${_cxx_runtime_lib}")
     endif()
   endif()
 
@@ -2105,7 +2111,7 @@ endif()
 
 if(NOT CURL_DISABLE_INSTALL)
 
-  # curl-config needs the following options to be set.
+  # curl-impersonate-config needs the following options to be set.
   set(CC                      "${CMAKE_C_COMPILER}")
   set(CONFIGURE_OPTIONS       "")
   set(CURLVERSION             "${_curl_version}")
@@ -2303,7 +2309,7 @@ if(NOT CURL_DISABLE_INSTALL)
     set(ENABLE_STATIC       "no")
   endif()
 
-  # Generate a "curl-config" matching this config.
+  # Generate a "curl-impersonate-config" matching this config.
   # Consumed variables:
   #   CC
   #   CONFIGURE_OPTIONS
@@ -2325,8 +2331,8 @@ if(NOT CURL_DISABLE_INSTALL)
   #   VERSIONNUM
   configure_file(
     "${PROJECT_SOURCE_DIR}/curl-config.in"
-    "${PROJECT_BINARY_DIR}/curl-config" @ONLY)
-  install(FILES "${PROJECT_BINARY_DIR}/curl-config"
+    "${PROJECT_BINARY_DIR}/curl-impersonate-config" @ONLY)
+  install(FILES "${PROJECT_BINARY_DIR}/curl-impersonate-config"
     DESTINATION ${CMAKE_INSTALL_BINDIR}
     PERMISSIONS
       OWNER_READ OWNER_WRITE OWNER_EXECUTE
@@ -2463,7 +2469,7 @@ if(NOT CURL_DISABLE_INSTALL)
   endif()
 
   if(BUILD_CURL_EXE)
-    install(FILES "${PROJECT_SOURCE_DIR}/scripts/wcurl"
+    install(FILES "${PROJECT_SOURCE_DIR}/scripts/wcurl-impersonate"
       DESTINATION ${CMAKE_INSTALL_BINDIR}
       PERMISSIONS
         OWNER_READ OWNER_WRITE OWNER_EXECUTE
diff --git a/Makefile.am b/Makefile.am
index 83fdadf035..c2224a74fe 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -68,13 +68,13 @@ EXTRA_DIST = CHANGES.md COPYING RELEASE-NOTES Dockerfile .clang-tidy.yml .editor
 
 DISTCLEANFILES = buildinfo.txt
 
-bin_SCRIPTS = curl-config
+bin_SCRIPTS = curl-impersonate-config
 
 SUBDIRS = lib docs src scripts
 DIST_SUBDIRS = $(SUBDIRS) tests projects include docs
 
 pkgconfigdir = $(libdir)/pkgconfig
-pkgconfig_DATA = libcurl.pc
+pkgconfig_DATA = libcurl-impersonate.pc
 
 dist-hook:
 	rm -rf $(top_builddir)/tests/log
diff --git a/configure.ac b/configure.ac
index a21847ea66..c39b6f4726 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1631,7 +1631,11 @@ if test "x$OPT_BROTLI" != "xno"; then
   CPPFLAGS="$CPPFLAGS $CPP_BROTLI"
   LIBS="$LIB_BROTLI $LIBS"
 
-  AC_CHECK_LIB(brotlidec, BrotliDecoderDecompress)
+  AC_CHECK_LIB(brotlidec, BrotliDecoderDecompress,
+    # curl-impersonate: Define 'action-if-found' explicitly to prevent
+    # -lbrotlidec from being added to LIBS (already added before)
+    AC_DEFINE(HAVE_LIBBROTLI, 1, [Define to 1 if libbrotli exists])
+  )
 
   AC_CHECK_HEADERS(brotli/decode.h,
     curl_brotli_msg="enabled (libbrotlidec)"
@@ -5447,6 +5451,8 @@ SUPPORT_PROTOCOLS=`echo $SUPPORT_PROTOCOLS | tr ' ' '\012' | sort | tr '\012' '
 
 AC_SUBST(SUPPORT_PROTOCOLS)
 
+AC_CHECK_FUNCS([SSL_set_alps_use_new_codepoint])
+
 dnl squeeze whitespace out of some variables
 
 squeeze CFLAGS
@@ -5495,9 +5501,10 @@ AC_CONFIG_FILES([\
   tests/http/Makefile \
   projects/Makefile \
   projects/vms/Makefile \
-  libcurl.pc
+  libcurl-impersonate.pc:libcurl.pc.in
 ])
-AC_CONFIG_FILES([curl-config], [chmod +x curl-config])
+AC_CONFIG_FILES([curl-impersonate-config:curl-config.in],
+                [chmod +x curl-impersonate-config])
 AC_OUTPUT
 
 SUPPORT_PROTOCOLS_LOWER=`echo "$SUPPORT_PROTOCOLS" | tr A-Z a-z`
diff --git a/curl-config.in b/curl-config.in
index a1c8185875..b64f79a926 100644
--- a/curl-config.in
+++ b/curl-config.in
@@ -155,9 +155,9 @@ while test "$#" -gt 0; do
       curllibdir=''
     fi
     if test '@ENABLE_SHARED@' = 'no'; then
-      echo "${curllibdir}-lcurl @LIBCURL_PC_LIBS_PRIVATE@"
+      echo "${curllibdir}-lcurl-impersonate @LIBCURL_PC_LIBS_PRIVATE@"
     else
-      echo "${curllibdir}-lcurl"
+      echo "${curllibdir}-lcurl-impersonate"
     fi
     ;;
 
@@ -167,7 +167,7 @@ while test "$#" -gt 0; do
 
   --static-libs)
     if test '@ENABLE_STATIC@' != 'no'; then
-      echo "@libdir@/libcurl.@libext@ @LIBCURL_PC_LDFLAGS_PRIVATE@ @LIBCURL_PC_LIBS_PRIVATE@"
+      echo "@libdir@/libcurl-impersonate.@libext@ @LIBCURL_PC_LDFLAGS_PRIVATE@ @LIBCURL_PC_LIBS_PRIVATE@"
     else
       echo 'curl was built with static libraries disabled' >&2
       exit 1
diff --git a/docs/CMakeLists.txt b/docs/CMakeLists.txt
index 9c02530193..79395d0e55 100644
--- a/docs/CMakeLists.txt
+++ b/docs/CMakeLists.txt
@@ -32,7 +32,7 @@ endif()
 if(BUILD_MISC_DOCS)
   set(_man_targets "curl-config" "mk-ca-bundle")
   if(BUILD_CURL_EXE)
-    list(APPEND _man_targets "wcurl")
+    list(APPEND _man_targets "wcurl-impersonate")
   endif()
 
   foreach(_man_misc IN LISTS _man_targets)
diff --git a/docs/Makefile.am b/docs/Makefile.am
index fdc4511b5c..f0857aaeef 100644
--- a/docs/Makefile.am
+++ b/docs/Makefile.am
@@ -28,10 +28,10 @@ if BUILD_DOCS
 # if we disable man page building, ignore these
 MK_CA_DOCS = mk-ca-bundle.1
 CURLCONF_DOCS = curl-config.1
-man_MANS = curl-config.1 wcurl.1
+man_MANS = curl-config.1 wcurl-impersonate.1
 endif
 
-CURLPAGES = curl-config.md mk-ca-bundle.md wcurl.md runtests.md testcurl.md
+CURLPAGES = curl-config.md mk-ca-bundle.md wcurl-impersonate.md runtests.md testcurl.md
 
 SUBDIRS = . cmdline-opts libcurl
 DIST_SUBDIRS = $(SUBDIRS) examples
@@ -150,7 +150,7 @@ curl-config.1: curl-config.md
 
 mk-ca-bundle.1: mk-ca-bundle.md
 
-wcurl.1: wcurl.md
+wcurl-impersonate.1: wcurl-impersonate.md
 
 distclean:
 	rm -f $(CLEANFILES)
diff --git a/docs/libcurl/curl_easy_getinfo.md b/docs/libcurl/curl_easy_getinfo.md
index 6fc5555b38..fcd0c3adf4 100644
--- a/docs/libcurl/curl_easy_getinfo.md
+++ b/docs/libcurl/curl_easy_getinfo.md
@@ -250,6 +250,11 @@ CURLINFO_QUEUE_TIME_T(3)
 
 Total number of redirects that were followed. See CURLINFO_REDIRECT_COUNT(3)
 
+## CURLINFO_REDIRECT_HISTORY
+
+Status codes and request URLs for redirects followed during the latest
+transfer. See CURLINFO_REDIRECT_HISTORY(3)
+
 ## CURLINFO_REDIRECT_TIME
 
 The time it took for all redirection steps include name lookup, connect,
diff --git a/docs/libcurl/opts/CURLINFO_REDIRECT_HISTORY.md b/docs/libcurl/opts/CURLINFO_REDIRECT_HISTORY.md
new file mode 100644
index 0000000000..c1429c6c01
--- /dev/null
+++ b/docs/libcurl/opts/CURLINFO_REDIRECT_HISTORY.md
@@ -0,0 +1,87 @@
+---
+c: Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+SPDX-License-Identifier: curl
+Title: CURLINFO_REDIRECT_HISTORY
+Section: 3
+Source: libcurl
+See-also:
+  - CURLINFO_EFFECTIVE_URL (3)
+  - CURLINFO_REDIRECT_COUNT (3)
+  - CURLINFO_RESPONSE_CODE (3)
+  - CURLOPT_FOLLOWLOCATION (3)
+  - curl_easy_getinfo (3)
+  - curl_slist_free_all (3)
+Protocol:
+  - HTTP
+Added-in: 8.21.0
+---
+
+# NAME
+
+CURLINFO_REDIRECT_HISTORY - get followed HTTP redirect responses
+
+# SYNOPSIS
+
+~~~c
+#include <curl/curl.h>
+
+CURLcode curl_easy_getinfo(CURL *handle, CURLINFO_REDIRECT_HISTORY,
+                           struct curl_slist **historyp);
+~~~
+
+# DESCRIPTION
+
+Pass a pointer to a *struct curl_slist * to receive the HTTP redirect
+responses followed during the latest transfer, in request order.
+
+Each list item uses this format, separated by a single ASCII tab:
+
+~~~text
+<status-code>\t<url>
+~~~
+
+The URL is the request URL that returned the status code. The final response
+is not part of the history; retrieve its URL with CURLINFO_EFFECTIVE_URL(3)
+and its status with CURLINFO_RESPONSE_CODE(3). Authentication challenges and
+automatic transport retries are not included.
+
+The returned list is newly allocated. The application must free it with
+curl_slist_free_all(3). If no redirects were followed, the returned list is
+NULL.
+
+# %PROTOCOLS%
+
+# EXAMPLE
+
+~~~c
+int main(void)
+{
+  CURL *curl = curl_easy_init();
+  if(curl) {
+    CURLcode result;
+    curl_easy_setopt(curl, CURLOPT_URL, "https://example.com");
+    curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L);
+    result = curl_easy_perform(curl);
+    if(result == CURLE_OK) {
+      struct curl_slist *history;
+      result = curl_easy_getinfo(curl, CURLINFO_REDIRECT_HISTORY, &history);
+      if(result == CURLE_OK) {
+        struct curl_slist *item;
+        for(item = history; item; item = item->next)
+          printf("%s\n", item->data);
+        curl_slist_free_all(history);
+      }
+    }
+    curl_easy_cleanup(curl);
+  }
+}
+~~~
+
+# %AVAILABILITY%
+
+# RETURN VALUE
+
+curl_easy_getinfo(3) returns a CURLcode indicating success or error.
+
+CURLE_OK (0) means everything was OK, non-zero means an error occurred, see
+libcurl-errors(3).
diff --git a/docs/libcurl/opts/Makefile.inc b/docs/libcurl/opts/Makefile.inc
index 1eb628b800..fbf28a21e6 100644
--- a/docs/libcurl/opts/Makefile.inc
+++ b/docs/libcurl/opts/Makefile.inc
@@ -71,6 +71,7 @@ man_MANS =                                      \
   CURLINFO_PROXYAUTH_USED.3                     \
   CURLINFO_QUEUE_TIME_T.3                       \
   CURLINFO_REDIRECT_COUNT.3                     \
+  CURLINFO_REDIRECT_HISTORY.3                   \
   CURLINFO_REDIRECT_TIME.3                      \
   CURLINFO_REDIRECT_TIME_T.3                    \
   CURLINFO_REDIRECT_URL.3                       \
diff --git a/docs/libcurl/symbols-in-versions b/docs/libcurl/symbols-in-versions
index 5bad9a9842..60c8a40b9f 100644
--- a/docs/libcurl/symbols-in-versions
+++ b/docs/libcurl/symbols-in-versions
@@ -480,6 +480,7 @@ CURLINFO_PROXYAUTH_USED         8.12.0
 CURLINFO_PTR                    7.54.1
 CURLINFO_QUEUE_TIME_T           8.6.0
 CURLINFO_REDIRECT_COUNT         7.9.7
+CURLINFO_REDIRECT_HISTORY       8.21.0
 CURLINFO_REDIRECT_TIME          7.9.7
 CURLINFO_REDIRECT_TIME_T        7.61.0
 CURLINFO_REDIRECT_URL           7.18.2
diff --git a/docs/wcurl-impersonate.md b/docs/wcurl-impersonate.md
new file mode 100644
index 0000000000..b285a0fc9e
--- /dev/null
+++ b/docs/wcurl-impersonate.md
@@ -0,0 +1,160 @@
+---
+c: Copyright (C) Samuel Henrique <samueloph@debian.org>, Sergio Durigan Junior <sergiodj@debian.org> and many contributors, see the AUTHORS file.
+SPDX-License-Identifier: curl
+Title: wcurl-impersonate
+Section: 1
+Source: wcurl-impersonate
+See-also:
+  - curl (1)
+  - trurl (1)
+Added-in: n/a
+---
+
+# NAME
+
+**wcurl-impersonate** - a simple wrapper around curl-impersonate to easily
+download files.
+
+# SYNOPSIS
+
+**wcurl-impersonate \<URL\>...**
+
+**wcurl-impersonate [--curl-options \<CURL_OPTIONS\>]... [--dry-run] [--no-decode-filename] [-o|-O|--output \<PATH\>] [--] \<URL\>...**
+
+**wcurl-impersonate [--curl-options=\<CURL_OPTIONS\>]... [--dry-run] [--no-decode-filename] [--output=\<PATH\>] [--] \<URL\>...**
+
+**wcurl-impersonate -V|--version**
+
+**wcurl-impersonate -h|--help**
+
+# DESCRIPTION
+
+**wcurl-impersonate** is a simple curl wrapper which lets you use
+curl-impersonate to download files without having to remember any parameters.
+
+Call **wcurl-impersonate** with a list of URLs you want to download and
+**wcurl-impersonate** picks sane defaults.
+
+If you need anything more complex, you can provide any of curl-impersonate's
+supported parameters via the **--curl-options** option. Beware that you likely
+should be using curl-impersonate directly if your use case is not covered.
+
+By default, **wcurl-impersonate** does:
+
+## * Percent-encode whitespace in URLs;
+
+## * Download multiple URLs in parallel
+    if the installed curl-impersonate's version is \>= 7.66.0 (--parallel);
+
+## * Use a total number of 5 parallel connections to the same protocol + hostname + port number target
+    if the installed curl-impersonate's version is \>= 8.16.0 (--parallel-max-host);
+
+## * Follow redirects;
+
+## * Automatically choose a filename as output;
+
+## * Avoid overwriting files
+    if the installed curl-impersonate's version is \>= 7.83.0 (--no-clobber);
+
+## * Perform retries;
+
+## * Set the downloaded file timestamp
+    to the value provided by the server, if available;
+
+## * Default to https
+    if the URL does not contain any scheme;
+
+## * Disable curl-impersonate's URL globbing parser
+    so {} and [] characters in URLs are not treated specially;
+
+## * Percent-decode the resulting filename;
+
+## * Use 'index.html' as the default filename
+    if there is none in the URL.
+
+# OPTIONS
+
+## --curl-options, --curl-options=\<CURL_OPTIONS\>...
+
+Specify extra options to be passed when invoking curl-impersonate. May be
+specified more than once.
+
+## -o, -O, --output, --output=\<PATH\>
+
+Use the provided output path instead of getting it from the URL. If multiple
+URLs are provided, resulting files share the same name with a number appended to
+the end (curl-impersonate \>= 7.83.0). If this option is provided multiple
+times, only the last value is considered.
+
+## --no-decode-filename
+
+Do not percent-decode the output filename, even if the percent-encoding in the
+URL was done by **wcurl-impersonate**, e.g.: The URL contained whitespace.
+
+## --dry-run
+
+Do not actually execute curl-impersonate, print what would be invoked.
+
+## -V, \--version
+
+Print version information.
+
+## -h, \--help
+
+Print help message.
+
+# CURL_OPTIONS
+
+Any option supported by curl-impersonate can be set here. This is not used by
+**wcurl-impersonate**; it is instead forwarded to the curl-impersonate
+invocation.
+
+# URL
+
+URL to be downloaded. Anything that is not a parameter is considered
+an URL. Whitespace is percent-encoded and the URL is passed to
+curl-impersonate, which then performs the parsing. May be specified more than
+once.
+
+# EXAMPLES
+
+Download a single file:
+
+**wcurl-impersonate example.com/filename.txt**
+
+Download two files in parallel:
+
+**wcurl-impersonate example.com/filename1.txt example.com/filename2.txt**
+
+Download a file passing the **--progress-bar** and **--http2** flags to
+curl-impersonate:
+
+**wcurl-impersonate --curl-options="--progress-bar --http2" example.com/filename.txt**
+
+Resume from an interrupted download. The options necessary to resume the
+download (`--clobber --continue-at -`) must be the **last** options specified in
+`--curl-options`. Note that the only way to resume interrupted downloads is to
+allow wcurl-impersonate to overwrite the destination file:
+
+**wcurl-impersonate --curl-options="--clobber --continue-at -" example.com/filename.txt**
+
+Download multiple files without a limit of concurrent connections per host
+(the default limit is 5):
+
+**wcurl-impersonate --curl-options="--parallel-max-host 0" example.com/filename1.txt example.com/filename2.txt**
+
+# AUTHORS
+
+    Samuel Henrique \<samueloph@debian.org\>
+    Sergio Durigan Junior \<sergiodj@debian.org\>
+    and many contributors, see the AUTHORS file.
+
+# REPORTING BUGS
+
+If you experience any problems with **wcurl-impersonate** that you do not
+experience with curl-impersonate, submit an issue on GitHub:
+https://github.com/curl/wcurl
+
+# COPYRIGHT
+
+**wcurl-impersonate** is licensed under the curl license
diff --git a/docs/wcurl.md b/docs/wcurl.md
deleted file mode 100644
index f0ed42baf2..0000000000
--- a/docs/wcurl.md
+++ /dev/null
@@ -1,154 +0,0 @@
----
-c: Copyright (C) Samuel Henrique <samueloph@debian.org>, Sergio Durigan Junior <sergiodj@debian.org> and many contributors, see the AUTHORS file.
-SPDX-License-Identifier: curl
-Title: wcurl
-Section: 1
-Source: wcurl
-See-also:
-  - curl (1)
-  - trurl (1)
-Added-in: n/a
----
-
-# NAME
-
-**wcurl** - a simple wrapper around curl to easily download files.
-
-# SYNOPSIS
-
-**wcurl \<URL\>...**
-
-**wcurl [--curl-options \<CURL_OPTIONS\>]... [--dry-run] [--no-decode-filename] [-o|-O|--output \<PATH\>] [--] \<URL\>...**
-
-**wcurl [--curl-options=\<CURL_OPTIONS\>]... [--dry-run] [--no-decode-filename] [--output=\<PATH\>] [--] \<URL\>...**
-
-**wcurl -V|--version**
-
-**wcurl -h|--help**
-
-# DESCRIPTION
-
-**wcurl** is a simple curl wrapper which lets you use curl to download files
-without having to remember any parameters.
-
-Call **wcurl** with a list of URLs you want to download and **wcurl**
-picks sane defaults.
-
-If you need anything more complex, you can provide any of curl's supported
-parameters via the **--curl-options** option. Beware that you likely should be
-using curl directly if your use case is not covered.
-
-By default, **wcurl** does:
-
-## * Percent-encode whitespace in URLs;
-
-## * Download multiple URLs in parallel
-    if the installed curl's version is \>= 7.66.0 (--parallel);
-
-## * Use a total number of 5 parallel connections to the same protocol + hostname + port number target
-    if the installed curl's version is \>= 8.16.0 (--parallel-max-host);
-
-## * Follow redirects;
-
-## * Automatically choose a filename as output;
-
-## * Avoid overwriting files
-    if the installed curl's version is \>= 7.83.0 (--no-clobber);
-
-## * Perform retries;
-
-## * Set the downloaded file timestamp
-    to the value provided by the server, if available;
-
-## * Default to https
-    if the URL does not contain any scheme;
-
-## * Disable curl's URL globbing parser
-    so {} and [] characters in URLs are not treated specially;
-
-## * Percent-decode the resulting filename;
-
-## * Use 'index.html' as the default filename
-    if there is none in the URL.
-
-# OPTIONS
-
-## --curl-options, --curl-options=\<CURL_OPTIONS\>...
-
-Specify extra options to be passed when invoking curl. May be specified more
-than once.
-
-## -o, -O, --output, --output=\<PATH\>
-
-Use the provided output path instead of getting it from the URL. If multiple
-URLs are provided, resulting files share the same name with a number appended to
-the end (curl \>= 7.83.0). If this option is provided multiple times, only the
-last value is considered.
-
-## --no-decode-filename
-
-Do not percent-decode the output filename, even if the percent-encoding in the
-URL was done by **wcurl**, e.g.: The URL contained whitespace.
-
-## --dry-run
-
-Do not actually execute curl, print what would be invoked.
-
-## -V, \--version
-
-Print version information.
-
-## -h, \--help
-
-Print help message.
-
-# CURL_OPTIONS
-
-Any option supported by curl can be set here. This is not used by **wcurl**; it
-is instead forwarded to the curl invocation.
-
-# URL
-
-URL to be downloaded. Anything that is not a parameter is considered
-an URL. Whitespace is percent-encoded and the URL is passed to curl, which
-then performs the parsing. May be specified more than once.
-
-# EXAMPLES
-
-Download a single file:
-
-**wcurl example.com/filename.txt**
-
-Download two files in parallel:
-
-**wcurl example.com/filename1.txt example.com/filename2.txt**
-
-Download a file passing the **--progress-bar** and **--http2** flags to curl:
-
-**wcurl --curl-options="--progress-bar --http2" example.com/filename.txt**
-
-Resume from an interrupted download. The options necessary to resume the download
-(`--clobber --continue-at -`) must be the **last** options specified in `--curl-options`.
-Note that the only way to resume interrupted downloads is to allow wcurl to overwrite
-the destination file:
-
-**wcurl --curl-options="--clobber --continue-at -" example.com/filename.txt**
-
-Download multiple files without a limit of concurrent connections per host (the default limit is 5):
-
-**wcurl --curl-options="--parallel-max-host 0" example.com/filename1.txt example.com/filename2.txt**
-
-# AUTHORS
-
-    Samuel Henrique \<samueloph@debian.org\>
-    Sergio Durigan Junior \<sergiodj@debian.org\>
-    and many contributors, see the AUTHORS file.
-
-# REPORTING BUGS
-
-If you experience any problems with **wcurl** that you do not experience with
-curl, submit an issue on GitHub: https://github.com/curl/wcurl
-
-# COPYRIGHT
-
-**wcurl** is licensed under the curl license
diff --git a/export.sh b/export.sh
new file mode 100755
index 0000000000..bc1a07122f
--- /dev/null
+++ b/export.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# TODO: use cmake to generate mingw makefile, see:
+#
+# 1. https://github.com/curl/curl/pull/13244/files
+# 2. https://everything.curl.dev/build/windows.html
+
+git df curl-8_21_0 -- . ':(exclude)tests/**' > chrome.patch
+mv chrome.patch ../curl-impersonate/patches/curl.patch
diff --git a/include/curl/curl.h b/include/curl/curl.h
index 7e59e43c4d..0310d464e7 100644
--- a/include/curl/curl.h
+++ b/include/curl/curl.h
@@ -185,6 +185,10 @@ typedef enum {
 /* Only use the custom method in the first request, always reset in the next */
 #define CURLFOLLOW_FIRSTONLY 3L
 
+/* curl-impersonate: Follow redirects, but reject redirects to
+   internal/private IP addresses (SSRF protection) */
+#define CURLFOLLOW_SAFE      4L
+
 struct curl_httppost {
   struct curl_httppost *next;       /* next entry in the list */
   char *name;                       /* pointer to allocated name */
@@ -2262,6 +2266,153 @@ typedef enum {
   /* set TLS supported signature algorithms */
   CURLOPT(CURLOPT_SSL_SIGNATURE_ALGORITHMS, CURLOPTTYPE_STRINGPOINT, 328),
 
+  /* curl-impersonate: The master option for setting an impersonate target.
+   * Impersonation target format is "name[:yes|no]".
+   * The optional suffix controls default browser headers. */
+  CURLOPT(CURLOPT_IMPERSONATE, CURLOPTTYPE_STRINGPOINT, 999),
+
+  /* curl-impersonate: A list of headers used by the impersonated browser.
+   * If given, merged with CURLOPT_HTTPHEADER. */
+  CURLOPT(CURLOPT_HTTPBASEHEADER, CURLOPTTYPE_SLISTPOINT, 1000),
+
+  /* curl-impersonate: A list of TLS signature hash algorithms.
+   * This has been implemented by curl as option 328, but we will keep it for compatibility.
+   * See https://datatracker.ietf.org/doc/html/rfc5246#section-7.4.1.4.1 */
+  CURLOPT(CURLOPT_SSL_SIG_HASH_ALGS, CURLOPTTYPE_STRINGPOINT, 1001),
+
+  /* curl-impersonate: Whether to enable ALPS in TLS or not.
+   * See https://datatracker.ietf.org/doc/html/draft-vvv-tls-alps.
+   * Support for ALPS is minimal and is intended only for the TLS client
+   * hello to match. */
+  CURLOPT(CURLOPT_SSL_ENABLE_ALPS, CURLOPTTYPE_LONG, 1002),
+
+  /* curl-impersonate: Comma-separated list of certificate compression
+   * algorithms to use. These are published in the client hello.
+   * Supported algorithms are "zlib" and "brotli".
+   * See https://datatracker.ietf.org/doc/html/rfc8879 */
+  CURLOPT(CURLOPT_SSL_CERT_COMPRESSION, CURLOPTTYPE_STRINGPOINT, 1003),
+
+  /* Enable/disable TLS session ticket extension (RFC5077) */
+  CURLOPT(CURLOPT_SSL_ENABLE_TICKET, CURLOPTTYPE_LONG, 1004),
+
+  /*
+   * curl-impersonate:
+   * Set the order of the HTTP/2 pseudo headers. The value must contain
+   * the letters 'm', 'a', 's', 'p' representing the pseudo-headers
+   * ":method", ":authority", ":scheme", ":path" in the desired order of
+   * appearance in the HTTP/2 HEADERS frame.
+   */
+  CURLOPT(CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER, CURLOPTTYPE_STRINGPOINT, 1005),
+
+  /* curl-impersonate: HTTP2 settings frame keys and values, format: 1:v;2:v;3:v */
+  CURLOPT(CURLOPT_HTTP2_SETTINGS, CURLOPTTYPE_STRINGPOINT, 1006),
+
+  /*
+   * curl-impersonate: Whether to enable Boringssl permute extensions
+   * See https://commondatastorage.googleapis.com/chromium-boringssl-docs/ssl.h.html#SSL_set_permute_extensions.
+   */
+  CURLOPT(CURLOPT_SSL_PERMUTE_EXTENSIONS, CURLOPTTYPE_LONG, 1007),
+
+  /* curl-impersonate: HTTP2 initial window update */
+  CURLOPT(CURLOPT_HTTP2_WINDOW_UPDATE, CURLOPTTYPE_LONG, 1008),
+
+  /* curl-impersonate: Set the initial streams settings for http2. */
+  CURLOPT(CURLOPT_HTTP2_STREAMS, CURLOPTTYPE_STRINGPOINT, 1010),
+
+  /* curl-impersonate: enable tls grease */
+  CURLOPT(CURLOPT_TLS_GREASE, CURLOPTTYPE_LONG, 1011),
+
+  /* curl-impersonate: set tls extension order */
+  CURLOPT(CURLOPT_TLS_EXTENSION_ORDER, CURLOPTTYPE_STRINGPOINT, 1012),
+
+  /* curl-impersonate: Set stream exclusiveness, 0 or 1 */
+  CURLOPT(CURLOPT_STREAM_EXCLUSIVE, CURLOPTTYPE_LONG, 1013),
+
+  /* curl-impersonate: enable tls key usage check, defaults: on */
+  CURLOPT(CURLOPT_TLS_KEY_USAGE_NO_CHECK, CURLOPTTYPE_LONG, 1014),
+
+  /* curl-impersonate: enable tls signed cert stamps */
+  CURLOPT(CURLOPT_TLS_SIGNED_CERT_TIMESTAMPS, CURLOPTTYPE_LONG, 1015),
+
+  /* curl-impersonate: enable tls status request */
+  CURLOPT(CURLOPT_TLS_STATUS_REQUEST, CURLOPTTYPE_LONG, 1016),
+
+  /* curl-impersonate: firefox delegated credentials */
+  CURLOPT(CURLOPT_TLS_DELEGATED_CREDENTIALS, CURLOPTTYPE_STRINGPOINT, 1017),
+
+  /* curl-impersonate: firefox record size limit */
+  CURLOPT(CURLOPT_TLS_RECORD_SIZE_LIMIT, CURLOPTTYPE_LONG, 1018),
+
+  /* curl-impersonate: firefox key_shares_limit */
+  CURLOPT(CURLOPT_TLS_KEY_SHARES_LIMIT, CURLOPTTYPE_LONG, 1019),
+
+  /* curl-impersonate: Use the new ALPS code point */
+  CURLOPT(CURLOPT_TLS_USE_NEW_ALPS_CODEPOINT, CURLOPTTYPE_LONG, 1020),
+
+  /* curl-impersonate: Do not set the priority bit in http2 header frame */
+  CURLOPT(CURLOPT_HTTP2_NO_PRIORITY, CURLOPTTYPE_LONG, 1021),
+
+  /* curl-impersonate: Do not reuse TLS sessions or connections from different proxy credentials */
+  CURLOPT(CURLOPT_PROXY_CREDENTIAL_NO_REUSE, CURLOPTTYPE_LONG, 1022),
+
+  /* curl-impersonate: Split cookies into separate Cookie headers */
+  CURLOPT(CURLOPT_SPLIT_COOKIES, CURLOPTTYPE_LONG, 1023),
+
+  /* curl-impersonate: Set multipart/form-data boundary style */
+  CURLOPT(CURLOPT_FORM_BOUNDARY, CURLOPTTYPE_STRINGPOINT, 1024),
+
+  /*
+   * curl-impersonate:
+   * Set the order of the HTTP/3 pseudo headers. The value must contain
+   * the letters 'm', 'a', 's', 'p' representing the pseudo-headers
+   * ":method", ":authority", ":scheme", ":path" in the desired order of
+   * appearance in the HTTP/3 HEADERS frame.
+   *
+   * This is very similar to the http/2 option.
+   */
+  CURLOPT(CURLOPT_HTTP3_PSEUDO_HEADERS_ORDER, CURLOPTTYPE_STRINGPOINT, 1025),
+
+  /* curl-impersonate: HTTP3 settings frame keys and values, format: 1:v;6:v;7:v */
+  CURLOPT(CURLOPT_HTTP3_SETTINGS, CURLOPTTYPE_STRINGPOINT, 1026),
+
+  /* curl-impersonate: QUIC transport parameters, format: id:value;id:value */
+  CURLOPT(CURLOPT_QUIC_TRANSPORT_PARAMETERS, CURLOPTTYPE_STRINGPOINT, 1027),
+
+  /* curl-impersonate: Signature hash algorithms for HTTP/3 (QUIC TLS).
+   * If set, used instead of CURLOPT_SSL_SIGNATURE_ALGORITHMS for QUIC
+   * connections. */
+  CURLOPT(CURLOPT_HTTP3_SIG_HASH_ALGS, CURLOPTTYPE_STRINGPOINT, 1028),
+
+  /* curl-impersonate: TLS extension order for HTTP/3 (QUIC TLS).
+   * If set, used instead of CURLOPT_TLS_EXTENSION_ORDER for QUIC connections. */
+  CURLOPT(CURLOPT_HTTP3_TLS_EXTENSION_ORDER, CURLOPTTYPE_STRINGPOINT, 1029),
+
+  /* curl-impersonate: Comma-separated order for normal HTTP headers. */
+  CURLOPT(CURLOPT_HTTPHEADER_ORDER, CURLOPTTYPE_STRINGPOINT, 1030),
+
+  /* curl-impersonate: HTTP/3-specific custom HTTP headers.
+   * If set, used instead of CURLOPT_HTTPHEADER for HTTP/3 connections. */
+  CURLOPT(CURLOPT_HTTP3_HTTPHEADER, CURLOPTTYPE_SLISTPOINT, 1031),
+
+  /* curl-impersonate: HTTP/3-specific order for normal HTTP headers. */
+  CURLOPT(CURLOPT_HTTP3_HTTPHEADER_ORDER, CURLOPTTYPE_STRINGPOINT, 1032),
+
+  /* curl-impersonate: HTTP/3-specific EC curves. */
+  CURLOPT(CURLOPT_HTTP3_SSL_EC_CURVES, CURLOPTTYPE_STRINGPOINT, 1033),
+
+  /* curl-impersonate: WebSocket-specific custom HTTP headers.
+   * If set, used instead of CURLOPT_HTTPHEADER for ws:// and wss://. */
+  CURLOPT(CURLOPT_WS_HTTPHEADER, CURLOPTTYPE_SLISTPOINT, 1034),
+
+  /* curl-impersonate: WebSocket-specific order for normal HTTP headers. */
+  CURLOPT(CURLOPT_WS_HTTPHEADER_ORDER, CURLOPTTYPE_STRINGPOINT, 1035),
+
+  /* curl-impersonate: Disable WebSocket TLS session ticket extension. */
+  CURLOPT(CURLOPT_WS_SSL_DISABLE_TICKET, CURLOPTTYPE_LONG, 1036),
+
+  /* curl-impersonate: WebSocket-specific TLS certificate compression. */
+  CURLOPT(CURLOPT_WS_SSL_CERT_COMPRESSION, CURLOPTTYPE_STRINGPOINT, 1037),
+
   CURLOPT_LASTENTRY /* the last unused */
 } CURLoption;
 
@@ -2996,7 +3147,14 @@ typedef enum {
   CURLINFO_HTTPAUTH_USED    = CURLINFO_LONG + 69,
   CURLINFO_PROXYAUTH_USED   = CURLINFO_LONG + 70,
   CURLINFO_SIZE_DELIVERED   = CURLINFO_OFF_T + 71,
-  CURLINFO_LASTONE          = 71
+  /* curl-impersonate: accepted server cookie mutations from the latest
+   * transfer, formatted as SET/DELETE plus Netscape cookie fields. Use a
+   * high number to avoid collisions with upstream infos. */
+  CURLINFO_COOKIECHANGES    = CURLINFO_SLIST + 1000,
+  /* curl-impersonate: followed HTTP redirect responses from the latest
+   * transfer, formatted as status-code plus tab plus request URL. */
+  CURLINFO_REDIRECT_HISTORY = CURLINFO_SLIST + 1001,
+  CURLINFO_LASTONE          = 1001
 } CURLINFO;
 
 /* CURLINFO_RESPONSE_CODE is the new name for the option previously known as
diff --git a/include/curl/curlver.h b/include/curl/curlver.h
index 5cc0e27c61..fef56cbc65 100644
--- a/include/curl/curlver.h
+++ b/include/curl/curlver.h
@@ -32,7 +32,7 @@
 
 /* This is the version number of the libcurl package from which this header
    file origins: */
-#define LIBCURL_VERSION "8.21.0-DEV"
+#define LIBCURL_VERSION "8.21.0-IMPERSONATE"
 
 /* The numeric version number is also available "in parts" by using these
    defines: */
diff --git a/include/curl/easy.h b/include/curl/easy.h
index 197e6e7b92..8e0659ca66 100644
--- a/include/curl/easy.h
+++ b/include/curl/easy.h
@@ -43,6 +43,17 @@ CURL_EXTERN CURLcode curl_easy_setopt(CURL *curl, CURLoption option, ...);
 CURL_EXTERN CURLcode curl_easy_perform(CURL *curl);
 CURL_EXTERN void curl_easy_cleanup(CURL *curl);
 
+/*
+ * curl-impersonate: Tell libcurl to impersonate a browser.
+ * This is a wrapper function that calls curl_easy_setopt()
+ * multiple times with all the parameters required. That's also why it was
+ * created as a separate API function and not just as another option to
+ * curl_easy_setopt().
+ */
+CURL_EXTERN CURLcode curl_easy_impersonate(CURL *curl, const char *target,
+                                           int default_headers);
+
+
 /*
  * NAME curl_easy_getinfo()
  *
diff --git a/include/curl/typecheck-gcc.h b/include/curl/typecheck-gcc.h
index d600c73cdc..66543d62d6 100644
--- a/include/curl/typecheck-gcc.h
+++ b/include/curl/typecheck-gcc.h
@@ -428,8 +428,22 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
    (option) == CURLOPT_FTP_ACCOUNT ||                                   \
    (option) == CURLOPT_FTP_ALTERNATIVE_TO_USER ||                       \
    (option) == CURLOPT_FTPPORT ||                                       \
+   (option) == CURLOPT_FORM_BOUNDARY ||                                 \
    (option) == CURLOPT_HAPROXY_CLIENT_IP ||                             \
    (option) == CURLOPT_HSTS ||                                          \
+   (option) == CURLOPT_HTTPHEADER_ORDER ||                              \
+   (option) == CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER ||                    \
+   (option) == CURLOPT_HTTP2_SETTINGS ||                                \
+   (option) == CURLOPT_HTTP2_STREAMS ||                                 \
+   (option) == CURLOPT_HTTP3_HTTPHEADER_ORDER ||                        \
+   (option) == CURLOPT_HTTP3_PSEUDO_HEADERS_ORDER ||                    \
+   (option) == CURLOPT_HTTP3_SETTINGS ||                                \
+   (option) == CURLOPT_HTTP3_SIG_HASH_ALGS ||                           \
+   (option) == CURLOPT_HTTP3_SSL_EC_CURVES ||                           \
+   (option) == CURLOPT_HTTP3_TLS_EXTENSION_ORDER ||                     \
+   (option) == CURLOPT_QUIC_TRANSPORT_PARAMETERS ||                     \
+   (option) == CURLOPT_WS_HTTPHEADER_ORDER ||                           \
+   (option) == CURLOPT_WS_SSL_CERT_COMPRESSION ||                       \
    (option) == CURLOPT_INTERFACE ||                                     \
    (option) == CURLOPT_ISSUERCERT ||                                    \
    (option) == CURLOPT_KEYPASSWD ||                                     \
@@ -546,6 +560,8 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
 #define curlcheck_slist_option(option)                                  \
   ((option) == CURLOPT_HTTP200ALIASES ||                                \
    (option) == CURLOPT_HTTPHEADER ||                                    \
+   (option) == CURLOPT_HTTP3_HTTPHEADER ||                              \
+   (option) == CURLOPT_WS_HTTPHEADER ||                                 \
    (option) == CURLOPT_MAIL_RCPT ||                                     \
    (option) == CURLOPT_POSTQUOTE ||                                     \
    (option) == CURLOPT_PREQUOTE ||                                      \
@@ -574,7 +590,9 @@ CURLWARNING(Wcurl_easy_getinfo_err_curl_off_t,
 /* true if info expects a pointer to struct curl_slist * argument */
 #define curlcheck_slist_info(info)                                      \
   (((info) == CURLINFO_SSL_ENGINES) ||                                  \
-   ((info) == CURLINFO_COOKIELIST))
+   ((info) == CURLINFO_COOKIELIST) ||                                   \
+   ((info) == CURLINFO_COOKIECHANGES) ||                                \
+   ((info) == CURLINFO_REDIRECT_HISTORY))
 
 /* true if info expects a pointer to struct curl_tlssessioninfo * argument */
 #define curlcheck_tlssessioninfo_info(info)                             \
diff --git a/lib/Makefile.am b/lib/Makefile.am
index 8a2bd4e68e..593ed1af15 100644
--- a/lib/Makefile.am
+++ b/lib/Makefile.am
@@ -32,7 +32,7 @@ EXTRA_DIST = config-mac.h config-os400.h config-riscos.h config-win32.h
   curl_config.h.in $(LIB_RCFILES) libcurl.def $(CMAKE_DIST) Makefile.soname     \
   optiontable.pl
 
-lib_LTLIBRARIES = libcurl.la
+lib_LTLIBRARIES = libcurl-impersonate.la
 
 if BUILD_UNITTESTS
 noinst_LTLIBRARIES = libcurlu.la
@@ -77,63 +77,63 @@ if USE_UNITY
 libcurl_unity.c: $(top_srcdir)/scripts/mk-unity.pl $(CSOURCES)
 	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(CSOURCES) > libcurl_unity.c
 
-nodist_libcurl_la_SOURCES = libcurl_unity.c
-libcurl_la_SOURCES =
+nodist_libcurl_impersonate_la_SOURCES = libcurl_unity.c
+libcurl_impersonate_la_SOURCES =
 nodist_libcurlu_la_SOURCES = libcurl_unity.c
 libcurlu_la_SOURCES =
 CLEANFILES = libcurl_unity.c
 else
-libcurl_la_SOURCES = $(CSOURCES) $(HHEADERS)
+libcurl_impersonate_la_SOURCES = $(CSOURCES) $(HHEADERS)
 libcurlu_la_SOURCES = $(CSOURCES) $(HHEADERS)
 CLEANFILES =
 endif
 
 CLEANFILES += $(UNITPROTOS)
 
-libcurl_la_CPPFLAGS_EXTRA =
-libcurl_la_LDFLAGS_EXTRA =
-libcurl_la_CFLAGS_EXTRA =
+libcurl_impersonate_la_CPPFLAGS_EXTRA =
+libcurl_impersonate_la_LDFLAGS_EXTRA =
+libcurl_impersonate_la_CFLAGS_EXTRA =
 
 if CURL_LT_SHLIB_USE_VERSION_INFO
 # Get VERSIONCHANGE, VERSIONADD, VERSIONDEL, VERSIONINFO variables
 include Makefile.soname
-libcurl_la_LDFLAGS_EXTRA += $(VERSIONINFO)
+libcurl_impersonate_la_LDFLAGS_EXTRA += $(VERSIONINFO)
 endif
 
 if CURL_LT_SHLIB_USE_NO_UNDEFINED
-libcurl_la_LDFLAGS_EXTRA += -no-undefined
+libcurl_impersonate_la_LDFLAGS_EXTRA += -no-undefined
 endif
 
 if CURL_LT_SHLIB_USE_MIMPURE_TEXT
-libcurl_la_LDFLAGS_EXTRA += -mimpure-text
+libcurl_impersonate_la_LDFLAGS_EXTRA += -mimpure-text
 endif
 
 if CURL_LT_SHLIB_USE_VERSIONED_SYMBOLS
-libcurl_la_LDFLAGS_EXTRA += -Wl,--version-script=libcurl.vers
+libcurl_impersonate_la_LDFLAGS_EXTRA += -Wl,--version-script=libcurl.vers
 else
 # if symbol-hiding is enabled, hide them!
 if DOING_CURL_SYMBOL_HIDING
-libcurl_la_LDFLAGS_EXTRA += -export-symbols-regex '^curl_.*'
+libcurl_impersonate_la_LDFLAGS_EXTRA += -export-symbols-regex '^curl_.*'
 endif
 endif
 
 if USE_CPPFLAG_CURL_STATICLIB
-libcurl_la_CPPFLAGS_EXTRA += -DCURL_STATICLIB
+libcurl_impersonate_la_CPPFLAGS_EXTRA += -DCURL_STATICLIB
 else
 if HAVE_WINDRES
-libcurl_la_SOURCES += $(LIB_RCFILES)
+libcurl_impersonate_la_SOURCES += $(LIB_RCFILES)
 $(LIB_RCFILES): $(top_srcdir)/include/curl/curlver.h
 endif
 endif
 
 if DOING_CURL_SYMBOL_HIDING
-libcurl_la_CPPFLAGS_EXTRA += -DCURL_HIDDEN_SYMBOLS
-libcurl_la_CFLAGS_EXTRA += $(CFLAG_CURL_SYMBOL_HIDING)
+libcurl_impersonate_la_CPPFLAGS_EXTRA += -DCURL_HIDDEN_SYMBOLS
+libcurl_impersonate_la_CFLAGS_EXTRA += $(CFLAG_CURL_SYMBOL_HIDING)
 endif
 
-libcurl_la_CPPFLAGS = $(AM_CPPFLAGS) $(libcurl_la_CPPFLAGS_EXTRA)
-libcurl_la_LDFLAGS = $(libcurl_la_LDFLAGS_EXTRA) $(CURL_LDFLAGS_LIB) $(LIBCURL_PC_LIBS_PRIVATE)
-libcurl_la_CFLAGS = $(libcurl_la_CFLAGS_EXTRA)
+libcurl_impersonate_la_CPPFLAGS = $(AM_CPPFLAGS) $(libcurl_impersonate_la_CPPFLAGS_EXTRA)
+libcurl_impersonate_la_LDFLAGS = $(libcurl_impersonate_la_LDFLAGS_EXTRA) $(CURL_LDFLAGS_LIB) $(LIBCURL_PC_LIBS_PRIVATE)
+libcurl_impersonate_la_CFLAGS = $(libcurl_impersonate_la_CFLAGS_EXTRA)
 
 libcurlu_la_CPPFLAGS = $(AM_CPPFLAGS) -DCURL_STATICLIB -DUNITTESTS
 libcurlu_la_LDFLAGS = -static $(LIBCURL_PC_LIBS_PRIVATE)
diff --git a/lib/Makefile.inc b/lib/Makefile.inc
index 266ba52af3..54608e8cc2 100644
--- a/lib/Makefile.inc
+++ b/lib/Makefile.inc
@@ -230,6 +230,7 @@ LIB_CFILES =         \
   idn.c              \
   if2ip.c            \
   imap.c             \
+  impersonate.c      \
   ldap.c             \
   llist.c            \
   macos.c            \
diff --git a/lib/cf-setup.c b/lib/cf-setup.c
index 119294a89a..f603800a1a 100644
--- a/lib/cf-setup.c
+++ b/lib/cf-setup.c
@@ -190,6 +190,15 @@ static CURLcode cf_setup_add_ip_happy(struct Curl_cfilter *cf,
     if(!first_peer)
       return CURLE_FAILED_INIT;
 
+#ifndef CURL_DISABLE_PROXY
+    /* curl-impersonate: QUIC over SOCKS first establishes the TCP control
+     * channel. The SOCKS filter later switches the data path to its UDP
+     * relay. */
+    if((ctx->transport == TRNSPRT_QUIC) &&
+       cf->conn->socks_proxy.peer && !cf->conn->http_proxy.peer)
+      first_transport = TRNSPRT_TCP;
+#endif
+
 #if !defined(CURL_DISABLE_PROXY) && !defined(CURL_DISABLE_HTTP)
     if(cf->conn->http_proxy.peer && !cf->conn->bits.origin_is_proxy) {
       first_transport =
@@ -258,6 +267,21 @@ static CURLcode cf_setup_add_origin_filters(struct Curl_cfilter *cf,
       }
       CURL_TRC_CF(data, cf, "added QUIC filter for origin");
     }
+    else if(ctx->transport == TRNSPRT_QUIC &&
+            cf->conn->socks_proxy.peer) {
+      struct Curl_peer *origin =
+        Curl_conn_get_origin(cf->conn, cf->sockindex);
+      struct Curl_peer *peer =
+        Curl_conn_get_destination(cf->conn, cf->sockindex);
+
+      result = Curl_cf_quic_insert_after(cf, origin, peer);
+      if(result) {
+        CURL_TRC_CF(data, cf, "adding QUIC over SOCKS failed -> %d",
+                    (int)result);
+        return result;
+      }
+      CURL_TRC_CF(data, cf, "added QUIC over SOCKS filter for origin");
+    }
     else
 #endif /* !CURL_DISABLE_HTTP && USE_HTTP3 && CURL_DISABLE_PROXY */
 #ifdef USE_SSL
diff --git a/lib/cf-socket.c b/lib/cf-socket.c
index 0741f2ba41..8fa6cfa667 100644
--- a/lib/cf-socket.c
+++ b/lib/cf-socket.c
@@ -1126,6 +1126,53 @@ static CURLcode set_remote_ip(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
+static bool is_internal_ip(const char *ip, int family)
+{
+  if(family == AF_INET) {
+    unsigned int addr;
+    if(1 != curlx_inet_pton(AF_INET, ip, &addr))
+      return FALSE;
+    addr = ntohl(addr);
+    /* 127.0.0.0/8 */
+    if((addr >> 24) == 127)
+      return TRUE;
+    /* 10.0.0.0/8 */
+    if((addr >> 24) == 10)
+      return TRUE;
+    /* 172.16.0.0/12 */
+    if((addr >> 20) == 0xac1) /* 172.16-31 */
+      return TRUE;
+    /* 192.168.0.0/16 */
+    if((addr >> 16) == 0xc0a8)
+      return TRUE;
+    /* 169.254.0.0/16 */
+    if((addr >> 16) == 0xa9fe)
+      return TRUE;
+  }
+#ifdef USE_IPV6
+  else if(family == AF_INET6) {
+    unsigned char addr[16];
+    if(1 != curlx_inet_pton(AF_INET6, ip, addr))
+      return FALSE;
+    /* ::1/128 */
+    {
+      static const unsigned char loopback[16] = {
+        0,0,0,0, 0,0,0,0, 0,0,0,0, 0,0,0,1
+      };
+      if(!memcmp(addr, loopback, 16))
+        return TRUE;
+    }
+    /* fc00::/7 - unique local */
+    if((addr[0] & 0xfe) == 0xfc)
+      return TRUE;
+    /* fe80::/10 - link-local */
+    if(addr[0] == 0xfe && (addr[1] & 0xc0) == 0x80)
+      return TRUE;
+  }
+#endif
+  return FALSE;
+}
+
 /* to figure out the type of the socket safely, remove the possibly ORed
    bits before comparing */
 static int cf_socktype(int x)
@@ -1171,6 +1218,16 @@ static CURLcode cf_socket_open(struct Curl_cfilter *cf,
   if(result)
     goto out;
 
+  /* curl-impersonate: SSRF protection, reject internal IPs on redirect */
+  if(data->set.http_follow_mode == CURLFOLLOW_SAFE &&
+     data->state.this_is_a_follow &&
+     is_internal_ip(ctx->ip.remote_ip, ctx->addr.family)) {
+    failf(data, "Redirect to internal IP %s rejected (SSRF protection)",
+          ctx->ip.remote_ip);
+    result = CURLE_COULDNT_CONNECT;
+    goto out;
+  }
+
 #ifdef USE_IPV6
   if(ctx->addr.family == AF_INET6) {
 #ifdef USE_WINSOCK
diff --git a/lib/cookie.c b/lib/cookie.c
index 91dc8d5fd0..7c50dd768b 100644
--- a/lib/cookie.c
+++ b/lib/cookie.c
@@ -44,6 +44,9 @@
 /* number of seconds in 400 days */
 #define COOKIES_MAXAGE (400 * 24 * 3600)
 
+static CURLcode record_cookie_change(struct Curl_easy *data,
+                                     const struct Cookie *co);
+
 /* Make sure cookies never expire further away in time than 400 days into the
    future. (from RFC6265bis draft-19)
 
@@ -980,7 +983,8 @@ CURLcode Curl_cookie_add(
   const char *domain,  /* default domain */
   const char *path,    /* full path used when this cookie is set, used
                           to get default path for the cookie unless set */
-  bool secure)         /* TRUE if connection is over secure origin */
+  bool secure,         /* TRUE if connection is over secure origin */
+  bool record)         /* TRUE for cookies received from a server */
 {
   struct Cookie comem;
   struct Cookie *co;
@@ -1074,6 +1078,12 @@ CURLcode Curl_cookie_add(
   if(co->expires && (co->expires < ci->next_expiration))
     ci->next_expiration = co->expires;
 
+  if(record) {
+    result = record_cookie_change(data, co);
+    if(result)
+      return result;
+  }
+
   if(httpheader)
     data->req.setcookies++;
 
@@ -1177,7 +1187,7 @@ static CURLcode cookie_load(struct Curl_easy *data, const char *file,
         }
 
         result = Curl_cookie_add(data, ci, headerline, TRUE, lineptr, NULL,
-                                 NULL, TRUE);
+                                 NULL, TRUE, FALSE);
         /* File reading cookie failures are not propagated back to the
            caller because there is no way to do that */
       }
@@ -1496,6 +1506,39 @@ static char *get_netscape_format(const struct Cookie *co)
     co->value ? co->value : "");
 }
 
+/* Record a normalized, accepted server cookie mutation for getinfo. */
+static CURLcode record_cookie_change(struct Curl_easy *data,
+                                     const struct Cookie *co)
+{
+  struct curl_slist *list;
+  const char *action = (co->expires &&
+                        co->expires < (curl_off_t)time(NULL)) ?
+    "DELETE" : "SET";
+  char *cookie = get_netscape_format(co);
+  char *change;
+
+  if(!cookie)
+    return CURLE_OUT_OF_MEMORY;
+
+  change = curl_maprintf("%s\t%s", action, cookie);
+  curlx_free(cookie);
+  if(!change)
+    return CURLE_OUT_OF_MEMORY;
+
+  list = Curl_slist_append_nodup(NULL, change);
+  if(!list) {
+    curlx_free(change);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  if(data->info.cookiechanges_tail)
+    data->info.cookiechanges_tail->next = list;
+  else
+    data->info.cookiechanges = list;
+  data->info.cookiechanges_tail = list;
+  return CURLE_OK;
+}
+
 /*
  * cookie_output()
  *
diff --git a/lib/cookie.h b/lib/cookie.h
index b8ef8b8ea1..6a514ef089 100644
--- a/lib/cookie.h
+++ b/lib/cookie.h
@@ -117,7 +117,8 @@ CURLcode Curl_cookie_add(struct Curl_easy *data,
                          const char *lineptr,
                          const char *domain,
                          const char *path,
-                         bool secure) WARN_UNUSED_RESULT;
+                         bool secure,
+                         bool record) WARN_UNUSED_RESULT;
 CURLcode Curl_cookie_getlist(struct Curl_easy *data,
                              bool *okay, const char *host,
                              struct Curl_llist *list) WARN_UNUSED_RESULT;
diff --git a/lib/dynhds.c b/lib/dynhds.c
index 097306cec9..e58b4e8c71 100644
--- a/lib/dynhds.c
+++ b/lib/dynhds.c
@@ -46,6 +46,9 @@ static struct dynhds_entry *entry_new(const char *name, size_t namelen,
   e->valuelen = valuelen;
   if(opts & DYNHDS_OPT_LOWERCASE)
     Curl_strntolower(e->name, e->name, e->namelen);
+  // curl-impersonate: Make header value also lower case
+  if(opts & DYNHDS_OPT_LOWERCASE_VAL)
+    Curl_strntolower(e->value, e->value, e->valuelen);
   return e;
 }
 
@@ -104,6 +107,19 @@ void Curl_dynhds_set_opts(struct dynhds *dynhds, int opts)
   dynhds->opts = opts;
 }
 
+// curl-impersonate
+void Curl_dynhds_set_opt(struct dynhds *dynhds, int opt)
+{
+  dynhds->opts |= opt;
+}
+
+// curl-impersonate
+void Curl_dynhds_del_opt(struct dynhds *dynhds, int opt)
+{
+  dynhds->opts &= ~opt;
+}
+
+
 struct dynhds_entry *Curl_dynhds_getn(struct dynhds *dynhds, size_t n)
 {
   DEBUGASSERT(dynhds);
diff --git a/lib/dynhds.h b/lib/dynhds.h
index d5337eb353..b2fb669979 100644
--- a/lib/dynhds.h
+++ b/lib/dynhds.h
@@ -52,6 +52,7 @@ struct dynhds {
 
 #define DYNHDS_OPT_NONE          0
 #define DYNHDS_OPT_LOWERCASE     (1 << 0)
+#define DYNHDS_OPT_LOWERCASE_VAL (1 << 1)
 
 /**
  * Init for use on first time or after a reset.
@@ -81,6 +82,9 @@ size_t Curl_dynhds_count(struct dynhds *dynhds);
  * This will not have an effect on already existing headers.
  */
 void Curl_dynhds_set_opts(struct dynhds *dynhds, int opts);
+// curl-impersonate
+void Curl_dynhds_set_opt(struct dynhds *dynhds, int opt);
+void Curl_dynhds_del_opt(struct dynhds *dynhds, int opt);
 
 /**
  * Return the n-th header entry or NULL if it does not exist.
diff --git a/lib/easy.c b/lib/easy.c
index d60bdaed7b..fe9d1e7517 100644
--- a/lib/easy.c
+++ b/lib/easy.c
@@ -70,10 +70,14 @@
 #include "setopt.h"
 #include "http_digest.h"
 #include "system_win32.h"
+#include "http2.h"
+#include "rand.h"
 #include "curlx/dynbuf.h"
 #include "bufref.h"
 #include "altsvc.h"
 #include "hsts.h"
+#include "strcase.h"
+#include "impersonate.h"
 
 #include "easy_lock.h"
 
@@ -323,6 +327,389 @@ CURLsslset curl_global_sslset(curl_sslbackend id, const char *name,
   return rc;
 }
 
+
+/*
+ * curl-impersonate: Actually call curl_easy_setopt() with all the needed options
+ */
+static CURLcode _do_impersonate(struct Curl_easy *data,
+                        const struct impersonate_opts *opts,
+                        int default_headers)
+{
+  int i;
+  int ret;
+  struct curl_slist *headers = NULL;
+
+  if(opts->target == NULL) {
+    DEBUGF(fprintf(stderr, "Error: unknown impersonation target '%s'\n",
+                   opts->target));
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  // Prefer user set versions
+  long selected_http_version;
+  if (data->set.httpwant != CURL_HTTP_VERSION_NONE) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP_VERSION, data->set.httpwant);
+    selected_http_version = data->set.httpwant;
+  } else {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP_VERSION, opts->httpversion);
+    selected_http_version = opts->httpversion;
+  }
+
+  if(ret)
+    return ret;
+
+  // Use impersonate ssl_version if user didn't set it.
+  // QUIC inherently uses TLS 1.3, enforced in the QUIC TLS setup.
+  if(!data->set.ssl_version_set &&
+     (opts->ssl_version != CURL_SSLVERSION_DEFAULT)) {
+    ret = curl_easy_setopt(data, CURLOPT_SSLVERSION, opts->ssl_version);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->ciphers) {
+    ret = curl_easy_setopt(data, CURLOPT_SSL_CIPHER_LIST, opts->ciphers);
+    if (ret)
+      return ret;
+  }
+
+  if(opts->curves) {
+    ret = curl_easy_setopt(data, CURLOPT_SSL_EC_CURVES, opts->curves);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http3_curves) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP3_SSL_EC_CURVES,
+                           opts->http3_curves);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->sig_hash_algs) {
+    ret = curl_easy_setopt(data, CURLOPT_SSL_SIGNATURE_ALGORITHMS,
+                           opts->sig_hash_algs);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http3_sig_hash_algs) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP3_SIG_HASH_ALGS,
+                           opts->http3_sig_hash_algs);
+    if(ret)
+      return ret;
+  }
+
+  // TODO: remove npn, which has been deprecated by curl
+  ret = curl_easy_setopt(data, CURLOPT_SSL_ENABLE_NPN, opts->npn ? 1 : 0);
+  if(ret)
+    return ret;
+
+  ret = curl_easy_setopt(data, CURLOPT_SSL_ENABLE_ALPN, opts->alpn ? 1 : 0);
+  if(ret)
+    return ret;
+
+  ret = curl_easy_setopt(data, CURLOPT_SSL_ENABLE_ALPS, opts->alps ? 1 : 0);
+  if(ret)
+    return ret;
+
+  ret = curl_easy_setopt(data, CURLOPT_SSL_ENABLE_TICKET,
+                         opts->tls_session_ticket ? 1 : 0);
+  if(ret)
+    return ret;
+
+  if(opts->ws_disable_session_ticket) {
+    ret = curl_easy_setopt(data, CURLOPT_WS_SSL_DISABLE_TICKET, 1L);
+    if(ret)
+      return ret;
+  }
+
+  // always enable this for browsers
+  ret = curl_easy_setopt(data, CURLOPT_TLS_SIGNED_CERT_TIMESTAMPS, 1);
+  if(ret)
+    return ret;
+
+  // always enable this for browsers
+  ret = curl_easy_setopt(data, CURLOPT_TLS_STATUS_REQUEST, 1);
+  if(ret)
+    return ret;
+
+  if(opts->tls_permute_extensions) {
+    ret = curl_easy_setopt(data, CURLOPT_SSL_PERMUTE_EXTENSIONS, 1);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->cert_compression) {
+    ret = curl_easy_setopt(data,
+                           CURLOPT_SSL_CERT_COMPRESSION,
+                           opts->cert_compression);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->ws_cert_compression) {
+    ret = curl_easy_setopt(data,
+                           CURLOPT_WS_SSL_CERT_COMPRESSION,
+                           opts->ws_cert_compression);
+    if(ret)
+      return ret;
+  }
+
+  if(default_headers) {
+    /* Build a linked list out of the static array of headers. */
+    for(i = 0; i < IMPERSONATE_MAX_HEADERS; i++) {
+      if(opts->http_headers[i]) {
+        headers = curl_slist_append(headers, opts->http_headers[i]);
+        if(!headers) {
+          return CURLE_OUT_OF_MEMORY;
+        }
+      }
+    }
+
+    if(headers) {
+      ret = curl_easy_setopt(data, CURLOPT_HTTPBASEHEADER, headers);
+      curl_slist_free_all(headers);
+      if(ret)
+        return ret;
+    }
+  }
+
+  if(opts->http2_pseudo_headers_order) {
+    ret = curl_easy_setopt(data,
+                           CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER,
+                           opts->http2_pseudo_headers_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http2_settings) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP2_SETTINGS, opts->http2_settings);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http_header_order) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTPHEADER_ORDER,
+                           opts->http_header_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http3_http_header_order) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP3_HTTPHEADER_ORDER,
+                           opts->http3_http_header_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->ws_http_header_order) {
+    ret = curl_easy_setopt(data, CURLOPT_WS_HTTPHEADER_ORDER,
+                           opts->ws_http_header_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http3_pseudo_headers_order) {
+    ret = curl_easy_setopt(data,
+                           CURLOPT_HTTP3_PSEUDO_HEADERS_ORDER,
+                           opts->http3_pseudo_headers_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http3_settings) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP3_SETTINGS, opts->http3_settings);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->quic_transport_parameters) {
+    ret = curl_easy_setopt(data, CURLOPT_QUIC_TRANSPORT_PARAMETERS,
+                           opts->quic_transport_parameters);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http2_window_update) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP2_WINDOW_UPDATE, opts->http2_window_update);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http2_streams) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP2_STREAMS, opts->http2_streams);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http2_no_priority) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP2_NO_PRIORITY, opts->http2_no_priority);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->ech) {
+    ret = curl_easy_setopt(data, CURLOPT_ECH, opts->ech);
+    if(ret)
+      return ret;
+  }
+
+  ret = curl_easy_setopt(data, CURLOPT_TLS_GREASE, opts->tls_grease);
+  if(ret)
+    return ret;
+
+  if(opts->tls_extension_order) {
+    ret = curl_easy_setopt(data, CURLOPT_TLS_EXTENSION_ORDER,
+                           opts->tls_extension_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http3_tls_extension_order) {
+    ret = curl_easy_setopt(data, CURLOPT_HTTP3_TLS_EXTENSION_ORDER,
+                           opts->http3_tls_extension_order);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->tls_delegated_credentials) {
+    ret = curl_easy_setopt(data, CURLOPT_TLS_DELEGATED_CREDENTIALS, opts->tls_delegated_credentials);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->tls_record_size_limit) {
+    ret = curl_easy_setopt(data, CURLOPT_TLS_RECORD_SIZE_LIMIT, opts->tls_record_size_limit);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->tls_key_shares_limit) {
+    ret = curl_easy_setopt(data, CURLOPT_TLS_KEY_SHARES_LIMIT, opts->tls_key_shares_limit);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->tls_use_new_alps_codepoint) {
+    ret = curl_easy_setopt(data, CURLOPT_TLS_USE_NEW_ALPS_CODEPOINT, opts->tls_use_new_alps_codepoint);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http2_stream_weight) {
+    ret = curl_easy_setopt(data, CURLOPT_STREAM_WEIGHT, opts->http2_stream_weight);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->http2_stream_exclusive) {
+    ret = curl_easy_setopt(data, CURLOPT_STREAM_EXCLUSIVE, opts->http2_stream_exclusive);
+    if(ret)
+      return ret;
+  }
+
+  if(opts->proxy_credential_no_reuse) {
+    ret = curl_easy_setopt(data, CURLOPT_PROXY_CREDENTIAL_NO_REUSE, opts->proxy_credential_no_reuse);
+    if(ret)
+      return ret;
+  }
+
+  ret = curl_easy_setopt(data, CURLOPT_SPLIT_COOKIES,
+                         opts->split_cookies ? 1L : 0L);
+  if(ret)
+    return ret;
+
+  if(opts->form_boundary) {
+    ret = curl_easy_setopt(data, CURLOPT_FORM_BOUNDARY,
+                           opts->form_boundary);
+    if(ret)
+      return ret;
+  }
+
+  return CURLE_OK;
+}
+
+
+/*
+ * curl-impersonate:
+ * Call curl_easy_setopt() with all the needed options as defined by the target
+ * */
+CURLcode curl_easy_impersonate_customized(struct Curl_easy *data,
+                                          const struct impersonate_opts *opts,
+                                          int default_headers)
+{
+  int ret;
+
+  ret = _do_impersonate(data, opts, default_headers);
+  if(ret)
+    return ret;
+
+  return CURLE_OK;
+}
+
+
+static const struct impersonate_opts *binary_search(size_t size, const char *key)
+{
+  int low = 0;
+  int high = size - 1;
+
+  while(low <= high) {
+    int mid = low + (high - low) / 2;
+    int cmp = strcmp(impersonations[mid].target, key);
+
+    if(cmp == 0) {
+      return &impersonations[mid];
+    } else if(cmp < 0) {
+      low = mid + 1;
+    } else {
+      high = mid - 1;
+    }
+  }
+
+  return NULL;
+}
+
+/*
+ * curl-impersonate:
+ * Call curl_easy_setopt() with all the needed options as defined in the
+ * 'impersonations' array.
+ * */
+CURLcode curl_easy_impersonate(CURL *data, const char *target,
+                               int default_headers)
+{
+  int ret;
+  const struct impersonate_opts *opts = NULL;
+  struct Curl_easy *_data = (struct Curl_easy *)data;
+
+  opts = binary_search(num_impersonations, target);
+
+  // If not found, fallback and search by alias again
+  if(opts == NULL) {
+    for(int i = 0; i < num_impersonations; ++i) {
+      if (curl_strequal(target, impersonations[i].alias)) {
+        opts = impersonations + i;
+        break;
+      }
+    }
+  }
+
+  if(opts == NULL) {
+    failf(_data, "Unknown impersonation target '%s'. "
+          "Use a valid --impersonate target such as firefox147.", target);
+    DEBUGF(fprintf(stderr, "Error: unknown impersonation target '%s'\n",
+                   target));
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  ret = _do_impersonate(_data, opts, default_headers);
+  if(ret)
+    return ret;
+
+  return CURLE_OK;
+}
+
+
 /*
  * curl_easy_init() is the external interface to alloc, setup and init an
  * easy handle that is returned. If anything goes wrong, NULL is returned.
@@ -331,6 +718,8 @@ CURL *curl_easy_init(void)
 {
   CURLcode result;
   struct Curl_easy *data;
+  char *env_target = NULL;
+  char *env_headers = NULL;
 
   /* Make sure we inited the global SSL stuff */
   global_init_lock();
@@ -353,6 +742,30 @@ CURL *curl_easy_init(void)
     return NULL;
   }
 
+  /*
+   * curl-impersonate: Hook into curl_easy_init() to set the required options
+   * from an environment variable.
+   * This is a bit hacky but allows seamless integration of libcurl-impersonate
+   * without code modifications to the app.
+   */
+  env_target = curl_getenv("CURL_IMPERSONATE");
+  if(env_target) {
+    env_headers = curl_getenv("CURL_IMPERSONATE_HEADERS");
+    if(env_headers) {
+      result = curl_easy_impersonate(data, env_target,
+                                     !curl_strequal(env_headers, "no"));
+      curlx_free(env_headers);
+    }
+    else {
+      result = curl_easy_impersonate(data, env_target, TRUE);
+    }
+    curlx_free(env_target);
+    if(result) {
+      Curl_close(&data);
+      return NULL;
+    }
+  }
+
   return data;
 }
 
@@ -1027,6 +1440,13 @@ CURL *curl_easy_duphandle(CURL *curl)
       goto fail;
   }
 
+  if(data->state.base_headers) {
+    outcurl->state.base_headers =
+      Curl_slist_duplicate(data->state.base_headers);
+    if(!outcurl->state.base_headers)
+      goto fail;
+  }
+
   /* Reinitialize an SSL engine for the new handle
    * note: the engine name has already been copied by dupset */
   if(outcurl->set.str[STRING_SSL_ENGINE]) {
@@ -1088,6 +1508,9 @@ fail:
  */
 void curl_easy_reset(CURL *curl)
 {
+  char *env_target;
+  char *env_headers;
+
   struct Curl_easy *data = curl;
   if(!GOOD_EASY_HANDLE(data))
     return;
@@ -1120,6 +1543,23 @@ void curl_easy_reset(CURL *curl)
   Curl_http_auth_cleanup_digest(data);
 #endif
   data->master_mid = UINT32_MAX;
+  /*
+   * curl-impersonate: Hook into curl_easy_reset() to set the required options
+   * from an environment variable, just like in curl_easy_init().
+   */
+  env_target = curl_getenv("CURL_IMPERSONATE");
+  if(env_target) {
+    env_headers = curl_getenv("CURL_IMPERSONATE_HEADERS");
+    if(env_headers) {
+      curl_easy_impersonate(data, env_target,
+                            !curl_strequal(env_headers, "no"));
+      curlx_free(env_headers);
+    }
+    else {
+      curl_easy_impersonate(data, env_target, TRUE);
+    }
+    curlx_free(env_target);
+  }
 }
 
 /*
diff --git a/lib/easyoptions.c b/lib/easyoptions.c
index 4c0b4f0ce4..31afae471b 100644
--- a/lib/easyoptions.c
+++ b/lib/easyoptions.c
@@ -99,6 +99,7 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "FNMATCH_FUNCTION", CURLOPT_FNMATCH_FUNCTION, CURLOT_FUNCTION, 0 },
   { "FOLLOWLOCATION", CURLOPT_FOLLOWLOCATION, CURLOT_LONG, 0 },
   { "FORBID_REUSE", CURLOPT_FORBID_REUSE, CURLOT_LONG, 0 },
+  { "FORM_BOUNDARY", CURLOPT_FORM_BOUNDARY, CURLOT_STRING, 0 },
   { "FRESH_CONNECT", CURLOPT_FRESH_CONNECT, CURLOT_LONG, 0 },
   { "FTPAPPEND", CURLOPT_APPEND, CURLOT_LONG, CURLOT_FLAG_ALIAS },
   { "FTPLISTONLY", CURLOPT_DIRLISTONLY, CURLOT_LONG, CURLOT_FLAG_ALIAS },
@@ -135,9 +136,27 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "HSTS_CTRL", CURLOPT_HSTS_CTRL, CURLOT_LONG, 0 },
   { "HTTP09_ALLOWED", CURLOPT_HTTP09_ALLOWED, CURLOT_LONG, 0 },
   { "HTTP200ALIASES", CURLOPT_HTTP200ALIASES, CURLOT_SLIST, 0 },
+  { "HTTP2_NO_PRIORITY", CURLOPT_HTTP2_NO_PRIORITY, CURLOT_LONG, 0 },
+  { "HTTP2_PSEUDO_HEADERS_ORDER", CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER,
+    CURLOT_STRING, 0 },
+  { "HTTP2_SETTINGS", CURLOPT_HTTP2_SETTINGS, CURLOT_STRING, 0 },
+  { "HTTP2_STREAMS", CURLOPT_HTTP2_STREAMS, CURLOT_STRING, 0 },
+  { "HTTP2_WINDOW_UPDATE", CURLOPT_HTTP2_WINDOW_UPDATE, CURLOT_LONG, 0 },
+  { "HTTP3_HTTPHEADER", CURLOPT_HTTP3_HTTPHEADER, CURLOT_SLIST, 0 },
+  { "HTTP3_HTTPHEADER_ORDER", CURLOPT_HTTP3_HTTPHEADER_ORDER,
+    CURLOT_STRING, 0 },
+  { "HTTP3_PSEUDO_HEADERS_ORDER", CURLOPT_HTTP3_PSEUDO_HEADERS_ORDER,
+    CURLOT_STRING, 0 },
+  { "HTTP3_SETTINGS", CURLOPT_HTTP3_SETTINGS, CURLOT_STRING, 0 },
+  { "HTTP3_SIG_HASH_ALGS", CURLOPT_HTTP3_SIG_HASH_ALGS, CURLOT_STRING, 0 },
+  { "HTTP3_SSL_EC_CURVES", CURLOPT_HTTP3_SSL_EC_CURVES, CURLOT_STRING, 0 },
+  { "HTTP3_TLS_EXTENSION_ORDER", CURLOPT_HTTP3_TLS_EXTENSION_ORDER,
+    CURLOT_STRING, 0 },
   { "HTTPAUTH", CURLOPT_HTTPAUTH, CURLOT_VALUES, 0 },
+  { "HTTPBASEHEADER", CURLOPT_HTTPBASEHEADER, CURLOT_SLIST, 0 },
   { "HTTPGET", CURLOPT_HTTPGET, CURLOT_LONG, 0 },
   { "HTTPHEADER", CURLOPT_HTTPHEADER, CURLOT_SLIST, 0 },
+  { "HTTPHEADER_ORDER", CURLOPT_HTTPHEADER_ORDER, CURLOT_STRING, 0 },
   { "HTTPPOST", CURLOPT_HTTPPOST, CURLOT_OBJECT, 0 },
   { "HTTPPROXYTUNNEL", CURLOPT_HTTPPROXYTUNNEL, CURLOT_LONG, 0 },
   { "HTTP_CONTENT_DECODING", CURLOPT_HTTP_CONTENT_DECODING, CURLOT_LONG, 0 },
@@ -145,6 +164,7 @@ const struct curl_easyoption Curl_easyopts[] = {
     CURLOT_LONG, 0 },
   { "HTTP_VERSION", CURLOPT_HTTP_VERSION, CURLOT_VALUES, 0 },
   { "IGNORE_CONTENT_LENGTH", CURLOPT_IGNORE_CONTENT_LENGTH, CURLOT_LONG, 0 },
+  { "IMPERSONATE", CURLOPT_IMPERSONATE, CURLOT_STRING, 0 },
   { "INFILE", CURLOPT_READDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS },
   { "INFILESIZE", CURLOPT_INFILESIZE, CURLOT_LONG, 0 },
   { "INFILESIZE_LARGE", CURLOPT_INFILESIZE_LARGE, CURLOT_OFF_T, 0 },
@@ -223,6 +243,8 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "PROXY_CAINFO", CURLOPT_PROXY_CAINFO, CURLOT_STRING, 0 },
   { "PROXY_CAINFO_BLOB", CURLOPT_PROXY_CAINFO_BLOB, CURLOT_BLOB, 0 },
   { "PROXY_CAPATH", CURLOPT_PROXY_CAPATH, CURLOT_STRING, 0 },
+  { "PROXY_CREDENTIAL_NO_REUSE", CURLOPT_PROXY_CREDENTIAL_NO_REUSE,
+    CURLOT_LONG, 0 },
   { "PROXY_CRLFILE", CURLOPT_PROXY_CRLFILE, CURLOT_STRING, 0 },
   { "PROXY_ISSUERCERT", CURLOPT_PROXY_ISSUERCERT, CURLOT_STRING, 0 },
   { "PROXY_ISSUERCERT_BLOB", CURLOPT_PROXY_ISSUERCERT_BLOB, CURLOT_BLOB, 0 },
@@ -251,6 +273,8 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "PROXY_TRANSFER_MODE", CURLOPT_PROXY_TRANSFER_MODE, CURLOT_LONG, 0 },
   { "PUT", CURLOPT_PUT, CURLOT_LONG, 0 },
   { "QUICK_EXIT", CURLOPT_QUICK_EXIT, CURLOT_LONG, 0 },
+  { "QUIC_TRANSPORT_PARAMETERS", CURLOPT_QUIC_TRANSPORT_PARAMETERS,
+    CURLOT_STRING, 0 },
   { "QUOTE", CURLOPT_QUOTE, CURLOT_SLIST, 0 },
   { "RANDOM_FILE", CURLOPT_RANDOM_FILE, CURLOT_STRING, 0 },
   { "RANGE", CURLOPT_RANGE, CURLOT_STRING, 0 },
@@ -289,6 +313,7 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "SOCKS5_GSSAPI_NEC", CURLOPT_SOCKS5_GSSAPI_NEC, CURLOT_LONG, 0 },
   { "SOCKS5_GSSAPI_SERVICE", CURLOPT_SOCKS5_GSSAPI_SERVICE,
     CURLOT_STRING, 0 },
+  { "SPLIT_COOKIES", CURLOPT_SPLIT_COOKIES, CURLOT_LONG, 0 },
   { "SSH_AUTH_TYPES", CURLOPT_SSH_AUTH_TYPES, CURLOT_VALUES, 0 },
   { "SSH_COMPRESSION", CURLOPT_SSH_COMPRESSION, CURLOT_LONG, 0 },
   { "SSH_HOSTKEYDATA", CURLOPT_SSH_HOSTKEYDATA, CURLOT_CBPTR, 0 },
@@ -313,23 +338,30 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "SSLKEYTYPE", CURLOPT_SSLKEYTYPE, CURLOT_STRING, 0 },
   { "SSLKEY_BLOB", CURLOPT_SSLKEY_BLOB, CURLOT_BLOB, 0 },
   { "SSLVERSION", CURLOPT_SSLVERSION, CURLOT_VALUES, 0 },
+  { "SSL_CERT_COMPRESSION", CURLOPT_SSL_CERT_COMPRESSION, CURLOT_STRING, 0 },
   { "SSL_CIPHER_LIST", CURLOPT_SSL_CIPHER_LIST, CURLOT_STRING, 0 },
   { "SSL_CTX_DATA", CURLOPT_SSL_CTX_DATA, CURLOT_CBPTR, 0 },
   { "SSL_CTX_FUNCTION", CURLOPT_SSL_CTX_FUNCTION, CURLOT_FUNCTION, 0 },
   { "SSL_EC_CURVES", CURLOPT_SSL_EC_CURVES, CURLOT_STRING, 0 },
   { "SSL_ENABLE_ALPN", CURLOPT_SSL_ENABLE_ALPN, CURLOT_LONG, 0 },
+  { "SSL_ENABLE_ALPS", CURLOPT_SSL_ENABLE_ALPS, CURLOT_LONG, 0 },
   { "SSL_ENABLE_NPN", CURLOPT_SSL_ENABLE_NPN, CURLOT_LONG, 0 },
+  { "SSL_ENABLE_TICKET", CURLOPT_SSL_ENABLE_TICKET, CURLOT_LONG, 0 },
   { "SSL_FALSESTART", CURLOPT_SSL_FALSESTART, CURLOT_LONG, 0 },
   { "SSL_OPTIONS", CURLOPT_SSL_OPTIONS, CURLOT_VALUES, 0 },
+  { "SSL_PERMUTE_EXTENSIONS", CURLOPT_SSL_PERMUTE_EXTENSIONS,
+    CURLOT_LONG, 0 },
   { "SSL_SESSIONID_CACHE", CURLOPT_SSL_SESSIONID_CACHE, CURLOT_LONG, 0 },
   { "SSL_SIGNATURE_ALGORITHMS", CURLOPT_SSL_SIGNATURE_ALGORITHMS,
     CURLOT_STRING, 0 },
+  { "SSL_SIG_HASH_ALGS", CURLOPT_SSL_SIG_HASH_ALGS, CURLOT_STRING, 0 },
   { "SSL_VERIFYHOST", CURLOPT_SSL_VERIFYHOST, CURLOT_LONG, 0 },
   { "SSL_VERIFYPEER", CURLOPT_SSL_VERIFYPEER, CURLOT_LONG, 0 },
   { "SSL_VERIFYSTATUS", CURLOPT_SSL_VERIFYSTATUS, CURLOT_LONG, 0 },
   { "STDERR", CURLOPT_STDERR, CURLOT_OBJECT, 0 },
   { "STREAM_DEPENDS", CURLOPT_STREAM_DEPENDS, CURLOT_OBJECT, 0 },
   { "STREAM_DEPENDS_E", CURLOPT_STREAM_DEPENDS_E, CURLOT_OBJECT, 0 },
+  { "STREAM_EXCLUSIVE", CURLOPT_STREAM_EXCLUSIVE, CURLOT_LONG, 0 },
   { "STREAM_WEIGHT", CURLOPT_STREAM_WEIGHT, CURLOT_LONG, 0 },
   { "SUPPRESS_CONNECT_HEADERS", CURLOPT_SUPPRESS_CONNECT_HEADERS,
     CURLOT_LONG, 0 },
@@ -351,6 +383,19 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "TLSAUTH_PASSWORD", CURLOPT_TLSAUTH_PASSWORD, CURLOT_STRING, 0 },
   { "TLSAUTH_TYPE", CURLOPT_TLSAUTH_TYPE, CURLOT_STRING, 0 },
   { "TLSAUTH_USERNAME", CURLOPT_TLSAUTH_USERNAME, CURLOT_STRING, 0 },
+  { "TLS_DELEGATED_CREDENTIALS", CURLOPT_TLS_DELEGATED_CREDENTIALS,
+    CURLOT_STRING, 0 },
+  { "TLS_EXTENSION_ORDER", CURLOPT_TLS_EXTENSION_ORDER, CURLOT_STRING, 0 },
+  { "TLS_GREASE", CURLOPT_TLS_GREASE, CURLOT_LONG, 0 },
+  { "TLS_KEY_SHARES_LIMIT", CURLOPT_TLS_KEY_SHARES_LIMIT, CURLOT_LONG, 0 },
+  { "TLS_KEY_USAGE_NO_CHECK", CURLOPT_TLS_KEY_USAGE_NO_CHECK,
+    CURLOT_LONG, 0 },
+  { "TLS_RECORD_SIZE_LIMIT", CURLOPT_TLS_RECORD_SIZE_LIMIT, CURLOT_LONG, 0 },
+  { "TLS_SIGNED_CERT_TIMESTAMPS", CURLOPT_TLS_SIGNED_CERT_TIMESTAMPS,
+    CURLOT_LONG, 0 },
+  { "TLS_STATUS_REQUEST", CURLOPT_TLS_STATUS_REQUEST, CURLOT_LONG, 0 },
+  { "TLS_USE_NEW_ALPS_CODEPOINT", CURLOPT_TLS_USE_NEW_ALPS_CODEPOINT,
+    CURLOT_LONG, 0 },
   { "TRAILERDATA", CURLOPT_TRAILERDATA, CURLOT_CBPTR, 0 },
   { "TRAILERFUNCTION", CURLOPT_TRAILERFUNCTION, CURLOT_FUNCTION, 0 },
   { "TRANSFERTEXT", CURLOPT_TRANSFERTEXT, CURLOT_LONG, 0 },
@@ -371,7 +416,12 @@ const struct curl_easyoption Curl_easyopts[] = {
   { "WRITEDATA", CURLOPT_WRITEDATA, CURLOT_CBPTR, 0 },
   { "WRITEFUNCTION", CURLOPT_WRITEFUNCTION, CURLOT_FUNCTION, 0 },
   { "WRITEHEADER", CURLOPT_HEADERDATA, CURLOT_CBPTR, CURLOT_FLAG_ALIAS },
+  { "WS_HTTPHEADER", CURLOPT_WS_HTTPHEADER, CURLOT_SLIST, 0 },
+  { "WS_HTTPHEADER_ORDER", CURLOPT_WS_HTTPHEADER_ORDER, CURLOT_STRING, 0 },
   { "WS_OPTIONS", CURLOPT_WS_OPTIONS, CURLOT_LONG, 0 },
+  { "WS_SSL_CERT_COMPRESSION", CURLOPT_WS_SSL_CERT_COMPRESSION,
+    CURLOT_STRING, 0 },
+  { "WS_SSL_DISABLE_TICKET", CURLOPT_WS_SSL_DISABLE_TICKET, CURLOT_LONG, 0 },
   { "XFERINFODATA", CURLOPT_XFERINFODATA, CURLOT_CBPTR, 0 },
   { "XFERINFOFUNCTION", CURLOPT_XFERINFOFUNCTION, CURLOT_FUNCTION, 0 },
   { "XOAUTH2_BEARER", CURLOPT_XOAUTH2_BEARER, CURLOT_STRING, 0 },
@@ -385,6 +435,6 @@ const struct curl_easyoption Curl_easyopts[] = {
  */
 int Curl_easyopts_check(void)
 {
-  return (CURLOPT_LASTENTRY % 10000) != (328 + 1);
+  return (CURLOPT_LASTENTRY % 10000) != (1037 + 1);
 }
 #endif
diff --git a/lib/getinfo.c b/lib/getinfo.c
index fde4aa4ef2..18dd6ec953 100644
--- a/lib/getinfo.c
+++ b/lib/getinfo.c
@@ -29,8 +29,39 @@
 #include "vtls/vtls.h"
 #include "connect.h" /* Curl_getconnectinfo() */
 #include "bufref.h"
+#include "slist.h"
 #include "curlx/strparse.h"
 
+void Curl_free_redirects(struct Curl_easy *data)
+{
+  curl_slist_free_all(data->info.redirect_history);
+  data->info.redirect_history = NULL;
+  data->info.redirect_history_tail = NULL;
+}
+
+CURLcode Curl_add_redirect(struct Curl_easy *data, const char *url,
+                           long status_code)
+{
+  struct curl_slist *list;
+  char *entry = curl_maprintf("%ld\t%s", status_code, url);
+
+  if(!entry)
+    return CURLE_OUT_OF_MEMORY;
+
+  list = Curl_slist_append_nodup(NULL, entry);
+  if(!list) {
+    curlx_free(entry);
+    return CURLE_OUT_OF_MEMORY;
+  }
+
+  if(data->info.redirect_history_tail)
+    data->info.redirect_history_tail->next = list;
+  else
+    data->info.redirect_history = list;
+  data->info.redirect_history_tail = list;
+  return CURLE_OK;
+}
+
 /*
  * Initialize statistical and informational data.
  *
@@ -69,6 +100,10 @@ void Curl_initinfo(struct Curl_easy *data)
 
   curlx_safefree(info->contenttype);
   curlx_safefree(info->wouldredirect);
+  curl_slist_free_all(info->cookiechanges);
+  info->cookiechanges = NULL;
+  info->cookiechanges_tail = NULL;
+  Curl_free_redirects(data);
 
   memset(&info->primary, 0, sizeof(info->primary));
   info->retry_after = 0;
@@ -575,12 +610,22 @@ static CURLcode getinfo_slist(struct Curl_easy *data, CURLINFO info,
   case CURLINFO_COOKIELIST:
     *param_slistp = Curl_cookie_list(data);
     break;
+  case CURLINFO_COOKIECHANGES:
+    *param_slistp = Curl_slist_duplicate(data->info.cookiechanges);
+    if(data->info.cookiechanges && !*param_slistp)
+      return CURLE_OUT_OF_MEMORY;
+    break;
   case CURLINFO_CERTINFO:
     /* Return the a pointer to the certinfo struct. Not really an slist
        pointer but we can pretend it is here */
     ptr.to_certinfo = &data->info.certs;
     *param_slistp = ptr.to_slist;
     break;
+  case CURLINFO_REDIRECT_HISTORY:
+    *param_slistp = Curl_slist_duplicate(data->info.redirect_history);
+    if(data->info.redirect_history && !*param_slistp)
+      return CURLE_OUT_OF_MEMORY;
+    break;
   case CURLINFO_TLS_SESSION:
   case CURLINFO_TLS_SSL_PTR: {
     int query = (info == CURLINFO_TLS_SSL_PTR) ?
diff --git a/lib/getinfo.h b/lib/getinfo.h
index f5efe4185c..0b7ccc509f 100644
--- a/lib/getinfo.h
+++ b/lib/getinfo.h
@@ -25,5 +25,8 @@
  ***************************************************************************/
 CURLcode Curl_getinfo(struct Curl_easy *data, CURLINFO info, ...);
 void Curl_initinfo(struct Curl_easy *data);
+CURLcode Curl_add_redirect(struct Curl_easy *data, const char *url,
+                           long status_code);
+void Curl_free_redirects(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_GETINFO_H */
diff --git a/lib/http.c b/lib/http.c
index 83d0e01152..781b063685 100644
--- a/lib/http.c
+++ b/lib/http.c
@@ -48,6 +48,7 @@
 #endif
 
 #include "transfer.h"
+#include "getinfo.h"
 #include "sendf.h"
 #include "curl_trc.h"
 #include "formdata.h"
@@ -82,9 +83,10 @@
 #include "hsts.h"
 #include "rtsp.h"
 #include "ws.h"
+#include "curl_ctype.h"
+#include "slist.h"
 #include "bufref.h"
 #include "curlx/strparse.h"
-
 void Curl_http_neg_init(struct Curl_easy *data, struct http_negotiation *neg)
 {
   memset(neg, 0, sizeof(*neg));
@@ -1268,6 +1270,17 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
     return CURLE_OK;
   }
 
+  if((type == FOLLOW_REDIR) &&
+     (data->req.httpcode >= 300) && (data->req.httpcode < 400)) {
+    CURLcode result = Curl_add_redirect(data,
+                                        Curl_bufref_ptr(&data->state.url),
+                                        (long)data->req.httpcode);
+    if(result) {
+      curl_free(follow_url);
+      return result;
+    }
+  }
+
   if(disallowport)
     data->state.allow_port = FALSE;
 
@@ -1735,6 +1748,12 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
   int numlists = 1; /* by default */
   int i;
 
+  /*
+   * curl-impersonate: Use the merged list of headers if it exists (i.e. when
+   * the CURLOPT_HTTPBASEHEADER option was set.
+   */
+  struct curl_slist *noproxyheaders = Curl_http_request_headers(data);
+
 #ifndef CURL_DISABLE_PROXY
   enum Curl_proxy_use proxy;
 
@@ -1745,10 +1764,11 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
 
   switch(proxy) {
   case HEADER_SERVER:
-    h[0] = data->set.headers;
+    h[0] = noproxyheaders;
+
     break;
   case HEADER_PROXY:
-    h[0] = data->set.headers;
+    h[0] = noproxyheaders;
     if(data->set.sep_headers) {
       h[1] = data->set.proxyheaders;
       numlists++;
@@ -1758,7 +1778,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
     if(data->set.sep_headers)
       h[0] = data->set.proxyheaders;
     else
-      h[0] = data->set.headers;
+      h[0] = noproxyheaders;
     break;
   case HEADER_CONNECT_UDP:
     if(data->set.sep_headers)
@@ -1769,7 +1789,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
   }
 #else
   (void)is_connect;
-  h[0] = data->set.headers;
+  h[0] = noproxyheaders;
 #endif
 
   /* loop through one or two lists */
@@ -1979,6 +1999,110 @@ void Curl_http_method(struct Curl_easy *data,
   *reqp = httpreq;
 }
 
+/*
+ * curl-impersonate:
+ * Create a new linked list of headers.
+ * The new list is a merge between the "base" headers and the application given
+ * headers. The "base" headers contain curl-impersonate's list of headers
+ * used by default by the impersonated browser.
+ *
+ * The application given headers will override the "base" headers if supplied.
+ */
+CURLcode Curl_http_merge_headers(struct Curl_easy *data)
+{
+  int i;
+  int ret;
+  struct curl_slist *head;
+  struct curl_slist *dup = NULL;
+  struct curl_slist *new_list = NULL;
+  char *uagent;
+
+  if (!data->state.base_headers)
+    return CURLE_OK;
+
+  /* Duplicate the list for temporary use. */
+  if (data->set.headers) {
+    dup = Curl_slist_duplicate(data->set.headers);
+    if(!dup)
+      return CURLE_OUT_OF_MEMORY;
+  }
+
+  for(head = data->state.base_headers; head; head = head->next) {
+    char *sep;
+    size_t prefix_len;
+    bool found = FALSE;
+    struct curl_slist *head2;
+
+    sep = strchr(head->data, ':');
+    if(!sep)
+      continue;
+
+    prefix_len = sep - head->data;
+
+    /* Check if this header was added by the application. */
+    for(head2 = dup; head2; head2 = head2->next) {
+      if(head2->data &&
+         curl_strnequal(head2->data, head->data, prefix_len) &&
+         Curl_headersep(head2->data[prefix_len]) ) {
+        new_list = curl_slist_append(new_list, head2->data);
+        /* Free and set to NULL to mark that it's been added. */
+        curlx_safefree(head2->data);
+        found = TRUE;
+        break;
+      }
+    }
+
+    /* If the user agent was set with CURLOPT_USERAGENT, but not with
+     * CURLOPT_HTTPHEADER, take it from there instead. */
+    if(!found &&
+       curl_strnequal(head->data, "User-Agent", prefix_len) &&
+       data->set.str[STRING_USERAGENT] &&
+       *data->set.str[STRING_USERAGENT]) {
+      uagent = curl_maprintf("User-Agent: %s",
+                             data->set.str[STRING_USERAGENT]);
+      if(!uagent) {
+        ret = CURLE_OUT_OF_MEMORY;
+        goto fail;
+      }
+      new_list = Curl_slist_append_nodup(new_list, uagent);
+      found = TRUE;
+    }
+
+    if (!found) {
+      new_list = curl_slist_append(new_list, head->data);
+    }
+
+    if (!new_list) {
+      ret = CURLE_OUT_OF_MEMORY;
+      goto fail;
+    }
+  }
+
+  /* Now go over any additional application-supplied headers. */
+  for(head = dup; head; head = head->next) {
+    if(head->data) {
+      new_list = curl_slist_append(new_list, head->data);
+      if(!new_list) {
+        ret = CURLE_OUT_OF_MEMORY;
+        goto fail;
+      }
+    }
+  }
+
+  curl_slist_free_all(dup);
+  /* Save the new, merged list separately, so it can be freed later. */
+  curl_slist_free_all(data->state.merged_headers);
+  data->state.merged_headers = new_list;
+
+  return CURLE_OK;
+
+fail:
+  curl_slist_free_all(dup);
+  curl_slist_free_all(new_list);
+  return ret;
+}
+
+
 static CURLcode http_useragent(struct Curl_easy *data)
 {
   /* The User-Agent string might have been allocated already, because
@@ -2005,45 +2129,10 @@ static CURLcode http_set_aptr_host(struct Curl_easy *data)
   if(ptr &&
      (!data->state.this_is_a_follow ||
       Curl_peer_equal(data->state.initial_origin, data->state.origin))) {
-#ifndef CURL_DISABLE_COOKIES
-    /* If we have a given custom Host: header, we extract the hostname in
-       order to possibly use it for cookie reasons later on. We only allow the
-       custom Host: header if this is NOT a redirect, as setting Host: in the
-       redirected request is being out on thin ice. Except if the hostname
-       is the same as the first one! */
-    char *cookiehost;
-    CURLcode result = copy_custom_value(ptr, &cookiehost);
-    if(result)
-      return result;
-    if(!*cookiehost)
-      /* ignore empty data */
-      curlx_free(cookiehost);
-    else {
-      /* If the host begins with '[', we start searching for the port after
-         the bracket has been closed */
-      if(*cookiehost == '[') {
-        char *closingbracket;
-        /* since the 'cookiehost' is an allocated memory area that will be
-           freed later we cannot increment the pointer */
-        memmove(cookiehost, cookiehost + 1, strlen(cookiehost) - 1);
-        closingbracket = strchr(cookiehost, ']');
-        if(closingbracket)
-          *closingbracket = 0;
-      }
-      else {
-        int startsearch = 0;
-        char *colon = strchr(cookiehost + startsearch, ':');
-        if(colon)
-          *colon = 0; /* The host must not include an embedded port number */
-      }
-      data->req.cookiehost = cookiehost;
-    }
-#endif
-
     if(!curl_strequal("Host:", ptr)) {
-      aptr->host = curl_maprintf("Host:%s\r\n", &ptr[5]);
-      if(!aptr->host)
-        return CURLE_OUT_OF_MEMORY;
+      /* Emit custom Host with the other user headers to preserve order.
+         Cookies continue to match the URL origin. */
+      aptr->host = NULL;
     }
   }
   else {
@@ -2448,6 +2537,231 @@ static CURLcode addexpect(struct Curl_easy *data, struct dynbuf *r,
   return CURLE_OK;
 }
 
+struct http_hdr_line {
+  const char *line;
+  size_t linelen;
+  const char *name;
+  size_t namelen;
+  bool used;
+};
+
+static const char *http_header_block_end(const char *buf, size_t blen)
+{
+  size_t i;
+
+  for(i = 0; (i + 3) < blen; i++) {
+    if(buf[i] == '\r' && buf[i + 1] == '\n' &&
+       buf[i + 2] == '\r' && buf[i + 3] == '\n')
+      return &buf[i];
+  }
+  return NULL;
+}
+
+static void http_header_order_token(const char **pp,
+                                    const char **pname,
+                                    size_t *pnamelen)
+{
+  const char *p = *pp;
+  const char *name;
+  const char *end;
+
+  while(ISBLANK(*p))
+    p++;
+  name = p;
+
+  while(*p && *p != ',')
+    p++;
+  end = p;
+  while(end > name && ISBLANK(end[-1]))
+    end--;
+
+  *pname = name;
+  *pnamelen = (size_t)(end - name);
+  *pp = p;
+}
+
+static bool http_header_name_match(const struct http_hdr_line *line,
+                                   const char *name, size_t namelen)
+{
+  return line->namelen == namelen &&
+         curl_strnequal(line->name, name, namelen);
+}
+
+static CURLcode http_header_order_add(struct dynbuf *out,
+                                      struct http_hdr_line *lines,
+                                      size_t nlines,
+                                      const char *name, size_t namelen)
+{
+  size_t i;
+
+  for(i = 0; i < nlines; i++) {
+    if(!lines[i].used && http_header_name_match(&lines[i], name, namelen)) {
+      CURLcode result = curlx_dyn_addn(out, lines[i].line, lines[i].linelen);
+      if(result)
+        return result;
+      lines[i].used = TRUE;
+    }
+  }
+  return CURLE_OK;
+}
+
+static CURLcode http_header_order_add_rest(struct dynbuf *out,
+                                           struct http_hdr_line *lines,
+                                           size_t nlines)
+{
+  size_t i;
+
+  for(i = 0; i < nlines; i++) {
+    if(!lines[i].used) {
+      CURLcode result = curlx_dyn_addn(out, lines[i].line, lines[i].linelen);
+      if(result)
+        return result;
+      lines[i].used = TRUE;
+    }
+  }
+  return CURLE_OK;
+}
+
+static const char *http_header_order_next_line(const char *p, const char *end)
+{
+  const char *nl = memchr(p, '\n', (size_t)(end - p));
+
+  return nl ? nl + 1 : end;
+}
+
+static void http_header_order_count_lines(const char *start,
+                                          const char *end,
+                                          size_t *pcount)
+{
+  const char *p = start;
+  size_t count = 0;
+
+  while(p < end) {
+    count++;
+    p = http_header_order_next_line(p, end);
+  }
+  *pcount = count;
+}
+
+static void http_header_order_parse_lines(struct http_hdr_line *lines,
+                                          size_t nlines,
+                                          const char *start,
+                                          const char *end)
+{
+  const char *p = start;
+  size_t i;
+
+  for(i = 0; (i < nlines) && (p < end); i++) {
+    const char *line = p;
+    const char *next = http_header_order_next_line(p, end);
+    const char *colon;
+
+    p = next;
+
+    lines[i].line = line;
+    lines[i].linelen = (size_t)(next - line);
+    colon = memchr(line, ':', (size_t)(next - line));
+    if(colon) {
+      lines[i].name = line;
+      lines[i].namelen = (size_t)(colon - line);
+    }
+  }
+}
+
+static CURLcode http_req_apply_header_order(struct Curl_easy *data,
+                                            struct dynbuf *r)
+{
+  const char *order = data->set.str[STRING_HTTPHEADER_ORDER];
+  struct http_hdr_line *lines = NULL;
+  struct dynbuf out;
+  struct dynbuf old;
+  char *buf;
+  const char *header_end;
+  const char *header_lines_end;
+  const char *request_end;
+  const char *header_start;
+  const char *p;
+  size_t blen;
+  size_t nlines = 0;
+  CURLcode result = CURLE_OK;
+
+  if(data->conn && data->conn->scheme &&
+     (data->conn->scheme->protocol & (CURLPROTO_WS | CURLPROTO_WSS)) &&
+     data->set.str[STRING_WS_HTTPHEADER_ORDER])
+    order = data->set.str[STRING_WS_HTTPHEADER_ORDER];
+  else if(data->conn &&
+          (Curl_conn_http_version(data, data->conn) == 30) &&
+          data->set.str[STRING_HTTP3_HTTPHEADER_ORDER])
+    order = data->set.str[STRING_HTTP3_HTTPHEADER_ORDER];
+
+  if(!order)
+    return CURLE_OK;
+
+  buf = curlx_dyn_ptr(r);
+  blen = curlx_dyn_len(r);
+  if(!buf || !blen)
+    return CURLE_OK;
+
+  /* Split the completed HTTP/1-style request into ordered regions. */
+  header_end = http_header_block_end(buf, blen);
+  if(!header_end)
+    return CURLE_OK;
+  /* Include the final header line's CRLF, but not the blank line. */
+  header_lines_end = header_end + 2;
+
+  request_end = memchr(buf, '\n', (size_t)(header_end - buf));
+  if(!request_end)
+    return CURLE_OK;
+  header_start = request_end + 1;
+
+  /* Index logical header entries, preserving duplicate header lines. */
+  http_header_order_count_lines(header_start, header_lines_end, &nlines);
+  if(!nlines)
+    return CURLE_OK;
+
+  lines = curlx_calloc(nlines, sizeof(*lines));
+  if(!lines)
+    return CURLE_OUT_OF_MEMORY;
+  http_header_order_parse_lines(lines, nlines, header_start, header_lines_end);
+
+  curlx_dyn_init(&out, DYN_HTTP_REQUEST);
+  result = curlx_dyn_addn(&out, buf, (size_t)(header_start - buf));
+
+  /* Rebuild headers: requested names first, then all unlisted headers. */
+  p = order;
+  while(!result && *p) {
+    const char *name;
+    size_t namelen;
+
+    http_header_order_token(&p, &name, &namelen);
+    if(namelen)
+      result = http_header_order_add(&out, lines, nlines, name, namelen);
+    if(*p == ',')
+      p++;
+  }
+
+  if(!result)
+    result = http_header_order_add_rest(&out, lines, nlines);
+
+  if(!result)
+    result = curlx_dyn_addn(&out, header_lines_end,
+                            blen - (size_t)(header_lines_end - buf));
+
+  curlx_free(lines);
+
+  if(result) {
+    curlx_dyn_free(&out);
+    return result;
+  }
+
+  /* Replace the caller's buffer only after the rebuild succeeds. */
+  old = *r;
+  *r = out;
+  out = old;
+  curlx_dyn_free(&out);
+  return CURLE_OK;
+}
+
 static CURLcode http_add_content_hds(struct Curl_easy *data,
                                      struct dynbuf *r,
                                      int httpversion,
@@ -2535,6 +2849,8 @@ static CURLcode http_cookies(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   char *addcookies = NULL;
   bool linecap = FALSE;
+  bool split = data->set.split_cookies &&
+    (Curl_conn_http_version(data, data->conn) >= 20);
   if(data->set.str[STRING_COOKIE] &&
      !Curl_checkheaders(data, STRCONST("Cookie")) &&
      Curl_auth_allowed_to_host(data))
@@ -2559,6 +2875,22 @@ static CURLcode http_cookies(struct Curl_easy *data,
           struct Cookie *co = Curl_node_elem(n);
           if(co->value) {
             size_t add;
+            if(split) {
+              /* One cookie per header line. */
+              add = strlen(co->name) + strlen(co->value) + 1;
+              if(add + 8 >= MAX_COOKIE_HEADER_LEN) {
+                infof(data, "Restricted outgoing cookies due to header size, "
+                      "'%s' not sent", co->name);
+                linecap = TRUE;
+                break;
+              }
+              result = curlx_dyn_addf(r, "Cookie: %s=%s\r\n", co->name,
+                                      co->value);
+              if(result)
+                break;
+              count++;
+              continue;
+            }
             if(!count) {
               result = curlx_dyn_addn(r, STRCONST("Cookie: "));
               if(result)
@@ -2583,7 +2915,32 @@ static CURLcode http_cookies(struct Curl_easy *data,
       }
       Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
     }
-    if(addcookies && !result && !linecap) {
+
+    if(addcookies && split && !result && !linecap) {
+      const char *p = addcookies;
+      while(*p) {
+        const char *start;
+        const char *end;
+        while(ISBLANK(*p) || (*p == ';'))
+          p++;
+        if(!*p)
+          break;
+        start = p;
+        while(*p && (*p != ';'))
+          p++;
+        end = p;
+        while((end > start) && ISBLANK(end[-1]))
+          end--;
+        if(end > start) {
+          result = curlx_dyn_addf(r, "Cookie: %.*s\r\n",
+                                  (int)(end - start), start);
+          if(result)
+            break;
+          count++;
+        }
+      }
+    }
+    else if(addcookies && !result && !linecap) {
       if(!count)
         result = curlx_dyn_addn(r, STRCONST("Cookie: "));
       if(!result) {
@@ -2591,7 +2948,7 @@ static CURLcode http_cookies(struct Curl_easy *data,
         count++;
       }
     }
-    if(count && !result)
+    if(count && !split && !result)
       result = curlx_dyn_addn(r, STRCONST("\r\n"));
 
     if(result)
@@ -2919,8 +3276,7 @@ static CURLcode http_add_hd(struct Curl_easy *data,
     break;
 
   case H1_HD_ACCEPT:
-    if(!Curl_checkheaders(data, STRCONST("Accept")))
-      result = curlx_dyn_add(req, "Accept: */*\r\n");
+    /* curl-impersonate: Do not add a default Accept header. */
     break;
 
   case H1_HD_TE:
@@ -3058,8 +3414,12 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done)
   /* what kind of request do we need to send? */
   Curl_http_method(data, &method, &httpreq);
 
+  /* Add HTTP headers used by the selected impersonation profile. */
+  result = Curl_http_merge_headers(data);
+
   /* select host to send */
-  result = http_set_aptr_host(data);
+  if(!result)
+    result = http_set_aptr_host(data);
   /* setup the authentication headers, how that method and host are known */
   if(!result)
     result = Curl_http_output_auth(data, data->conn, method, httpreq,
@@ -3086,6 +3446,10 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done)
       goto out;
   }
 
+  result = http_req_apply_header_order(data, &req);
+  if(result)
+    goto out;
+
   /* setup variables for the upcoming transfer and send */
   Curl_xfer_setup_sendrecv(data, FIRSTSOCKET, -1);
   result = Curl_req_send(data, &req, httpversion);
@@ -3541,7 +3905,7 @@ static CURLcode http_header_s(struct Curl_easy *data,
     CURLcode result;
     Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
     result = Curl_cookie_add(data, data->cookies, TRUE, FALSE, v, host,
-                             data->state.up.path, secure_context);
+                             data->state.up.path, secure_context, TRUE);
     Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
     return result;
   }
@@ -4920,6 +5284,29 @@ static bool http_TE_has_token(const char *fvalue, const char *token)
   return FALSE;
 }
 
+/*
+ * curl-impersonate:
+ * Determine the position of HTTP/2 pseudo headers.
+ * The pseudo headers ":method", ":path", ":scheme", ":authority"
+ * are sent in different order by different browsers. An important part of the
+ * impersonation is ordering them like the browser does.
+ */
+static CURLcode h2_check_pseudo_header_order(const char *order)
+{
+  if(strlen(order) != 4)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  // All pseudo-headers must be present
+  if(!strchr(order, 'm') ||
+     !strchr(order, 'a') ||
+     !strchr(order, 's') ||
+     !strchr(order, 'p'))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  return CURLE_OK;
+}
+
+
 CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
                              struct httpreq *req, struct Curl_easy *data)
 {
@@ -4928,6 +5315,10 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
   size_t i;
   CURLcode result;
 
+  // curl-impersonate: Use the Chrome ordering by default:
+  // :method, :authority, :scheme, :path
+  char *order = "masp";
+
   DEBUGASSERT(req);
   DEBUGASSERT(h2_headers);
 
@@ -4957,20 +5348,46 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
 
   Curl_dynhds_reset(h2_headers);
   Curl_dynhds_set_opts(h2_headers, DYNHDS_OPT_LOWERCASE);
-  result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_METHOD),
-                           req->method, strlen(req->method));
-  if(!result && scheme) {
-    result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_SCHEME),
-                             scheme, strlen(scheme));
+
+  /* curl-impersonate: order of pseudo headers is different from the default */
+  if(data->conn && Curl_conn_http_version(data, data->conn) == 30 &&
+     data->set.str[STRING_HTTP3_PSEUDO_HEADERS_ORDER]) {
+    order = data->set.str[STRING_HTTP3_PSEUDO_HEADERS_ORDER];
   }
-  if(!result && authority) {
-    result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_AUTHORITY),
-                             authority, strlen(authority));
+  else if(data->set.str[STRING_HTTP2_PSEUDO_HEADERS_ORDER]) {
+    order = data->set.str[STRING_HTTP2_PSEUDO_HEADERS_ORDER];
   }
-  if(!result && req->path) {
-    result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_PATH),
-                             req->path, strlen(req->path));
+
+  result = h2_check_pseudo_header_order(order);
+
+  /* curl-impersonate: add http2 pseudo headers according to the specified order. */
+  for(i = 0; !result && i < 4; ++i) {
+    switch(order[i]) {
+      case 'm':
+        result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_METHOD),
+                                 req->method, strlen(req->method));
+        break;
+      case 'a':
+        if(authority) {
+          result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_AUTHORITY),
+                                   authority, strlen(authority));
+        }
+        break;
+      case 's':
+        if(scheme) {
+          result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_SCHEME),
+                                   scheme, strlen(scheme));
+        }
+        break;
+      case 'p':
+        if(req->path) {
+          result = Curl_dynhds_add(h2_headers, STRCONST(HTTP_PSEUDO_PATH),
+                                   req->path, strlen(req->path));
+        }
+        break;
+    }
   }
+
   for(i = 0; !result && i < Curl_dynhds_count(&req->headers); ++i) {
     e = Curl_dynhds_getn(&req->headers, i);
     /* "TE" is special in that it is only permissible when it
@@ -4983,6 +5400,8 @@ CURLcode Curl_http_req_to_h2(struct dynhds *h2_headers,
     else if(h2_permissible_field(e)) {
       result = Curl_dynhds_add(h2_headers, e->name, e->namelen,
                                e->value, e->valuelen);
+      /* curl-impersonate: delete the option */
+      Curl_dynhds_del_opt(h2_headers, DYNHDS_OPT_LOWERCASE_VAL);
     }
   }
 
diff --git a/lib/http2.c b/lib/http2.c
index a820439ef4..f7581b4030 100644
--- a/lib/http2.c
+++ b/lib/http2.c
@@ -46,6 +46,7 @@
 #include "bufref.h"
 #include "curlx/dynbuf.h"
 #include "headers.h"
+#include "curlx/strdup.h"
 
 #if NGHTTP2_VERSION_NUM < 0x010f00
 #error "nghttp2 1.15.0 or greater required"
@@ -63,11 +64,13 @@
 /* on send into TLS, we want to accumulate small frames */
 #define H2_NW_SEND_CHUNKS       1
 /* this is how much we want "in flight" for a stream, unthrottled */
-#define H2_STREAM_WINDOW_SIZE_MAX   (10 * 1024 * 1024)
+/* curl-impersonate: match Chrome's stream window. */
+#define H2_STREAM_WINDOW_SIZE_MAX   (1024 * 1024)
 /* this is how much we want "in flight" for a stream, initially, IFF
  * nghttp2 allows us to tweak the local window size. */
 #if NGHTTP2_HAS_SET_LOCAL_WINDOW_SIZE
-#define H2_STREAM_WINDOW_SIZE_INITIAL  (64 * 1024)
+/* curl-impersonate: match Chrome's initial stream window. */
+#define H2_STREAM_WINDOW_SIZE_INITIAL  (1024 * 1024)
 #else
 #define H2_STREAM_WINDOW_SIZE_INITIAL H2_STREAM_WINDOW_SIZE_MAX
 #endif
@@ -81,9 +84,10 @@
  * the overall connection. Streams might become PAUSED which will block their
  * received QUOTA in the connection window. If we run out of space, the server
  * is blocked from sending us any data. See #10988 for an issue with this. */
-#define HTTP2_HUGE_WINDOW_SIZE (100 * H2_STREAM_WINDOW_SIZE_MAX)
+/* curl-impersonate: match Chrome's connection window. */
+#define HTTP2_HUGE_WINDOW_SIZE (15 * H2_STREAM_WINDOW_SIZE_MAX)
 
-#define H2_SETTINGS_IV_LEN 3
+#define H2_SETTINGS_IV_LEN 8
 #define H2_BINSETTINGS_LEN 80
 
 struct cf_h2_ctx {
@@ -215,17 +219,72 @@ static size_t populate_settings(nghttp2_settings_entry *iv,
                                 struct Curl_easy *data,
                                 struct cf_h2_ctx *ctx)
 {
-  iv[0].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
-  iv[0].value = Curl_multi_max_concurrent_streams(data->multi);
+  /* curl-impersonate: set the HTTP/2 SETTINGS frame as instructed by the
+   * application. Format example: 1:65536;2:0;4:6291456;6:262144
+   * See https://httpwg.org/specs/rfc7540.html#SETTINGS. */
+  const char *settings = data->set.str[STRING_HTTP2_SETTINGS];
+  char *copy;
+  char *setting;
+  size_t i = 0;
+
+  /* TODO: validate setting IDs and values before submitting them. */
+  /* Use Chrome's settings as the default. */
+  if(!settings)
+    settings = "1:65536;2:0;4:6291456;6:262144";
+  copy = curlx_strdup(settings);
+  if(!copy)
+    return 0;
 
-  iv[1].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
-  iv[1].value = cf_h2_initial_win_size(data);
-  if(ctx)
-    ctx->initial_win_size = iv[1].value;
-  iv[2].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
-  iv[2].value = !!data->multi->push_cb;
+  for(setting = strtok(copy, ";"); setting && i < H2_SETTINGS_IV_LEN;
+      setting = strtok(NULL, ";")) {
+    unsigned long value = strtoul(setting + 2, NULL, 10);
+    switch(setting[0]) {
+    case '1':
+      iv[i].settings_id = NGHTTP2_SETTINGS_HEADER_TABLE_SIZE;
+      break;
+    case '2':
+      iv[i].settings_id = NGHTTP2_SETTINGS_ENABLE_PUSH;
+      break;
+    case '3':
+      /* FIXME: We also need to notify curl_multi about this setting. */
+      iv[i].settings_id = NGHTTP2_SETTINGS_MAX_CONCURRENT_STREAMS;
+      break;
+    case '4':
+      iv[i].settings_id = NGHTTP2_SETTINGS_INITIAL_WINDOW_SIZE;
+      if(ctx)
+        ctx->initial_win_size = (uint32_t)value;
+      break;
+    case '5':
+      iv[i].settings_id = NGHTTP2_SETTINGS_MAX_FRAME_SIZE;
+      break;
+    case '6':
+      iv[i].settings_id = NGHTTP2_SETTINGS_MAX_HEADER_LIST_SIZE;
+      break;
+    case '8':
+      /* RFC 8441 extended CONNECT. */
+      iv[i].settings_id = NGHTTP2_SETTINGS_ENABLE_CONNECT_PROTOCOL;
+      break;
+    case '9':
+      /* RFC 9218 extensible priorities. */
+      iv[i].settings_id = NGHTTP2_SETTINGS_NO_RFC7540_PRIORITIES;
+      break;
+    default:
+      continue;
+    }
+    iv[i].value = (uint32_t)value;
+    i++;
+  }
+  curlx_free(copy);
 
-  return 3;
+  /* Up to Chrome 98, the SETTINGS frame contained a randomly chosen setting
+   * number, possibly as a form of GREASE. It has since been removed.
+   *
+   * Curl_rand(data, (unsigned char *)&iv[4].settings_id,
+   *           sizeof(iv[4].settings_id));
+   * Curl_rand(data, (unsigned char *)&iv[4].value,
+   *           sizeof(iv[4].value));
+   */
+  return i;
 }
 
 static ssize_t populate_binsettings(uint8_t *binsettings,
@@ -252,6 +311,101 @@ static CURLcode cf_h2_update_settings(struct cf_h2_ctx *ctx,
   return CURLE_OK;
 }
 
+/* HTTP/2 priorities are deprecated, but retain this helper for Firefox
+ * impersonation profiles which use the legacy priority tree. */
+static CURLcode http2_set_stream_priority(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          int32_t stream_id,
+                                          int32_t dep_stream_id,
+                                          int32_t weight,
+                                          int exclusive)
+{
+  int rv;
+  struct cf_h2_ctx *ctx = cf->ctx;
+  nghttp2_priority_spec pri_spec;
+
+  nghttp2_priority_spec_init(&pri_spec, dep_stream_id, weight, exclusive);
+  rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
+                               stream_id, &pri_spec);
+  if(rv) {
+    failf(data, "nghttp2_submit_priority() failed: %s(%d)",
+          nghttp2_strerror(rv), rv);
+    return CURLE_HTTP2;
+  }
+
+  return CURLE_OK;
+}
+
+/*
+ * curl-impersonate: Firefox used an elaborate scheme of HTTP/2 streams to
+ * split the load for HTML, JavaScript, CSS and images. It built a tree of
+ * streams with different weights and communicated it to the server. Retain
+ * the path even though legacy HTTP/2 priorities are deprecated.
+ */
+static CURLcode http2_set_stream_priorities(struct Curl_cfilter *cf,
+                                            struct Curl_easy *data)
+{
+  CURLcode result;
+  char *copy;
+  char *stream;
+
+  if(!data->set.str[STRING_HTTP2_STREAMS])
+    return CURLE_OK;
+
+  copy = curlx_strdup(data->set.str[STRING_HTTP2_STREAMS]);
+  if(!copy)
+    return CURLE_OUT_OF_MEMORY;
+
+  stream = copy;
+  while(stream) {
+    char *next_stream = strchr(stream, ',');
+    char *value;
+    int32_t stream_id;
+    int exclusive;
+    int32_t dep_stream_id;
+    int32_t weight;
+
+    if(next_stream)
+      *next_stream++ = '\0';
+
+    if(!*stream)
+      break;
+
+    value = strtok(stream, ":");
+    if(!value)
+      goto malformed;
+    stream_id = (int32_t)atoi(value);
+    value = strtok(NULL, ":");
+    if(!value)
+      goto malformed;
+    exclusive = atoi(value);
+    value = strtok(NULL, ":");
+    if(!value)
+      goto malformed;
+    dep_stream_id = (int32_t)atoi(value);
+    value = strtok(NULL, ":");
+    if(!value)
+      goto malformed;
+    weight = (int32_t)atoi(value);
+
+    result = http2_set_stream_priority(cf, data, stream_id, dep_stream_id,
+                                       weight, exclusive);
+    if(result) {
+      curlx_free(copy);
+      return result;
+    }
+
+    stream = next_stream;
+  }
+
+  curlx_free(copy);
+  return CURLE_OK;
+
+malformed:
+  curlx_free(copy);
+  return CURLE_BAD_FUNCTION_ARGUMENT;
+}
+
 #define H2_STREAM_CTX(ctx, data)                                         \
   ((struct h2_stream_ctx *)(                                             \
     (data) ? Curl_uint32_hash_get(&(ctx)->streams, (data)->mid) : NULL))
@@ -1748,18 +1902,26 @@ out:
   return result;
 }
 
+/*
+ * curl-impersonate: use Chrome's default HTTP/2 stream weight instead of
+ * nghttp2's default stream weight.
+ */
+#define CHROME_DEFAULT_STREAM_WEIGHT  256
+#define SAFARI_DEFAULT_STREAM_WEIGHT  255
+#define FIREFOX_DEFAULT_STREAM_WEIGHT 42
+
 static int sweight_wanted(const struct Curl_easy *data)
 {
   /* 0 weight is not set by user and we take the nghttp2 default one */
   return data->set.priority.weight ?
-    data->set.priority.weight : NGHTTP2_DEFAULT_WEIGHT;
+    data->set.priority.weight : CHROME_DEFAULT_STREAM_WEIGHT;
 }
 
 static int sweight_in_effect(const struct Curl_easy *data)
 {
   /* 0 weight is not set by user and we take the nghttp2 default one */
   return data->state.priority.weight ?
-    data->state.priority.weight : NGHTTP2_DEFAULT_WEIGHT;
+    data->state.priority.weight : CHROME_DEFAULT_STREAM_WEIGHT;
 }
 
 /*
@@ -1768,12 +1930,22 @@ static int sweight_in_effect(const struct Curl_easy *data)
  * struct.
  */
 
+/*
+ * curl-impersonate: Firefox used stream 13 as the parent of the stream which
+ * fetched the main HTML resource.
+ */
+#define FIREFOX_DEFAULT_STREAM_DEP 13
+
 static void h2_pri_spec(struct Curl_easy *data,
                         nghttp2_priority_spec *pri_spec)
 {
   struct Curl_data_priority *prio = &data->set.priority;
+
+  /* curl-impersonate: use the configured exclusive flag from data->set.
+   * The dependency ID can be changed to FIREFOX_DEFAULT_STREAM_DEP for the
+   * legacy Firefox priority path. */
   nghttp2_priority_spec_init(pri_spec, 0,
-                             sweight_wanted(data), FALSE);
+                             sweight_wanted(data), prio->exclusive);
   data->state.priority = *prio;
 }
 
@@ -1790,18 +1962,23 @@ static CURLcode h2_progress_egress(struct Curl_cfilter *cf,
   struct h2_stream_ctx *stream = H2_STREAM_CTX(ctx, data);
   int rv = 0;
 
+  /* curl-impersonate: also detect a change to the exclusive flag. */
   if(stream && stream->id > 0 &&
-     (sweight_wanted(data) != sweight_in_effect(data))) {
+     ((sweight_wanted(data) != sweight_in_effect(data)) ||
+      (data->set.priority.exclusive != data->state.priority.exclusive))) {
     /* send new weight and/or dependency */
     nghttp2_priority_spec pri_spec;
 
     h2_pri_spec(data, &pri_spec);
-    CURL_TRC_CF(data, cf, "[%d] Queuing PRIORITY", stream->id);
-    DEBUGASSERT(stream->id != -1);
-    rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
-                                 stream->id, &pri_spec);
-    if(rv)
-      goto out;
+    /* curl-impersonate: do not send PRIORITY frames for the main stream. */
+    if(stream->id != 1) {
+      CURL_TRC_CF(data, cf, "[%d] Queuing PRIORITY", stream->id);
+      DEBUGASSERT(stream->id != -1);
+      rv = nghttp2_submit_priority(ctx->h2, NGHTTP2_FLAG_NONE,
+                                   stream->id, &pri_spec);
+      if(rv)
+        goto out;
+    }
   }
 
   ctx->nw_out_blocked = 0;
@@ -2114,7 +2291,9 @@ static CURLcode h2_submit(struct h2_stream_ctx **pstream,
   /* Check the initial windows size of the transfer (rate-limits?) and
    * send an updated settings on changes from previous value. */
   initial_win_size = cf_h2_initial_win_size(data);
-  if(initial_win_size != ctx->initial_win_size) {
+  /* curl-impersonate: keep an explicitly configured SETTINGS fingerprint. */
+  if(!data->set.str[STRING_HTTP2_SETTINGS] &&
+     (initial_win_size != ctx->initial_win_size)) {
     result = cf_h2_update_settings(ctx, initial_win_size);
     if(result)
       goto out;
@@ -2127,11 +2306,13 @@ static CURLcode h2_submit(struct h2_stream_ctx **pstream,
   case HTTPREQ_PUT:
     data_prd.read_callback = req_body_read_callback;
     data_prd.source.ptr = NULL;
-    stream_id = nghttp2_submit_request(ctx->h2, &pri_spec, nva, nheader,
+    stream_id = nghttp2_submit_request(
+      ctx->h2, data->set.http2_no_priority ? NULL : &pri_spec, nva, nheader,
                                        &data_prd, data);
     break;
   default:
-    stream_id = nghttp2_submit_request(ctx->h2, &pri_spec, nva, nheader,
+    stream_id = nghttp2_submit_request(
+      ctx->h2, data->set.http2_no_priority ? NULL : &pri_spec, nva, nheader,
                                        NULL, data);
   }
 
@@ -2466,8 +2647,15 @@ static CURLcode cf_h2_ctx_open(struct Curl_cfilter *cf,
     }
   }
 
-  rc = nghttp2_session_set_local_window_size(ctx->h2, NGHTTP2_FLAG_NONE, 0,
-                                             HTTP2_HUGE_WINDOW_SIZE);
+  {
+    /* curl-impersonate: directly change the connection window using the
+     * configured increment, with Chrome's increment as the default. */
+    int current_window = nghttp2_session_get_local_window_size(ctx->h2);
+    int window_update = data->set.http2_window_update ?
+      data->set.http2_window_update : 15663105;
+    rc = nghttp2_session_set_local_window_size(
+      ctx->h2, NGHTTP2_FLAG_NONE, 0, current_window + window_update);
+  }
   if(rc) {
     failf(data, "nghttp2_session_set_local_window_size() failed: %s(%d)",
           nghttp2_strerror(rc), rc);
@@ -2475,6 +2663,20 @@ static CURLcode cf_h2_ctx_open(struct Curl_cfilter *cf,
     goto out;
   }
 
+  /* curl-impersonate: retain the legacy Firefox stream-priority path. No
+   * current browser profile enables it, so it remains disabled by default.
+   *
+   * result = http2_set_stream_priorities(cf, data);
+   * if(result)
+   *   goto out;
+   *
+   * Firefox's first request stream followed its idle priority streams:
+   *
+   * #define FIREFOX_DEFAULT_STREAM_ID 15
+   * nghttp2_session_set_next_stream_id(ctx->h2,
+   *                                    FIREFOX_DEFAULT_STREAM_ID);
+   */
+
   /* all set, traffic will be send on connect */
   result = CURLE_OK;
   CURL_TRC_CF(data, cf, "[0] created h2 session%s",
diff --git a/lib/http2.h b/lib/http2.h
index e38dc5745c..95921f5a99 100644
--- a/lib/http2.h
+++ b/lib/http2.h
@@ -29,7 +29,8 @@
 
 /* value for MAX_CONCURRENT_STREAMS we use until we get an updated setting
    from the peer */
-#define DEFAULT_MAX_CONCURRENT_STREAMS 100
+/* curl-impersonate: Use 1000 concurrent streams like Chrome. */
+#define DEFAULT_MAX_CONCURRENT_STREAMS 1000
 
 /*
  * Store nghttp2 version info in this buffer.
diff --git a/lib/impersonate.c b/lib/impersonate.c
new file mode 100644
index 0000000000..928315b46b
--- /dev/null
+++ b/lib/impersonate.c
@@ -0,0 +1,2282 @@
+#include "curl_setup.h"
+#include <curl/curl.h>
+#include "impersonate.h"
+
+const struct impersonate_opts impersonations[] = {
+  {
+    .target = "chrome100",
+    .alias = "chrome100",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"100\", \"Google Chrome\";v=\"100\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.75 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome101",
+    .alias = "chrome101",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"101\", \"Google Chrome\";v=\"101\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome104",
+    .alias = "chrome104",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"104\", \" Not A;Brand\";v=\"99\", \"Google Chrome\";v=\"104\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome107",
+    .alias = "chrome107",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Google Chrome\";v=\"107\", \"Chromium\";v=\"107\", \"Not=A?Brand\";v=\"24\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;2:0;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome110",
+    .alias = "chrome110",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"110\", \"Not A(Brand\";v=\"24\", \"Google Chrome\";v=\"110\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;2:0;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome116",
+    .alias = "chrome116",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"116\", \"Not)A;Brand\";v=\"24\", \"Google Chrome\";v=\"116\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;2:0;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome119",
+    .alias = "chrome119",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Google Chrome\";v=\"119\", \"Chromium\";v=\"119\", \"Not?A_Brand\";v=\"24\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome120",
+    .alias = "chrome120",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Not_A Brand\";v=\"8\", \"Chromium\";v=\"120\", \"Google Chrome\";v=\"120\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome123",
+    .alias = "chrome123",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Google Chrome\";v=\"123\", \"Not:A-Brand\";v=\"8\", \"Chromium\";v=\"123\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome124",
+    .alias = "chrome124",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519Kyber768Draft00:X25519:P-256:P-384",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"124\", \"Google Chrome\";v=\"124\", \"Not-A.Brand\";v=\"99\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome131",
+    .alias = "chrome131",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome131_android",
+    .alias = "chrome131_android",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519:P-256:P-384",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Google Chrome\";v=\"131\", \"Chromium\";v=\"131\", \"Not_A Brand\";v=\"24\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Android\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome133a",
+    .alias = "chrome133a",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Not(A:Brand\";v=\"99\", \"Google Chrome\";v=\"133\", \"Chromium\";v=\"133\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = true,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome136",
+    .alias = "chrome136",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"136\", \"Google Chrome\";v=\"136\", \"Not.A/Brand\";v=\"99\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = true,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome142",
+    .alias = "chrome142",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"142\", \"Google Chrome\";v=\"142\", \"Not_A Brand\";v=\"99\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = true,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome145",
+    .alias = "chrome145",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512",
+    .http3_sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Not:A-Brand\";v=\"99\", \"Google Chrome\";v=\"145\", \"Chromium\";v=\"145\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .http3_settings = "1:65536;6:262144;7:100;51:1;GREASE",
+    .http3_pseudo_headers_order = "masp",
+    .quic_transport_parameters = "1:30000;3:1472;4:15728640;5:6291456;6:6291456;7:6291456;8:100;9:103;15:;17:1@1,GREASE;32:65536;12583:AUTO;18258:1;GREASE",
+    .http3_tls_extension_order = "0-10-13-16-27-43-45-51-57-17613-65037",
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = true,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome146",
+    .alias = "chrome146",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512",
+    .http3_sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_permute_extensions = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \"Chromium\";v=\"146\", \"Not-A.Brand\";v=\"24\", \"Google Chrome\";v=\"146\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"macOS\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Accept-Language: en-US,en;q=0.9",
+      "Priority: u=0, i"
+    },
+    .http2_settings = "1:65536;2:0;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .http3_settings = "1:65536;6:262144;7:100;51:1;GREASE",
+    .http3_pseudo_headers_order = "masp",
+    .quic_transport_parameters = "1:30000;3:1472;4:15728640;5:6291456;6:6291456;7:6291456;8:100;9:103;15:;17:1@1,GREASE;32:65536;12583:AUTO;12584:0x4f524947;GREASE",
+    .http3_tls_extension_order = "0-10-13-16-27-43-45-51-57-17613-65037",
+    .ech = "true",
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = true,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome99",
+    .alias = "chrome99",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"99\", \"Google Chrome\";v=\"99\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "chrome99_android",
+    .alias = "chrome99_android",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"99\", \"Google Chrome\";v=\"99\"",
+      "sec-ch-ua-mobile: ?1",
+      "sec-ch-ua-platform: \"Android\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Linux; Android 12; Pixel 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.58 Mobile Safari/537.36",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "edge101",
+    .alias = "edge101",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"101\", \"Microsoft Edge\";v=\"101\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.47",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "edge99",
+    .alias = "edge99",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "ECDHE-ECDSA-AES128-GCM-SHA256:"
+      "ECDHE-RSA-AES128-GCM-SHA256:"
+      "ECDHE-ECDSA-AES256-GCM-SHA384:"
+      "ECDHE-RSA-AES256-GCM-SHA384:"
+      "ECDHE-ECDSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-CHACHA20-POLY1305:"
+      "ECDHE-RSA-AES128-SHA:"
+      "ECDHE-RSA-AES256-SHA:"
+      "AES128-GCM-SHA256:"
+      "AES256-GCM-SHA384:"
+      "AES128-SHA:"
+      "AES256-SHA",
+    .npn = false,
+    .alpn = true,
+    .alps = true,
+    .tls_session_ticket = true,
+    .cert_compression = "brotli",
+    .http_headers = {
+      "sec-ch-ua: \" Not A;Brand\";v=\"99\", \"Chromium\";v=\"99\", \"Microsoft Edge\";v=\"99\"",
+      "sec-ch-ua-mobile: ?0",
+      "sec-ch-ua-platform: \"Windows\"",
+      "Upgrade-Insecure-Requests: 1",
+      "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Edg/99.0.1150.30",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-User: ?1",
+      "Sec-Fetch-Dest: document",
+      "Accept-Encoding: gzip, deflate, br",
+      "Accept-Language: en-US,en;q=0.9"
+    },
+    .http2_settings = "1:65536;3:1000;4:6291456;6:262144",
+    .http2_window_update = 15663105,
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 1,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "firefox133",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA",
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-US,en;q=0.5",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Upgrade-Insecure-Requests: 1",
+      "Sec-Fetch-Dest: document",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-User: ?1",
+      "Priority: u=0, i",
+      "Te: trailers"
+    },
+    .curves = "X25519MLKEM768:X25519:P-256:P-384:P-521:ffdhe2048:ffdhe3072",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_secp521r1_sha512:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha256:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pkcs1_sha512:"
+      "ecdsa_sha1:"
+      "rsa_pkcs1_sha1",
+    .alpn = true,
+    .http2_settings = "1:65536;2:0;4:131072;5:16384",
+    .http2_window_update = 12517377,
+    .http2_pseudo_headers_order = "mpas",
+    .http2_stream_exclusive = 0,
+    .cert_compression = "zlib,brotli,zstd",
+    .ws_cert_compression = "",
+    .ech = "true",
+    .tls_session_ticket = true,
+    .ws_disable_session_ticket = true,
+    .tls_extension_order = "0-23-65281-10-11-35-16-5-34-51-43-13-45-28-27-65037",
+    .tls_delegated_credentials = "ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ecdsa_sha1",
+    .tls_record_size_limit = 16385,
+    .tls_grease = false,
+    .tls_signed_cert_timestamps = false,
+    .tls_key_shares_limit = 3,
+    .split_cookies = true,
+    .form_boundary = "firefox",
+  },
+  {
+    .target = "firefox135",
+    .alias = "firefox135",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA",
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:135.0) Gecko/20100101 Firefox/135.0",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-US,en;q=0.5",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Upgrade-Insecure-Requests: 1",
+      "Sec-Fetch-Dest: document",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-User: ?1",
+      "Priority: u=0, i",
+      "Te: trailers"
+    },
+    .curves = "X25519MLKEM768:X25519:P-256:P-384:P-521:ffdhe2048:ffdhe3072",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_secp521r1_sha512:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha256:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pkcs1_sha512:"
+      "ecdsa_sha1:"
+      "rsa_pkcs1_sha1",
+    .alpn = true,
+    .http2_settings = "1:65536;2:0;4:131072;5:16384",
+    .http2_window_update = 12517377,
+    .http2_pseudo_headers_order = "mpas",
+    .http2_stream_exclusive = 0,
+    .cert_compression = "zlib,brotli,zstd",
+    .ws_cert_compression = "",
+    .ech = "true",
+    .tls_session_ticket = true,
+    .ws_disable_session_ticket = true,
+    .tls_extension_order = "0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037",
+    .tls_delegated_credentials = "ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ecdsa_sha1",
+    .tls_record_size_limit = 16385,
+    .tls_grease = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_key_shares_limit = 3,
+    .split_cookies = true,
+    .form_boundary = "firefox",
+  },
+  {
+    .target = "firefox144",
+    .alias = "firefox144",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA",
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-US,en;q=0.5",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Upgrade-Insecure-Requests: 1",
+      "Sec-Fetch-Dest: document",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-User: ?1",
+      "Priority: u=0, i",
+      "Te: trailers"
+    },
+    .curves = "X25519MLKEM768:X25519:P-256:P-384:P-521:ffdhe2048:ffdhe3072",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_secp521r1_sha512:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha256:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pkcs1_sha512:"
+      "ecdsa_sha1:"
+      "rsa_pkcs1_sha1",
+    .alpn = true,
+    .http2_settings = "1:65536;2:0;4:131072;5:16384",
+    .http2_window_update = 12517377,
+    .http2_pseudo_headers_order = "mpas",
+    .http2_stream_exclusive = 0,
+    .http2_stream_weight = 42,
+    .cert_compression = "zlib,brotli,zstd",
+    .ws_cert_compression = "",
+    .ech = "true",
+    .tls_session_ticket = true,
+    .ws_disable_session_ticket = true,
+    .tls_extension_order = "0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037",
+    .tls_delegated_credentials = "ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ecdsa_sha1",
+    .tls_record_size_limit = 16385,
+    .tls_grease = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_key_shares_limit = 3,
+    .split_cookies = true,
+    .form_boundary = "firefox",
+  },
+  {
+    .target = "firefox147",
+    .alias = "firefox147",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA",
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:147.0) Gecko/20100101 Firefox/147.0",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-US,en;q=0.9",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Upgrade-Insecure-Requests: 1",
+      "Sec-Fetch-Dest: document",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-User: ?1",
+      "Priority: u=0, i",
+      "Te: trailers"
+    },
+    .curves = "X25519MLKEM768:X25519:P-256:P-384:P-521:ffdhe2048:ffdhe3072",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_secp521r1_sha512:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha256:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pkcs1_sha512:"
+      "ecdsa_sha1:"
+      "rsa_pkcs1_sha1",
+    .alpn = true,
+    .http2_settings = "1:65536;2:0;4:131072;5:16384",
+    .http2_window_update = 12517377,
+    .http2_pseudo_headers_order = "mpas",
+    .http2_stream_exclusive = 0,
+    .http2_stream_weight = 42,
+    .http3_settings = "1:65536;7:20;727725890:0;16765559:1;51:1;8:1",
+    .http3_pseudo_headers_order = "msap",
+    .quic_transport_parameters = "1:30000;4:25165824;5:12582912;6:1048576;7:1048576;8:100;9:100;11:20;14:8;15:AUTO;17:1@GREASE,1;GREASE;32:65535",
+    .http3_tls_extension_order = "28-51-27-13-34-10-45-16-65281-23-5-0-43-57-65037",
+    .cert_compression = "zlib,brotli,zstd",
+    .ws_cert_compression = "",
+    .ech = "true",
+    .tls_session_ticket = true,
+    .ws_disable_session_ticket = true,
+    .tls_extension_order = "0-23-65281-10-11-35-16-5-34-18-51-43-13-45-28-27-65037",
+    .tls_delegated_credentials = "ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ecdsa_sha1",
+    .tls_record_size_limit = 16385,
+    .tls_grease = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_key_shares_limit = 3,
+    .split_cookies = true,
+    .form_boundary = "firefox",
+  },
+  {
+    .target = "okhttp4_android",
+    .alias = "okhttp4", /* not working */
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_sha1:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Sec-Fetch-Site: none",
+      "Accept-Encoding: gzip, deflate, br",
+      "Sec-Fetch-Mode: navigate",
+      "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+      "Accept-Language: en-US,en;q=0.9",
+      "Sec-Fetch-Dest: document"
+    },
+    .http2_settings = "2:0;4:4194304;3:100",
+    .http2_window_update = 10485760,
+    .http2_pseudo_headers_order = "mspa",
+    .http2_stream_weight = 255,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+  },
+  {
+    .target = "safari153",
+    .alias = "safari15_3",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA256:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_sha1:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.3 Safari/605.1.15",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-us",
+      "Accept-Encoding: gzip, deflate, br"
+    },
+    .http2_settings = "4:4194304;3:100",
+    .http2_window_update = 10485760,
+    .http2_pseudo_headers_order = "mspa",
+    .http2_stream_weight = 255,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari155",
+    .alias = "safari15_5",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_sha1:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.5 Safari/605.1.15",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-GB,en-US;q=0.9,en;q=0.8",
+      "Accept-Encoding: gzip, deflate, br"
+    },
+    .http2_settings = "4:4194304;3:100",
+    .http2_window_update = 10485760,
+    .http2_pseudo_headers_order = "mspa",
+    .http2_stream_weight = 255,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari170",
+    .alias = "safari17_0",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_sha1:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Sec-Fetch-Site: none",
+      "Accept-Encoding: gzip, deflate, br",
+      "Sec-Fetch-Mode: navigate",
+      "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15",
+      "Accept-Language: en-US,en;q=0.9",
+      "Sec-Fetch-Dest: document"
+    },
+    .http2_settings = "2:0;4:4194304;3:100",
+    .http2_window_update = 10485760,
+    .http2_pseudo_headers_order = "mspa",
+    .http2_stream_weight = 255,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari172_ios",
+    .alias = "safari17_2_ios",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_sha1:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Sec-Fetch-Site: none",
+      "Accept-Encoding: gzip, deflate, br",
+      "Sec-Fetch-Mode: navigate",
+      "User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1",
+      "Accept-Language: en-US,en;q=0.9",
+      "Sec-Fetch-Dest: document"
+    },
+    .http2_settings = "2:0;4:2097152;3:100",
+    .http2_window_update = 10485760,
+    .http2_pseudo_headers_order = "mspa",
+    .http2_stream_weight = 255,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari180",
+    .alias = "safari18_0",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;8:1;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari180_ios",
+    .alias = "safari18_0_ios",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Mobile/15E148 Safari/604.1",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;8:1;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari184",
+    .alias = "safari18_4",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari184_ios",
+    .alias = "safari18_4_ios",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .tls_session_ticket = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_stream_weight = 256,
+    .http2_stream_exclusive = 0,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari260",
+    .alias = "safari26_0",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br, zstd"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_no_priority = true,
+    .tls_session_ticket = true,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari2601",
+    .alias = "safari26_0_1",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519MLKEM768:X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0.1 Safari/605.1.15",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_no_priority = true,
+    .tls_session_ticket = false,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "safari260_ios",
+    .alias = "safari26_0_ios",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA:"
+      "TLS_RSA_WITH_3DES_EDE_CBC_SHA",
+    .curves = "X25519:P-256:P-384:P-521",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pkcs1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha512:"
+      "rsa_pkcs1_sha1",
+    .npn = false,
+    .alpn = true,
+    .alps = false,
+    .cert_compression = "zlib",
+    .http_headers = {
+      "sec-fetch-dest: document",
+      "user-agent: Mozilla/5.0 (iPhone; CPU iPhone OS 26_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Mobile/15E148 Safari/604.1",
+      "accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "sec-fetch-site: none",
+      "sec-fetch-mode: navigate",
+      "accept-language: en-US,en;q=0.9",
+      "priority: u=0, i",
+      "accept-encoding: gzip, deflate, br, zstd"
+    },
+    .http2_settings = "2:0;3:100;4:2097152;9:1",
+    .http2_window_update = 10420225,
+    .http2_pseudo_headers_order = "msap",
+    .http2_no_priority = true,
+    .tls_session_ticket = true,
+    .tls_extension_order = NULL,
+    .tls_use_new_alps_codepoint = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_grease = true,
+    .split_cookies = true,
+    .form_boundary = "webkit",
+  },
+  {
+    .target = "tor145",  // tor 14.5, based on firefox 128
+    .alias = "tor145",
+    .httpversion = CURL_HTTP_VERSION_2_0,
+    .ssl_version = CURL_SSLVERSION_TLSv1_2 | CURL_SSLVERSION_MAX_DEFAULT,
+    .ciphers =
+      "TLS_AES_128_GCM_SHA256:"
+      "TLS_CHACHA20_POLY1305_SHA256:"
+      "TLS_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256:"
+      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA:"
+      "TLS_RSA_WITH_AES_128_GCM_SHA256:"
+      "TLS_RSA_WITH_AES_256_GCM_SHA384:"
+      "TLS_RSA_WITH_AES_128_CBC_SHA:"
+      "TLS_RSA_WITH_AES_256_CBC_SHA",
+    .http_headers = {
+      "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.0",
+      "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
+      "Accept-Language: en-US,en;q=0.5",
+      "Accept-Encoding: gzip, deflate, br, zstd",
+      "Sec-GPC: 1",
+      "Upgrade-Insecure-Requests: 1",
+      "Sec-Fetch-Dest: document",
+      "Sec-Fetch-Mode: navigate",
+      "Sec-Fetch-Site: none",
+      "Sec-Fetch-User: ?1",
+      "Priority: u=0, i",
+      "Te: trailers"
+    },
+    .curves = "X25519:P-256:P-384:P-521:ffdhe2048:ffdhe3072",
+    .sig_hash_algs =
+      "ecdsa_secp256r1_sha256:"
+      "ecdsa_secp384r1_sha384:"
+      "ecdsa_secp521r1_sha512:"
+      "rsa_pss_rsae_sha256:"
+      "rsa_pss_rsae_sha384:"
+      "rsa_pss_rsae_sha512:"
+      "rsa_pkcs1_sha256:"
+      "rsa_pkcs1_sha384:"
+      "rsa_pkcs1_sha512:"
+      "ecdsa_sha1:"
+      "rsa_pkcs1_sha1",
+    .alpn = true,
+    .http2_settings = "1:65536;2:0;4:131072;5:16384",
+    .http2_window_update = 12517377,
+    .http2_pseudo_headers_order = "mpas",
+    .http2_stream_exclusive = 0,
+    .http2_stream_weight = 42,
+    .cert_compression = "zlib,brotli,zstd",
+    .ech = "true",
+    .tls_session_ticket = true,
+    .tls_extension_order = "0-23-65281-10-11-16-5-34-51-43-13-28-65037",
+    .tls_delegated_credentials = "ecdsa_secp256r1_sha256:ecdsa_secp384r1_sha384:ecdsa_secp521r1_sha512:ecdsa_sha1",
+    .tls_record_size_limit = 16385,
+    .tls_grease = false,
+    .tls_signed_cert_timestamps = true,
+    .tls_key_shares_limit = 2,
+    .split_cookies = true,
+    .form_boundary = "firefox",
+  }
+};
+
+const size_t num_impersonations = sizeof(impersonations) / sizeof(impersonations[0]);
diff --git a/lib/impersonate.h b/lib/impersonate.h
new file mode 100644
index 0000000000..d44b1fd0de
--- /dev/null
+++ b/lib/impersonate.h
@@ -0,0 +1,82 @@
+#ifndef HEADER_CURL_IMPERSONATE_H
+#define HEADER_CURL_IMPERSONATE_H
+
+#define IMPERSONATE_MAX_HEADERS 32
+
+/*
+ * curl-impersonate: Options to be set for each supported target browser.
+ */
+struct impersonate_opts {
+  const char *target;
+  const char *alias;
+  int httpversion;
+  int ssl_version;
+  const char *ciphers;
+  /* Elliptic curves (TLS extension 10).
+   * Passed to CURLOPT_SSL_EC_CURVES */
+  const char *curves;
+  const char *http3_curves;
+  /* Signature hash algorithms (TLS extension 13).
+   * Passed to CURLOPT_SSL_SIGNATURE_ALGORITHMS */
+  const char *sig_hash_algs;
+  /* Signature hash algorithms for HTTP/3 (QUIC TLS).
+   * If set, used instead of sig_hash_algs for QUIC connections.
+   * Chrome applies different verify prefs for TCP vs QUIC:
+   * TCP strips SHA-1 (ssl_client_socket_impl.cc), QUIC uses BoringSSL
+   * defaults which include rsa_pkcs1_sha1. */
+  const char *http3_sig_hash_algs;
+  /* Enable TLS NPN extension. */
+  bool npn;
+  /* Enable TLS ALPN extension. */
+  bool alpn;
+  /* Enable TLS ALPS extension. */
+  bool alps;
+  /* Enable TLS session ticket extension. */
+  bool tls_session_ticket;
+  bool ws_disable_session_ticket;
+  /* TLS certificate compression algorithms.
+   * (TLS extension 27) */
+  const char *cert_compression;
+  const char *ws_cert_compression;
+  const char *http_headers[IMPERSONATE_MAX_HEADERS];
+  const char *http3_headers[IMPERSONATE_MAX_HEADERS];
+  const char *ws_headers[IMPERSONATE_MAX_HEADERS];
+  const char *http2_pseudo_headers_order;
+  const char *http2_settings;
+  const char *http_header_order;
+  const char *http3_http_header_order;
+  const char *ws_http_header_order;
+  int http2_window_update;
+  const char *http2_streams;
+  const char *http3_pseudo_headers_order;
+  const char *http3_settings;
+  const char *quic_transport_parameters;
+  bool tls_permute_extensions;
+  bool tls_use_new_alps_codepoint;
+  bool tls_signed_cert_timestamps;
+  const char *ech;
+  const char *tls_extension_order;
+  const char *http3_tls_extension_order;
+  const char *tls_delegated_credentials;
+  int tls_record_size_limit;
+  int tls_key_shares_limit;  // for firefox key_shares extension
+  bool tls_grease;
+  int http2_stream_weight;
+  int http2_stream_exclusive;
+  bool http2_no_priority;  // disable http2 priority in header frame
+  bool proxy_credential_no_reuse;  // do not reuse TLS sessions or connections from different proxy credentials
+  bool split_cookies;  // split cookies into one Cookie header per pair
+  const char *form_boundary;
+
+  /* Other TLS options will come here in the future once they are
+   * configurable through curl_easy_setopt() */
+};
+
+/*
+ * curl-impersonate: Global array of supported browsers and their
+ * impersonation options.
+ */
+extern const struct impersonate_opts impersonations[];
+extern const size_t num_impersonations;
+
+#endif /* HEADER_CURL_IMPERSONATE_H */
diff --git a/lib/libcurl.def b/lib/libcurl.def
index 803f372041..24695366c3 100644
--- a/lib/libcurl.def
+++ b/lib/libcurl.def
@@ -5,6 +5,7 @@ curl_easy_escape
 curl_easy_getinfo
 curl_easy_header
 curl_easy_init
+curl_easy_impersonate
 curl_easy_nextheader
 curl_easy_option_by_id
 curl_easy_option_by_name
diff --git a/lib/mime.c b/lib/mime.c
index 077e599e43..6f12cc10c8 100644
--- a/lib/mime.c
+++ b/lib/mime.c
@@ -54,6 +54,61 @@ static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
                                  size_t call_depth);
 static curl_off_t mime_size(curl_mimepart *part);
 
+static CURLcode mime_set_boundary(struct Curl_easy *easy, curl_mime *mime)
+{
+  const char *form_boundary = NULL;
+
+  if(easy)
+    form_boundary = easy->set.str[STRING_FORM_BOUNDARY];
+
+  if(form_boundary && curl_strequal(form_boundary, "webkit")) {
+    memcpy(mime->boundary, MIME_WEBKIT_BOUNDARY_PREFIX,
+           sizeof(MIME_WEBKIT_BOUNDARY_PREFIX) - 1);
+    return Curl_rand_alnum(easy,
+                           (unsigned char *)
+                           &mime->boundary[sizeof(MIME_WEBKIT_BOUNDARY_PREFIX)
+                                           - 1],
+                           MIME_WEBKIT_BOUNDARY_CHARS + 1);
+  }
+  if(form_boundary && curl_strequal(form_boundary, "firefox")) {
+    memcpy(mime->boundary, MIME_FIREFOX_BOUNDARY_PREFIX,
+           sizeof(MIME_FIREFOX_BOUNDARY_PREFIX) - 1);
+    return Curl_rand_hex(easy,
+                         (unsigned char *)
+                         &mime->boundary[sizeof(MIME_FIREFOX_BOUNDARY_PREFIX)
+                                         - 1],
+                         MIME_FIREFOX_BOUNDARY_CHARS + 1);
+  }
+
+  memset(mime->boundary, '-', MIME_BOUNDARY_DASHES);
+  return Curl_rand_alnum(easy,
+                         (unsigned char *)
+                         &mime->boundary[MIME_BOUNDARY_DASHES],
+                         MIME_RAND_BOUNDARY_CHARS + 1);
+}
+
+CURLcode Curl_mime_set_form_boundary(struct Curl_easy *easy, curl_mime *mime)
+{
+  CURLcode result;
+  curl_mimepart *part;
+
+  if(!mime)
+    return CURLE_OK;
+
+  result = mime_set_boundary(easy, mime);
+  if(result)
+    return result;
+
+  for(part = mime->firstpart; part; part = part->nextpart) {
+    if(part->kind == MIMEKIND_MULTIPART) {
+      result = Curl_mime_set_form_boundary(easy, (curl_mime *) part->arg);
+      if(result)
+        return result;
+    }
+  }
+
+  return CURLE_OK;
+}
 /* Quoted-printable character class table.
  *
  * We cannot rely on ctype functions since quoted-printable input data
@@ -918,6 +973,7 @@ static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
                                  size_t call_depth)
 {
   curl_mime *mime = (curl_mime *)instream;
+  size_t boundarylen = strlen(mime->boundary);
   size_t cursize = 0;
   (void)size;  /* Always 1 */
 
@@ -945,10 +1001,10 @@ static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
     case MIMESTATE_BOUNDARY2:
       if(part)
         sz = readback_bytes(&mime->state, buffer, nitems, mime->boundary,
-                            MIME_BOUNDARY_LEN, STRCONST("\r\n"));
+                            boundarylen, STRCONST("\r\n"));
       else
         sz = readback_bytes(&mime->state, buffer, nitems, mime->boundary,
-                            MIME_BOUNDARY_LEN, STRCONST("--\r\n"));
+                            boundarylen, STRCONST("--\r\n"));
       if(!sz) {
         mimesetstate(&mime->state, MIMESTATE_CONTENT, part);
       }
@@ -1202,6 +1258,7 @@ CURLcode Curl_mime_duppart(struct Curl_easy *data,
 /* Create a mime handle. */
 curl_mime *curl_mime_init(void *easy)
 {
+  struct Curl_easy *data = (struct Curl_easy *)easy;
   curl_mime *mime = curlx_malloc(sizeof(*mime));
 
   if(mime) {
@@ -1209,10 +1266,7 @@ curl_mime *curl_mime_init(void *easy)
     mime->firstpart = NULL;
     mime->lastpart = NULL;
 
-    memset(mime->boundary, '-', MIME_BOUNDARY_DASHES);
-    if(Curl_rand_alnum(easy,
-                       (unsigned char *)&mime->boundary[MIME_BOUNDARY_DASHES],
-                       MIME_RAND_BOUNDARY_CHARS + 1)) {
+    if(Curl_mime_set_form_boundary(data, mime)) {
       /* failed to get random separator, bail out */
       curlx_free(mime);
       return NULL;
@@ -1567,7 +1621,7 @@ static curl_off_t multipart_size(curl_mime *mime)
   if(!mime)
     return 0;           /* Not present -> empty. */
 
-  boundarysize = 4 + MIME_BOUNDARY_LEN + 2;
+  boundarysize = 4 + (curl_off_t) strlen(mime->boundary) + 2;
   size = boundarysize;  /* Final boundary - CRLF after headers. */
 
   for(part = mime->firstpart; part; part = part->nextpart) {
diff --git a/lib/mime.h b/lib/mime.h
index e84f04051b..738b3a8335 100644
--- a/lib/mime.h
+++ b/lib/mime.h
@@ -27,6 +27,10 @@
 
 #define MIME_BOUNDARY_DASHES            24  /* leading boundary dashes */
 #define MIME_RAND_BOUNDARY_CHARS        22  /* Nb. of random boundary chars. */
+#define MIME_WEBKIT_BOUNDARY_PREFIX "------WebKitFormBoundary"
+#define MIME_WEBKIT_BOUNDARY_CHARS      16
+#define MIME_FIREFOX_BOUNDARY_PREFIX "------geckoformboundary"
+#define MIME_FIREFOX_BOUNDARY_CHARS     32
 #define MAX_ENCODED_LINE_LENGTH         76  /* Maximum encoded line length. */
 #define ENCODING_BUFFER_SIZE            256 /* Encoding temp buffers size. */
 
@@ -94,7 +98,8 @@ struct mime_state {
 };
 
 /* Boundary string length. */
-#define MIME_BOUNDARY_LEN (MIME_BOUNDARY_DASHES + MIME_RAND_BOUNDARY_CHARS)
+#define MIME_BOUNDARY_LEN (sizeof(MIME_FIREFOX_BOUNDARY_PREFIX) - 1 + \
+                           MIME_FIREFOX_BOUNDARY_CHARS)
 
 /* A mime multipart. */
 struct curl_mime {
@@ -150,6 +155,7 @@ CURLcode Curl_mime_prepare_headers(struct Curl_easy *data,
                                    const char *contenttype,
                                    const char *disposition,
                                    enum mimestrategy strategy);
+CURLcode Curl_mime_set_form_boundary(struct Curl_easy *easy, curl_mime *mime);
 size_t Curl_mime_read(char *buffer, size_t size, size_t nitems,
                       void *instream);
 const char *Curl_mime_contenttype(const char *filename);
@@ -166,6 +172,7 @@ CURLcode Curl_creader_set_mime(struct Curl_easy *data, curl_mimepart *part);
 #define Curl_mime_duppart(x, y, z) CURLE_OK /* Nothing to duplicate. Succeed */
 #define Curl_mime_set_subparts(a, b, c)          CURLE_NOT_BUILT_IN
 #define Curl_mime_prepare_headers(a, b, c, d, e) CURLE_NOT_BUILT_IN
+#define Curl_mime_set_form_boundary(a, b)        CURLE_NOT_BUILT_IN
 #define Curl_mime_read                           NULL
 #define Curl_creader_set_mime(x, y) ((void)(x), CURLE_NOT_BUILT_IN)
 #endif
diff --git a/lib/multi.c b/lib/multi.c
index d6ae111d8e..0fd71c76b9 100644
--- a/lib/multi.c
+++ b/lib/multi.c
@@ -262,7 +262,8 @@ struct Curl_multi *Curl_multi_handle(uint32_t xfer_table_size,
   Curl_llist_init(&multi->msglist, NULL);
 
   multi->multiplexing = TRUE;
-  multi->max_concurrent_streams = 100;
+  /* curl-impersonate: Use 1000 concurrent streams like Chrome. */
+  multi->max_concurrent_streams = 1000;
   multi->last_timeout_ms = -1;
 #ifdef ENABLE_WAKEUP
   multi->wakeup_pair[0] = CURL_SOCKET_BAD;
diff --git a/lib/protocol.c b/lib/protocol.c
index 8d57c058c6..6725bbeaea 100644
--- a/lib/protocol.c
+++ b/lib/protocol.c
@@ -458,7 +458,7 @@ const struct Curl_scheme Curl_scheme_wss = {
   CURLPROTO_WSS,                        /* protocol */
   CURLPROTO_HTTP,                       /* family */
   PROTOPT_SSL | PROTOPT_CREDSPERREQUEST | /* flags */
-  PROTOPT_USERPWDCTRL | PROTOPT_HTTP_PROXY_TUNNEL,
+  PROTOPT_USERPWDCTRL | PROTOPT_HTTP_PROXY_TUNNEL | PROTOPT_ALPN,
   PORT_HTTPS                            /* defport */
 };
 
diff --git a/lib/setopt.c b/lib/setopt.c
index eb9ff2e396..2b78cb5947 100644
--- a/lib/setopt.c
+++ b/lib/setopt.c
@@ -46,8 +46,10 @@
 #include "altsvc.h"
 #include "hsts.h"
 #include "tftp.h"
+#include "slist.h"
 #include "curlx/strdup.h"
 #include "escape.h"
+#include "curl_ctype.h"
 #include "bufref.h"
 #include "vauth/vauth.h"
 
@@ -98,6 +100,95 @@ CURLcode Curl_setstropt(char **charp, const char *s)
   return CURLE_OK;
 }
 
+static bool setopt_valid_form_boundary(const char *value)
+{
+  return curl_strequal(value, "webkit") ||
+         curl_strequal(value, "firefox");
+}
+
+/* Return whether `c` is valid in an HTTP field name. */
+static bool http_header_order_name_char(char c)
+{
+  return ISALNUM(c) || c == '!' || c == '#' || c == '$' ||
+         c == '%' || c == '&' || c == '\'' || c == '*' ||
+         c == '+' || c == '-' || c == '.' || c == '^' ||
+         c == '_' || c == '`' || c == '|' || c == '~';
+}
+
+/* Parse one comma-separated header name and trim surrounding blanks. */
+static void http_header_order_token(const char **pp, const char **pname,
+                                    size_t *pnamelen)
+{
+  const char *p = *pp;
+  const char *name;
+  const char *end;
+
+  while(ISBLANK(*p))
+    p++;
+  name = p;
+  while(*p && *p != ',')
+    p++;
+  end = p;
+  while(end > name && ISBLANK(end[-1]))
+    end--;
+  *pname = name;
+  *pnamelen = (size_t)(end - name);
+  *pp = p;
+}
+
+/* Return whether `name` already appeared earlier in `order`. */
+static bool http_header_order_duplicate(const char *order,
+                                        const char *name, size_t namelen)
+{
+  const char *p = order;
+
+  while(p < name) {
+    const char *prev;
+    size_t prevlen;
+    http_header_order_token(&p, &prev, &prevlen);
+    if(prevlen == namelen && curl_strnequal(prev, name, namelen))
+      return TRUE;
+    if(*p == ',') {
+      p++;
+      if(!*p)
+        return FALSE;
+    }
+  }
+  return FALSE;
+}
+
+/* Validate CURLOPT_HTTPHEADER_ORDER before storing it. */
+static bool setopt_valid_http_header_order(const char *order)
+{
+  const char *p = order;
+
+  if(!order)
+    return TRUE;
+  if(!*order)
+    return FALSE;
+
+  /* Validate comma-separated HTTP field names before storing the option. */
+  while(*p) {
+    const char *name;
+    size_t namelen;
+    size_t i;
+    http_header_order_token(&p, &name, &namelen);
+    if(!namelen || name[0] == ':' ||
+       http_header_order_duplicate(order, name, namelen))
+      return FALSE;
+    for(i = 0; i < namelen; i++) {
+      if(!http_header_order_name_char(name[i]))
+        return FALSE;
+    }
+    if(*p == ',') {
+      p++;
+      if(!*p)
+        return FALSE;
+    }
+  }
+  return TRUE;
+}
+
 CURLcode Curl_setblobopt(struct curl_blob **blobp,
                          const struct curl_blob *blob)
 {
@@ -307,6 +398,9 @@ static CURLcode setopt_HTTP_VERSION(struct Curl_easy *data, long arg)
     return CURLE_UNSUPPORTED_PROTOCOL;
   }
   data->set.httpwant = (unsigned char)arg;
+  /* QUIC inherently uses TLS 1.3, enforced in the QUIC TLS setup. Do not
+   * override the global SSL version here because --http3 may fall back to
+   * HTTP/2 over TLS 1.2. */
   return CURLE_OK;
 }
 #endif /* !CURL_DISABLE_HTTP */
@@ -343,6 +437,8 @@ CURLcode Curl_setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
 
     primary->version = (unsigned char)version;
     primary->version_max = (unsigned int)version_max;
+    if(option == CURLOPT_SSLVERSION)
+      data->set.ssl_version_set = TRUE;
   }
   return CURLE_OK;
 }
@@ -499,6 +595,9 @@ static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option,
      */
     s->cookiesession = enabled;
     break;
+  case CURLOPT_SPLIT_COOKIES:
+    s->split_cookies = enabled;
+    break;
 #endif
   case CURLOPT_AUTOREFERER:
     /*
@@ -586,6 +685,9 @@ static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option,
      */
     s->proxy_transfer_mode = enabled;
     break;
+  case CURLOPT_PROXY_CREDENTIAL_NO_REUSE:
+    s->proxy_credential_no_reuse = enabled;
+    break;
 #endif /* !CURL_DISABLE_PROXY */
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   case CURLOPT_SOCKS5_GSSAPI_NEC:
@@ -776,6 +878,30 @@ static CURLcode setopt_long_bool(struct Curl_easy *data, CURLoption option,
   case CURLOPT_SSL_ENABLE_ALPN:
     s->ssl_enable_alpn = enabled;
     break;
+  case CURLOPT_SSL_ENABLE_ALPS:
+    s->ssl_enable_alps = enabled;
+    break;
+  case CURLOPT_SSL_ENABLE_TICKET:
+    s->ssl_enable_ticket = enabled;
+    break;
+  case CURLOPT_WS_SSL_DISABLE_TICKET:
+    s->ws_disable_session_ticket = enabled;
+    break;
+  case CURLOPT_SSL_PERMUTE_EXTENSIONS:
+    s->ssl_permute_extensions = enabled;
+    break;
+  case CURLOPT_TLS_GREASE:
+    s->tls_grease = enabled;
+    break;
+  case CURLOPT_TLS_KEY_USAGE_NO_CHECK:
+    s->tls_key_usage_no_check = enabled;
+    break;
+  case CURLOPT_TLS_SIGNED_CERT_TIMESTAMPS:
+    s->tls_signed_cert_timestamps = enabled;
+    break;
+  case CURLOPT_TLS_STATUS_REQUEST:
+    s->tls_status_request = enabled;
+    break;
   case CURLOPT_PATH_AS_IS:
     s->path_as_is = enabled;
     break;
@@ -987,6 +1113,15 @@ static CURLcode setopt_long_ssl(struct Curl_easy *data, CURLoption option,
 #endif
   case CURLOPT_SSL_ENABLE_NPN:
     break;
+  case CURLOPT_TLS_RECORD_SIZE_LIMIT:
+    s->tls_record_size_limit = (int)arg;
+    break;
+  case CURLOPT_TLS_KEY_SHARES_LIMIT:
+    s->tls_key_shares_limit = (int)arg;
+    break;
+  case CURLOPT_TLS_USE_NEW_ALPS_CODEPOINT:
+    s->tls_use_new_alps_codepoint = !!arg;
+    break;
   case CURLOPT_SSLENGINE_DEFAULT:
     curlx_safefree(s->str[STRING_SSL_ENGINE]);
     result = Curl_ssl_set_engine_default(data);
@@ -1064,7 +1199,7 @@ static CURLcode setopt_long_http(struct Curl_easy *data, CURLoption option,
 
   switch(option) {
   case CURLOPT_FOLLOWLOCATION:
-    if((unsigned long)arg > 3)
+    if((unsigned long)arg > CURLFOLLOW_SAFE)
       result = CURLE_BAD_FUNCTION_ARGUMENT;
     else
       s->http_follow_mode = (unsigned char)arg;
@@ -1090,6 +1225,29 @@ static CURLcode setopt_long_http(struct Curl_easy *data, CURLoption option,
     return httpauth(data, FALSE, (unsigned long)arg);
   case CURLOPT_HTTP_VERSION:
     return setopt_HTTP_VERSION(data, arg);
+  case CURLOPT_STREAM_EXCLUSIVE:
+#ifdef USE_HTTP2
+    s->priority.exclusive = (int)arg;
+    break;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
+  case CURLOPT_HTTP2_WINDOW_UPDATE:
+#ifdef USE_HTTP2
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->http2_window_update = (int)arg;
+    break;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
+  case CURLOPT_HTTP2_NO_PRIORITY:
+#ifdef USE_HTTP2
+    s->http2_no_priority = !!arg;
+    break;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
   case CURLOPT_EXPECT_100_TIMEOUT_MS:
     result = value_range(&arg, 0, 0, 0xffff);
     if(!result)
@@ -1393,6 +1551,23 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
      */
     s->headers = slist;
     break;
+  case CURLOPT_HTTP3_HTTPHEADER:
+    /* Set an HTTP/3-specific list with HTTP headers to use. */
+    s->http3_headers = slist;
+    break;
+  case CURLOPT_WS_HTTPHEADER:
+    /* Set a WebSocket-specific list with HTTP headers to use. */
+    s->ws_headers = slist;
+    break;
+  case CURLOPT_HTTPBASEHEADER:
+    /* curl-impersonate: Set default browser headers to merge with
+     * CURLOPT_HTTPHEADER. Unlike CURLOPT_HTTPHEADER, this list is copied and
+     * may be freed immediately by the caller. */
+    curl_slist_free_all(data->state.base_headers);
+    data->state.base_headers = Curl_slist_duplicate(slist);
+    if(slist && !data->state.base_headers)
+      result = CURLE_OUT_OF_MEMORY;
+    break;
 #endif
 #ifndef CURL_DISABLE_TELNET
   case CURLOPT_TELNETOPTIONS:
@@ -1484,6 +1659,9 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
 #ifndef CURL_DISABLE_MIME
   case CURLOPT_MIMEPOST:
     result = setopt_mimepost(data, va_arg(param, curl_mime *));
+    if(!result && s->str[STRING_FORM_BOUNDARY] && s->mimepostp)
+      result = Curl_mime_set_form_boundary(
+        data, (curl_mime *)s->mimepostp->arg);
     break;
 #endif /* !CURL_DISABLE_MIME */
 #endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_SMTP || !CURL_DISABLE_IMAP */
@@ -1571,11 +1749,11 @@ static CURLcode cookielist(struct Curl_easy *data, const char *ptr)
     if(checkprefix("Set-Cookie:", ptr))
       /* HTTP Header format line */
       result = Curl_cookie_add(data, data->cookies, TRUE, FALSE, ptr + 11,
-                               NULL, NULL, TRUE);
+                               NULL, NULL, TRUE, FALSE);
     else
       /* Netscape format line */
       result = Curl_cookie_add(data, data->cookies, FALSE, FALSE, ptr, NULL,
-                               NULL, TRUE);
+                               NULL, TRUE, FALSE);
     Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
   }
   return result;
@@ -1998,6 +2176,9 @@ static CURLcode setopt_cptr_ssl(struct Curl_easy *data, CURLoption option,
     if(Curl_ssl_supports(data, SSLSUPP_SSL_EC_CURVES))
       return Curl_setstropt(&s->str[STRING_SSL_EC_CURVES], ptr);
     return CURLE_NOT_BUILT_IN;
+  case CURLOPT_HTTP3_SSL_EC_CURVES:
+    /* Set HTTP/3-specific accepted curves in SSL connection setup. */
+    return Curl_setstropt(&s->str[STRING_HTTP3_SSL_EC_CURVES], ptr);
   case CURLOPT_SSL_SIGNATURE_ALGORITHMS:
     /*
      * Set accepted signature algorithms.
@@ -2494,12 +2675,106 @@ static CURLcode setopt_cptr_misc(struct Curl_easy *data, CURLoption option,
   return result;
 }
 
+static CURLcode setopt_cptr_impersonate(struct Curl_easy *data,
+                                        CURLoption option, char *ptr)
+{
+  struct UserDefined *s = &data->set;
+
+  switch(option) {
+  case CURLOPT_IMPERSONATE: {
+    bool default_headers = TRUE;
+    char *p;
+    char *suffix;
+    CURLcode result = Curl_setstropt(&s->str[STRING_IMPERSONATE], ptr);
+    if(result)
+      return result;
+    p = s->str[STRING_IMPERSONATE];
+    if(!p || !*p)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    suffix = strchr(p, ':');
+    if(suffix) {
+      if((suffix == p) || !suffix[1] || strchr(suffix + 1, ':'))
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      if(!strcmp(suffix + 1, "yes"))
+        default_headers = TRUE;
+      else if(!strcmp(suffix + 1, "no"))
+        default_headers = FALSE;
+      else
+        return CURLE_BAD_FUNCTION_ARGUMENT;
+      *suffix = '\0';
+      result = curl_easy_impersonate(data, p, default_headers);
+      *suffix = ':';
+      return result;
+    }
+    return curl_easy_impersonate(data, p, TRUE);
+  }
+  case CURLOPT_FORM_BOUNDARY: {
+    CURLcode result;
+    if(ptr && !setopt_valid_form_boundary(ptr))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    result = Curl_setstropt(&s->str[STRING_FORM_BOUNDARY], ptr);
+#if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
+    if(!result && s->mimepostp)
+      result = Curl_mime_set_form_boundary(
+        data, (curl_mime *)s->mimepostp->arg);
+#endif
+    return result;
+  }
+  case CURLOPT_TLS_EXTENSION_ORDER:
+    return Curl_setstropt(&s->str[STRING_TLS_EXTENSION_ORDER], ptr);
+  case CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER:
+    return Curl_setstropt(&s->str[STRING_HTTP2_PSEUDO_HEADERS_ORDER], ptr);
+  case CURLOPT_HTTP2_SETTINGS:
+    return Curl_setstropt(&s->str[STRING_HTTP2_SETTINGS], ptr);
+  case CURLOPT_HTTPHEADER_ORDER:
+    if(!setopt_valid_http_header_order(ptr))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    return Curl_setstropt(&s->str[STRING_HTTPHEADER_ORDER], ptr);
+  case CURLOPT_HTTP3_HTTPHEADER_ORDER:
+    if(!setopt_valid_http_header_order(ptr))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    return Curl_setstropt(&s->str[STRING_HTTP3_HTTPHEADER_ORDER], ptr);
+  case CURLOPT_WS_HTTPHEADER_ORDER:
+    if(!setopt_valid_http_header_order(ptr))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    return Curl_setstropt(&s->str[STRING_WS_HTTPHEADER_ORDER], ptr);
+  case CURLOPT_HTTP3_PSEUDO_HEADERS_ORDER:
+    return Curl_setstropt(&s->str[STRING_HTTP3_PSEUDO_HEADERS_ORDER], ptr);
+  case CURLOPT_HTTP3_SETTINGS:
+    return Curl_setstropt(&s->str[STRING_HTTP3_SETTINGS], ptr);
+  case CURLOPT_QUIC_TRANSPORT_PARAMETERS:
+    return Curl_setstropt(&s->str[STRING_QUIC_TRANSPORT_PARAMETERS], ptr);
+  case CURLOPT_HTTP3_SIG_HASH_ALGS:
+    return Curl_setstropt(&s->str[STRING_HTTP3_SIG_HASH_ALGS], ptr);
+  case CURLOPT_HTTP3_TLS_EXTENSION_ORDER:
+    return Curl_setstropt(&s->str[STRING_HTTP3_TLS_EXTENSION_ORDER], ptr);
+  case CURLOPT_HTTP2_STREAMS:
+    return Curl_setstropt(&s->str[STRING_HTTP2_STREAMS], ptr);
+  case CURLOPT_SSL_SIG_HASH_ALGS:
+    /* Backwards-compatible alias for
+     * CURLOPT_SSL_SIGNATURE_ALGORITHMS. */
+    return Curl_setstropt(&s->str[STRING_SSL_SIGNATURE_ALGORITHMS], ptr);
+  case CURLOPT_SSL_CERT_COMPRESSION:
+    /* Set the comma-delimited list of TLS certificate compression
+     * algorithms. Supported values include "zlib" and "brotli". */
+    return Curl_setstropt(&s->str[STRING_SSL_CERT_COMPRESSION], ptr);
+  case CURLOPT_WS_SSL_CERT_COMPRESSION:
+    /* Set the TLS certificate compression algorithms for WebSocket. */
+    return Curl_setstropt(&s->str[STRING_WS_SSL_CERT_COMPRESSION], ptr);
+  case CURLOPT_TLS_DELEGATED_CREDENTIALS:
+    return Curl_setstropt(&s->str[STRING_TLS_DELEGATED_CREDENTIALS], ptr);
+  default:
+    return CURLE_UNKNOWN_OPTION;
+  }
+}
+
 static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
                             char *ptr)
 {
   typedef CURLcode (*ptrfunc)(struct Curl_easy *data, CURLoption option,
                               char *ptr);
   static const ptrfunc setopt_call[] = {
+    setopt_cptr_impersonate,
 #ifndef CURL_DISABLE_PROXY
     setopt_cptr_proxy,
 #endif
@@ -2892,6 +3167,9 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
        way than being listed explicitly */
     switch(option) {
     case CURLOPT_HTTPHEADER:
+    case CURLOPT_HTTP3_HTTPHEADER:
+    case CURLOPT_HTTPBASEHEADER:
+    case CURLOPT_WS_HTTPHEADER:
     case CURLOPT_QUOTE:
     case CURLOPT_POSTQUOTE:
     case CURLOPT_TELNETOPTIONS:
diff --git a/lib/socks.c b/lib/socks.c
index 6c458c505d..49a4efeacc 100644
--- a/lib/socks.c
+++ b/lib/socks.c
@@ -40,8 +40,11 @@
 #include "cfilters.h"
 #include "cf-dns.h"
 #include "connect.h"
+#include "cf-socket.h"
+#include "sockaddr.h"
 #include "socks.h"
 #include "curlx/inet_pton.h"
+#include "curlx/inet_ntop.h"
 
 /* for the (SOCKS) connect state machine */
 enum socks_state_t {
@@ -94,19 +97,43 @@ static const char * const cf_socks_statename[] = {
 #define SOCKS_CHUNK_SIZE    1024
 #define SOCKS_CHUNKS        1
 
+#define SOCKS5_ATYP_IPV4    1
+#define SOCKS5_ATYP_DOMAIN  3
+#define SOCKS5_ATYP_IPV6    4
+#define SOCKS5_HEADER_LEN    4
+#define SOCKS5_PORT_LEN      2
+#define SOCKS5_IPV4_LEN      4
+#define SOCKS5_IPV6_LEN     16
+
 struct socks_ctx {
   enum socks_state_t state;
   struct bufq iobuf;
   struct Curl_peer *dest;
   struct Curl_creds *creds;
+
+  /* curl-impersonate: SOCKS5 UDP ASSOCIATE state. See RFC 1928 section 7. */
+  struct Curl_cfilter *tcp_cf; /* SOCKS proxy TCP control channel */
+  struct Curl_cfilter *udp_cf; /* SOCKS proxy UDP relay data path */
+  struct Curl_sockaddr_ex udp_peer_addr; /* QUIC peer address */
   CURLproxycode presult;
   uint32_t resolv_id;
+  unsigned char udp_relay_addr[SOCKS5_IPV6_LEN]; /* relay address */
+  unsigned char udp_dest_addr[SOCKS5_IPV6_LEN]; /* QUIC destination */
+  unsigned char udp_dest_domain[256]; /* remotely resolved destination */
+  size_t udp_dest_domain_len;
+  int udp_relay_port;
+  int udp_relay_family;
+  int udp_dest_port;
+  int udp_dest_atyp; /* SOCKS5 ATYP for UDP destination */
   uint8_t ip_version;
   uint8_t proxy_type;
   unsigned char version;
   BIT(resolve_local);
   BIT(start_resolving);
   BIT(socks4a);
+  BIT(udp_associate); /* use UDP ASSOCIATE instead of CONNECT */
+  BIT(udp_dest_set); /* destination cached for UDP headers */
+  BIT(udp_peer_set); /* udp_peer_addr is available */
 };
 
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
@@ -753,6 +780,78 @@ static CURLproxycode socks5_check_auth_resp(struct socks_ctx *sx,
   return CURLPX_OK;
 }
 
+/* curl-impersonate: cache the address QUIC uses as its UDP peer. */
+static void socks5_udp_set_peer(struct socks_ctx *sx,
+                                int family,
+                                const unsigned char *address,
+                                int port)
+{
+  memset(&sx->udp_peer_addr, 0, sizeof(sx->udp_peer_addr));
+  if(family == AF_INET) {
+    struct sockaddr_in *sa =
+      (struct sockaddr_in *)(void *)&sx->udp_peer_addr.curl_sa_addr;
+    sa->sin_family = AF_INET;
+    memcpy(&sa->sin_addr, address, sizeof(struct in_addr));
+    sa->sin_port = htons((unsigned short)port);
+    sx->udp_peer_addr.family = AF_INET;
+    sx->udp_peer_addr.addrlen = sizeof(struct sockaddr_in);
+  }
+#ifdef USE_IPV6
+  else if(family == AF_INET6) {
+    struct sockaddr_in6 *sa6 =
+      (struct sockaddr_in6 *)(void *)&sx->udp_peer_addr.curl_sa_addr;
+    sa6->sin6_family = AF_INET6;
+    memcpy(&sa6->sin6_addr, address, sizeof(struct in6_addr));
+    sa6->sin6_port = htons((unsigned short)port);
+    sx->udp_peer_addr.family = AF_INET6;
+    sx->udp_peer_addr.addrlen = sizeof(struct sockaddr_in6);
+  }
+#endif
+  else
+    return;
+  sx->udp_peer_addr.socktype = SOCK_DGRAM;
+  sx->udp_peer_addr.protocol = IPPROTO_UDP;
+  sx->udp_peer_set = TRUE;
+}
+
+/* curl-impersonate: cache the resolved target for SOCKS5 UDP headers. */
+static void socks5_udp_set_dest(struct socks_ctx *sx,
+                                int family,
+                                const unsigned char *address)
+{
+  size_t addrlen = SOCKS5_IPV4_LEN;
+  sx->udp_dest_atyp = SOCKS5_ATYP_IPV4;
+#ifdef USE_IPV6
+  if(family == AF_INET6) {
+    addrlen = SOCKS5_IPV6_LEN;
+    sx->udp_dest_atyp = SOCKS5_ATYP_IPV6;
+  }
+#else
+  (void)family;
+#endif
+  memcpy(sx->udp_dest_addr, address, addrlen);
+  sx->udp_dest_port = sx->dest->port;
+  sx->udp_dest_set = TRUE;
+  socks5_udp_set_peer(sx, family, address, sx->udp_dest_port);
+}
+
+/* curl-impersonate: cache a target which the SOCKS5 proxy resolves. */
+static CURLproxycode socks5_udp_set_domain(struct socks_ctx *sx,
+                                           struct Curl_easy *data)
+{
+  size_t hlen = strlen(sx->dest->hostname);
+  if(!hlen || hlen > 255) {
+    failf(data, "SOCKS5 UDP destination hostname is invalid");
+    return CURLPX_LONG_HOSTNAME;
+  }
+  sx->udp_dest_atyp = SOCKS5_ATYP_DOMAIN;
+  memcpy(sx->udp_dest_domain, sx->dest->hostname, hlen);
+  sx->udp_dest_domain_len = hlen;
+  sx->udp_dest_port = sx->dest->port;
+  sx->udp_dest_set = TRUE;
+  return CURLPX_OK;
+}
+
 static CURLproxycode socks5_req1_init(struct socks_ctx *sx,
                                       struct Curl_cfilter *cf,
                                       struct Curl_easy *data)
@@ -765,7 +864,8 @@ static CURLproxycode socks5_req1_init(struct socks_ctx *sx,
   CURLcode result;
 
   req[0] = 5; /* version (SOCKS5) */
-  req[1] = 1; /* connect */
+  /* curl-impersonate: use UDP ASSOCIATE for a QUIC data path. */
+  req[1] = sx->udp_associate ? 3 : 1; /* UDP ASSOCIATE or CONNECT */
   req[2] = 0; /* must be zero */
   if(sx->resolve_local) {
     /* rest of request is added after resolving */
@@ -802,6 +902,38 @@ static CURLproxycode socks5_req1_init(struct socks_ctx *sx,
     destlen = (unsigned char)hostname_len; /* 1-byte length */
   }
 
+  if(sx->udp_associate) {
+    CURLproxycode presult;
+
+    /* Preserve the real target for the per-datagram SOCKS5 UDP header. */
+    if(desttype == SOCKS5_ATYP_IPV4)
+      socks5_udp_set_dest(sx, AF_INET, destination);
+#ifdef USE_IPV6
+    else if(desttype == SOCKS5_ATYP_IPV6)
+      socks5_udp_set_dest(sx, AF_INET6, destination);
+#endif
+    else {
+      presult = socks5_udp_set_domain(sx, data);
+      if(presult)
+        return presult;
+    }
+
+    /* The UDP endpoint is not bound yet. Request an unspecified relay. */
+    memset(ipbuf, 0, sizeof(ipbuf));
+#ifdef USE_IPV6
+    if(data->set.ipver == CURL_IPRESOLVE_V6) {
+      desttype = SOCKS5_ATYP_IPV6;
+      destlen = SOCKS5_IPV6_LEN;
+    }
+    else
+#endif
+    {
+      desttype = SOCKS5_ATYP_IPV4;
+      destlen = SOCKS5_IPV4_LEN;
+    }
+    destination = ipbuf;
+  }
+
   req[3] = desttype;
   req[4] = destlen;
   hdlen = (desttype == 3) ? 5 : 4; /* no length byte for ip addresses */
@@ -811,9 +943,12 @@ static CURLproxycode socks5_req1_init(struct socks_ctx *sx,
   result = Curl_bufq_write(&sx->iobuf, destination, destlen, &nwritten);
   if(result || (nwritten != destlen))
     return CURLPX_SEND_REQUEST;
+  /* An unbound UDP endpoint requests port zero per RFC 1928. */
   /* PORT MSB+LSB */
-  req[0] = (unsigned char)((sx->dest->port >> 8) & 0xff);
-  req[1] = (unsigned char)(sx->dest->port & 0xff);
+  req[0] = sx->udp_associate ? 0 :
+    (unsigned char)((sx->dest->port >> 8) & 0xff);
+  req[1] = sx->udp_associate ? 0 :
+    (unsigned char)(sx->dest->port & 0xff);
   result = Curl_bufq_write(&sx->iobuf, req, 2, &nwritten);
   if(result || (nwritten != 2))
     return CURLPX_SEND_REQUEST;
@@ -831,6 +966,7 @@ static CURLproxycode socks5_resolving(struct socks_ctx *sx,
   char dest[MAX_IPADR_LEN];  /* printable address */
   const unsigned char *destination = NULL;
   unsigned char desttype = 1, destlen = 4;
+  unsigned char bind_addr[SOCKS5_IPV6_LEN] = { 0 };
   unsigned char req[2];
   CURLcode result;
   CURLproxycode presult = CURLPX_OK;
@@ -903,6 +1039,12 @@ static CURLproxycode socks5_resolving(struct socks_ctx *sx,
     goto out;
   }
 
+  if(sx->udp_associate) {
+    /* Preserve the locally resolved target for SOCKS5 UDP headers. */
+    socks5_udp_set_dest(sx, ai->ai_family, destination);
+    destination = bind_addr;
+  }
+
   req[0] = desttype;
   result = Curl_bufq_write(&sx->iobuf, req, 1, &nwritten);
   if(result || (nwritten != 1)) {
@@ -914,9 +1056,12 @@ static CURLproxycode socks5_resolving(struct socks_ctx *sx,
     presult = CURLPX_SEND_REQUEST;
     goto out;
   }
+  /* An unbound UDP endpoint requests port zero per RFC 1928. */
   /* PORT MSB+LSB */
-  req[0] = (unsigned char)((sx->dest->port >> 8) & 0xffU);
-  req[1] = (unsigned char)(sx->dest->port & 0xffU);
+  req[0] = sx->udp_associate ? 0 :
+    (unsigned char)((sx->dest->port >> 8) & 0xffU);
+  req[1] = sx->udp_associate ? 0 :
+    (unsigned char)(sx->dest->port & 0xffU);
   result = Curl_bufq_write(&sx->iobuf, req, 2, &nwritten);
   if(result || (nwritten != 2)) {
     presult = CURLPX_SEND_REQUEST;
@@ -1022,6 +1167,54 @@ static CURLproxycode socks5_recv_resp1(struct socks_ctx *sx,
   return CURLPX_OK;
 }
 
+/* curl-impersonate: parse BND.ADDR and BND.PORT from the UDP ASSOCIATE
+ * response and store the proxy's UDP relay endpoint. */
+static CURLproxycode socks5_udp_set_relay(struct socks_ctx *sx,
+                                          struct Curl_easy *data)
+{
+  const unsigned char *resp;
+  const unsigned char *address;
+  size_t rlen;
+  size_t addrlen;
+  char addrbuf[MAX_IPADR_LEN];
+
+  if(!Curl_bufq_peek(&sx->iobuf, &resp, &rlen) || rlen < 8)
+    return CURLPX_RECV_CONNECT;
+
+  address = &resp[SOCKS5_HEADER_LEN];
+  switch(resp[3]) {
+  case SOCKS5_ATYP_IPV4:
+    addrlen = SOCKS5_IPV4_LEN;
+    sx->udp_relay_family = AF_INET;
+    break;
+#ifdef USE_IPV6
+  case SOCKS5_ATYP_IPV6:
+    addrlen = SOCKS5_IPV6_LEN;
+    sx->udp_relay_family = AF_INET6;
+    break;
+#endif
+  default:
+    failf(data, "SOCKS5 UDP relay has unsupported address type");
+    return CURLPX_BAD_ADDRESS_TYPE;
+  }
+
+  if(rlen < SOCKS5_HEADER_LEN + addrlen + SOCKS5_PORT_LEN)
+    return CURLPX_RECV_CONNECT;
+  memcpy(sx->udp_relay_addr, address, addrlen);
+  sx->udp_relay_port = (int)((address[addrlen] << 8) |
+                             address[addrlen + 1]);
+  if(!sx->udp_relay_port) {
+    failf(data, "SOCKS5 UDP relay returned port 0");
+    return CURLPX_BAD_ADDRESS_TYPE;
+  }
+  if(!curlx_inet_ntop(sx->udp_relay_family, sx->udp_relay_addr,
+                      addrbuf, sizeof(addrbuf)))
+    strcpy(addrbuf, "unknown");
+  infof(data, "SOCKS5 UDP relay is %s:%d", addrbuf,
+        sx->udp_relay_port);
+  return CURLPX_OK;
+}
+
 /*
  * This function logs in to a SOCKS5 proxy and sends the specifics to the final
  * destination server.
@@ -1126,6 +1319,8 @@ process_state:
       sxstate(sx, cf, data, SOCKS5_ST_REQ1_SEND);
       goto process_state;
     }
+    /* curl-impersonate: locally resolve the QUIC target before caching it
+     * for the SOCKS5 UDP header. */
     sx->start_resolving = TRUE;
     sxstate(sx, cf, data, SOCKS5_ST_RESOLVING);
     FALLTHROUGH();
@@ -1160,6 +1355,11 @@ process_state:
       return socks_failed(sx, cf, data, presult);
     if(!done)
       return CURLPX_OK;
+    if(sx->udp_associate) {
+      presult = socks5_udp_set_relay(sx, data);
+      if(presult)
+        return socks_failed(sx, cf, data, presult);
+    }
     CURL_TRC_CF(data, cf, "SOCKS5 request granted.");
     sxstate(sx, cf, data, SOCKS_ST_SUCCESS);
     FALLTHROUGH();
@@ -1177,9 +1377,100 @@ process_state:
   }
 }
 
-static void socks_proxy_ctx_free(struct socks_ctx *ctx)
+/* curl-impersonate: create the UDP relay data path while retaining the TCP
+ * control channel required for the lifetime of the association. */
+static CURLcode socks5_udp_create(struct Curl_cfilter *cf,
+                                  struct socks_ctx *sx,
+                                  struct Curl_easy *data)
+{
+  const struct Curl_sockaddr_ex *proxy_addr = NULL;
+  struct Curl_sockaddr_ex relay_addr;
+  struct Curl_peer *origin;
+  size_t addrlen;
+  size_t i;
+  bool is_zero = TRUE;
+  int dummy = 0;
+  CURLcode result;
+
+  addrlen = SOCKS5_IPV4_LEN;
+#ifdef USE_IPV6
+  if(sx->udp_relay_family == AF_INET6)
+    addrlen = SOCKS5_IPV6_LEN;
+#endif
+  for(i = 0; i < addrlen; ++i) {
+    if(sx->udp_relay_addr[i]) {
+      is_zero = FALSE;
+      break;
+    }
+  }
+  /* If the relay address is 0.0.0.0 or ::, reuse the proxy's TCP peer. */
+  if(is_zero && cf->next &&
+     !cf->next->cft->query(cf->next, data, CF_QUERY_REMOTE_ADDR,
+                           &dummy, &proxy_addr) && proxy_addr) {
+    if(proxy_addr->family == AF_INET) {
+      const struct sockaddr_in *sa =
+        (const struct sockaddr_in *)(const void *)&proxy_addr->curl_sa_addr;
+      memcpy(sx->udp_relay_addr, &sa->sin_addr, sizeof(sa->sin_addr));
+      sx->udp_relay_family = AF_INET;
+      is_zero = FALSE;
+    }
+#ifdef USE_IPV6
+    else if(proxy_addr->family == AF_INET6) {
+      const struct sockaddr_in6 *sa6 =
+        (const struct sockaddr_in6 *)(const void *)&proxy_addr->curl_sa_addr;
+      memcpy(sx->udp_relay_addr, &sa6->sin6_addr, sizeof(sa6->sin6_addr));
+      sx->udp_relay_family = AF_INET6;
+      is_zero = FALSE;
+    }
+#endif
+  }
+  if(is_zero)
+    return CURLE_COULDNT_CONNECT;
+
+  memset(&relay_addr, 0, sizeof(relay_addr));
+  if(sx->udp_relay_family == AF_INET) {
+    struct sockaddr_in *sa =
+      (struct sockaddr_in *)(void *)&relay_addr.curl_sa_addr;
+    sa->sin_family = AF_INET;
+    memcpy(&sa->sin_addr, sx->udp_relay_addr, sizeof(sa->sin_addr));
+    sa->sin_port = htons((unsigned short)sx->udp_relay_port);
+    relay_addr.family = AF_INET;
+    relay_addr.addrlen = sizeof(*sa);
+  }
+#ifdef USE_IPV6
+  else if(sx->udp_relay_family == AF_INET6) {
+    struct sockaddr_in6 *sa6 =
+      (struct sockaddr_in6 *)(void *)&relay_addr.curl_sa_addr;
+    sa6->sin6_family = AF_INET6;
+    memcpy(&sa6->sin6_addr, sx->udp_relay_addr, sizeof(sa6->sin6_addr));
+    sa6->sin6_port = htons((unsigned short)sx->udp_relay_port);
+    relay_addr.family = AF_INET6;
+    relay_addr.addrlen = sizeof(*sa6);
+  }
+#endif
+  else
+    return CURLE_COULDNT_CONNECT;
+  relay_addr.socktype = SOCK_DGRAM;
+  relay_addr.protocol = IPPROTO_UDP;
+
+  /* QUIC needs a connected UDP socket when using UDP ASSOCIATE. */
+  origin = Curl_conn_get_origin(cf->conn, cf->sockindex);
+  result = Curl_cf_udp_create(&sx->udp_cf, data, origin, sx->dest,
+                              TRNSPRT_QUIC, cf->conn, &relay_addr,
+                              NULL, TRNSPRT_QUIC);
+  if(result)
+    return result;
+  sx->udp_cf->conn = cf->conn;
+  sx->udp_cf->sockindex = cf->sockindex;
+  return CURLE_OK;
+}
+
+static void socks_proxy_ctx_free(struct socks_ctx *ctx,
+                                 struct Curl_easy *data)
 {
   if(ctx) {
+    if(ctx->tcp_cf)
+      Curl_conn_cf_discard_chain(&ctx->tcp_cf, data);
     Curl_peer_unlink(&ctx->dest);
     Curl_creds_unlink(&ctx->creds);
     Curl_bufq_free(&ctx->iobuf);
@@ -1236,6 +1527,22 @@ static CURLcode socks_proxy_cf_connect(struct Curl_cfilter *cf,
   else if(ctx->state != SOCKS_ST_SUCCESS)
     goto out;
 
+  if(ctx->udp_associate) {
+    if(!ctx->udp_cf) {
+      result = socks5_udp_create(cf, ctx, data);
+      if(result)
+        goto out;
+      /* Keep the TCP control channel and switch the data path to the UDP
+       * relay. Closing the control channel terminates the association. */
+      ctx->tcp_cf = cf->next;
+      cf->next = ctx->udp_cf;
+      CURL_TRC_CF(data, cf, "switched from SOCKS TCP control to UDP relay");
+    }
+    result = Curl_conn_cf_connect(cf->next, data, done);
+    if(result || !*done)
+      goto out;
+  }
+
 #ifdef CURLVERBOSE
   if(Curl_trc_is_verbose(data)) {
     struct ip_quadruple ipquad;
@@ -1261,6 +1568,171 @@ out:
   return result;
 }
 
+/* curl-impersonate: wrap outgoing QUIC datagrams in SOCKS5 UDP headers. */
+static CURLcode socks_proxy_cf_send(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    const uint8_t *buf, size_t len, bool eos,
+                                    size_t *pnwritten)
+{
+  struct socks_ctx *sx = cf->ctx;
+  unsigned char *packet;
+  unsigned char atyp;
+  size_t addrlen;
+  size_t header_len;
+  size_t nwritten = 0;
+  CURLcode result;
+
+  *pnwritten = 0;
+  if(!sx || !sx->udp_associate)
+    return Curl_cf_def_send(cf, data, buf, len, eos, pnwritten);
+  if(!sx->udp_dest_set)
+    return CURLE_SEND_ERROR;
+
+  switch(sx->udp_dest_atyp) {
+#ifdef USE_IPV6
+  case SOCKS5_ATYP_IPV6:
+    atyp = SOCKS5_ATYP_IPV6;
+    addrlen = SOCKS5_IPV6_LEN;
+    break;
+#endif
+  case SOCKS5_ATYP_DOMAIN:
+    atyp = SOCKS5_ATYP_DOMAIN;
+    addrlen = 1 + sx->udp_dest_domain_len;
+    break;
+  default:
+    atyp = SOCKS5_ATYP_IPV4;
+    addrlen = SOCKS5_IPV4_LEN;
+    break;
+  }
+
+  header_len = SOCKS5_HEADER_LEN + addrlen + SOCKS5_PORT_LEN;
+  if(len > SIZE_MAX - header_len)
+    return CURLE_OUT_OF_MEMORY;
+  packet = curlx_malloc(header_len + len);
+  if(!packet)
+    return CURLE_OUT_OF_MEMORY;
+
+  packet[0] = 0; /* RSV */
+  packet[1] = 0; /* RSV */
+  packet[2] = 0; /* FRAG */
+  packet[3] = atyp;
+  if(atyp == SOCKS5_ATYP_DOMAIN) {
+    packet[4] = (unsigned char)sx->udp_dest_domain_len;
+    memcpy(&packet[5], sx->udp_dest_domain, sx->udp_dest_domain_len);
+  }
+  else
+    memcpy(&packet[4], sx->udp_dest_addr, addrlen);
+  packet[SOCKS5_HEADER_LEN + addrlen] =
+    (unsigned char)((sx->udp_dest_port >> 8) & 0xffU);
+  packet[SOCKS5_HEADER_LEN + addrlen + 1] =
+    (unsigned char)(sx->udp_dest_port & 0xffU);
+  memcpy(&packet[header_len], buf, len);
+
+  result = cf->next->cft->do_send(cf->next, data, packet,
+                                  header_len + len, eos, &nwritten);
+  curlx_free(packet);
+  if(result)
+    return result;
+  if(nwritten != header_len + len)
+    return CURLE_SEND_ERROR;
+  *pnwritten = len;
+  return CURLE_OK;
+}
+
+/* curl-impersonate: strip SOCKS5 UDP headers before passing QUIC payloads
+ * upward. */
+static CURLcode socks_proxy_cf_recv(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    char *buf, size_t len, size_t *pnread)
+{
+  struct socks_ctx *sx = cf->ctx;
+  const size_t max_header = SOCKS5_HEADER_LEN + 1 + 255 + SOCKS5_PORT_LEN;
+  unsigned char *packet;
+  size_t packet_len;
+  size_t addrlen;
+  size_t offset;
+  size_t nread = 0;
+  CURLcode result;
+
+  *pnread = 0;
+  if(!sx || !sx->udp_associate)
+    return Curl_cf_def_recv(cf, data, buf, len, pnread);
+  if(len > SIZE_MAX - max_header)
+    return CURLE_OUT_OF_MEMORY;
+  packet_len = len + max_header;
+  packet = curlx_malloc(packet_len);
+  if(!packet)
+    return CURLE_OUT_OF_MEMORY;
+
+  result = cf->next->cft->do_recv(cf->next, data, (char *)packet,
+                                  packet_len, &nread);
+  if(result)
+    goto out;
+  if(nread < SOCKS5_HEADER_LEN || packet[0] || packet[1] || packet[2]) {
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+
+  offset = SOCKS5_HEADER_LEN;
+  switch(packet[3]) {
+  case SOCKS5_ATYP_IPV4:
+    addrlen = SOCKS5_IPV4_LEN;
+    break;
+#ifdef USE_IPV6
+  case SOCKS5_ATYP_IPV6:
+    addrlen = SOCKS5_IPV6_LEN;
+    break;
+#endif
+  case SOCKS5_ATYP_DOMAIN:
+    if(nread < SOCKS5_HEADER_LEN + 1) {
+      result = CURLE_RECV_ERROR;
+      goto out;
+    }
+    addrlen = 1 + packet[SOCKS5_HEADER_LEN];
+    break;
+  default:
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+  if(nread < offset + addrlen + SOCKS5_PORT_LEN) {
+    result = CURLE_RECV_ERROR;
+    goto out;
+  }
+
+  /* For socks5h with a domain target, leave udp_peer_set false so the socket
+   * filter reports the relay as QUIC's network peer. For locally resolved
+   * targets and IP literals, cache the source address from the UDP header. */
+  if((packet[3] == SOCKS5_ATYP_IPV4
+#ifdef USE_IPV6
+      || packet[3] == SOCKS5_ATYP_IPV6
+#endif
+     ) &&
+     sx->udp_dest_atyp != SOCKS5_ATYP_DOMAIN) {
+    int port = (int)((packet[offset + addrlen] << 8) |
+                     packet[offset + addrlen + 1]);
+#ifdef USE_IPV6
+    socks5_udp_set_peer(sx,
+                        packet[3] == SOCKS5_ATYP_IPV4 ? AF_INET : AF_INET6,
+                        &packet[offset], port);
+#else
+    socks5_udp_set_peer(sx, AF_INET, &packet[offset], port);
+#endif
+  }
+
+  offset += addrlen + SOCKS5_PORT_LEN;
+  if(nread > offset) {
+    size_t payload_len = nread - offset;
+    if(payload_len > len)
+      payload_len = len;
+    memcpy(buf, &packet[offset], payload_len);
+    *pnread = payload_len;
+  }
+
+out:
+  curlx_free(packet);
+  return result;
+}
+
 static CURLcode socks_cf_adjust_pollset(struct Curl_cfilter *cf,
                                         struct Curl_easy *data,
                                         struct easy_pollset *ps)
@@ -1292,8 +1764,7 @@ static CURLcode socks_cf_adjust_pollset(struct Curl_cfilter *cf,
 static void socks_proxy_cf_destroy(struct Curl_cfilter *cf,
                                    struct Curl_easy *data)
 {
-  (void)data;
-  socks_proxy_ctx_free(cf->ctx);
+  socks_proxy_ctx_free(cf->ctx, data);
   cf->ctx = NULL;
 }
 
@@ -1304,6 +1775,14 @@ static CURLcode socks_cf_query(struct Curl_cfilter *cf,
   struct socks_ctx *sx = cf->ctx;
 
   switch(query) {
+  case CF_QUERY_REMOTE_ADDR:
+    /* Return the target for local DNS/IP literals. For socks5h domain names,
+     * fall through so the UDP relay address is returned instead. */
+    if(sx && sx->udp_associate && sx->udp_peer_set) {
+      *((const struct Curl_sockaddr_ex **)pres2) = &sx->udp_peer_addr;
+      return CURLE_OK;
+    }
+    break;
   case CF_QUERY_HOST_PORT:
     if(sx) {
       *pres1 = sx->dest->port;
@@ -1334,14 +1813,25 @@ struct Curl_cftype Curl_cft_socks_proxy = {
   Curl_cf_def_shutdown,
   socks_cf_adjust_pollset,
   Curl_cf_def_data_pending,
-  Curl_cf_def_send,
-  Curl_cf_def_recv,
+  socks_proxy_cf_send,
+  socks_proxy_cf_recv,
   Curl_cf_def_cntrl,
   Curl_cf_def_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
   socks_cf_query,
 };
 
+bool Curl_cf_socks_proxy_is_udp_associate(struct Curl_cfilter *cf)
+{
+  for(; cf; cf = cf->next) {
+    if(cf->cft == &Curl_cft_socks_proxy) {
+      struct socks_ctx *sx = cf->ctx;
+      return sx && sx->udp_associate;
+    }
+  }
+  return FALSE;
+}
+
 CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
                                           struct Curl_easy *data,
                                           struct Curl_peer *dest,
@@ -1366,6 +1856,13 @@ CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
     failf(data, "unknown proxytype %d option given", proxy_type);
     return CURLE_COULDNT_CONNECT;
   }
+  if((cf_at->conn->transport_wanted == TRNSPRT_QUIC) &&
+     !cf_at->conn->http_proxy.peer &&
+     (proxy_type != CURLPROXY_SOCKS5) &&
+     (proxy_type != CURLPROXY_SOCKS5_HOSTNAME)) {
+    failf(data, "SOCKS UDP ASSOCIATE requires SOCKS5");
+    return CURLE_UNSUPPORTED_PROTOCOL;
+  }
 
   /* NUL byte already part of struct size */
   ctx = curlx_calloc(1, sizeof(*ctx));
@@ -1376,6 +1873,11 @@ CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
   Curl_peer_link(&ctx->dest, dest);
   ctx->ip_version = ip_version;
   ctx->proxy_type = proxy_type;
+  /* curl-impersonate: QUIC through a direct SOCKS proxy uses UDP ASSOCIATE.
+   * A nested HTTP proxy continues through its TCP CONNECT path. */
+  ctx->udp_associate =
+    (cf_at->conn->transport_wanted == TRNSPRT_QUIC) &&
+    !cf_at->conn->http_proxy.peer;
   Curl_creds_link(&ctx->creds, creds);
   Curl_bufq_init2(&ctx->iobuf, SOCKS_CHUNK_SIZE, SOCKS_CHUNKS,
                   BUFQ_OPT_SOFT_LIMIT);
@@ -1384,7 +1886,7 @@ CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
   if(!result)
     Curl_conn_cf_insert_after(cf_at, cf);
   else
-    socks_proxy_ctx_free(ctx);
+    socks_proxy_ctx_free(ctx, data);
   return result;
 }
 
diff --git a/lib/socks.h b/lib/socks.h
index d8e77c7f13..d410a3f18a 100644
--- a/lib/socks.h
+++ b/lib/socks.h
@@ -25,7 +25,11 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#ifndef CURL_DISABLE_PROXY
+#ifdef CURL_DISABLE_PROXY
+
+#define Curl_cf_socks_proxy_is_udp_associate(x) FALSE
+
+#else
 
 struct Curl_peer;
 struct Curl_creds;
@@ -62,8 +66,11 @@ CURLcode Curl_cf_socks_proxy_insert_after(struct Curl_cfilter *cf_at,
                                           uint8_t proxy_type,
                                           struct Curl_creds *creds);
 
+/* Query whether a SOCKS filter in the chain uses UDP ASSOCIATE. */
+bool Curl_cf_socks_proxy_is_udp_associate(struct Curl_cfilter *cf);
+
 extern struct Curl_cftype Curl_cft_socks_proxy;
 
-#endif /* !CURL_DISABLE_PROXY */
+#endif /* CURL_DISABLE_PROXY */
 
 #endif /* HEADER_CURL_SOCKS_H */
diff --git a/lib/transfer.c b/lib/transfer.c
index 1a4138f6c1..78b6591327 100644
--- a/lib/transfer.c
+++ b/lib/transfer.c
@@ -75,7 +75,25 @@
 #include "bufref.h"
 
 #if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_SMTP) || \
-  !defined(CURL_DISABLE_IMAP)
+    !defined(CURL_DISABLE_IMAP)
+struct curl_slist *Curl_http_request_headers(const struct Curl_easy *data)
+{
+  struct curl_slist *head =
+    data->state.merged_headers ? data->state.merged_headers :
+    data->set.headers;
+
+  if(data->conn && data->conn->scheme &&
+     (data->conn->scheme->protocol & (CURLPROTO_WS | CURLPROTO_WSS)) &&
+     data->set.ws_headers)
+    return data->set.ws_headers;
+
+  if(data->conn && (Curl_conn_http_version((struct Curl_easy *)data,
+                                           data->conn) == 30) &&
+     data->set.http3_headers)
+    return data->set.http3_headers;
+
+  return head;
+}
 /*
  * checkheaders() checks the linked list of custom headers for a
  * particular header (prefix). Provide the prefix without colon!
@@ -90,7 +108,9 @@ char *Curl_checkheaders(const struct Curl_easy *data,
   DEBUGASSERT(thislen);
   DEBUGASSERT(thisheader[thislen - 1] != ':');
 
-  for(head = data->set.headers; head; head = head->next) {
+  head = Curl_http_request_headers(data);
+
+  for(; head; head = head->next) {
     if(curl_strnequal(head->data, thisheader, thislen) &&
        Curl_headersep(head->data[thislen]))
       return head->data;
diff --git a/lib/transfer.h b/lib/transfer.h
index 7507ce27bd..6c89e49ae2 100644
--- a/lib/transfer.h
+++ b/lib/transfer.h
@@ -25,6 +25,7 @@
  ***************************************************************************/
 #define Curl_headersep(x) ((((x) == ':') || ((x) == ';')))
 
+struct curl_slist *Curl_http_request_headers(const struct Curl_easy *data);
 char *Curl_checkheaders(const struct Curl_easy *data,
                         const char *thisheader,
                         const size_t thislen);
diff --git a/lib/url.c b/lib/url.c
index 505e08a7e1..ad8440dd9c 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -270,6 +270,8 @@ CURLcode Curl_close(struct Curl_easy **datap)
   curlx_safefree(data->state.most_recent_ftp_entrypath);
   curlx_safefree(data->info.contenttype);
   curlx_safefree(data->info.wouldredirect);
+  curl_slist_free_all(data->info.cookiechanges);
+  Curl_free_redirects(data);
 
   /* No longer a dirty share, if it exists */
   if(Curl_share_easy_unlink(data))
@@ -288,6 +290,10 @@ CURLcode Curl_close(struct Curl_easy **datap)
 #ifndef CURL_DISABLE_RTSP
   curlx_safefree(data->state.aptr.rtsp_transport);
 #endif
+  /* curl-impersonate: Free the list set by CURLOPT_HTTPBASEHEADER. */
+  curl_slist_free_all(data->state.base_headers);
+  /* curl-impersonate: Free the dynamic list of headers. */
+  curl_slist_free_all(data->state.merged_headers);
 
 #if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_FORM_API)
   Curl_mime_cleanpart(data->state.formp);
@@ -399,6 +405,7 @@ void Curl_init_userdefined(struct Curl_easy *data)
   Curl_setopt_SSLVERSION(data, CURLOPT_PROXY_SSLVERSION,
                          CURL_SSLVERSION_DEFAULT);
 #endif
+  set->ssl_version_set = FALSE;
 #endif
 #ifndef CURL_DISABLE_FTP
   set->wildcard_enabled = FALSE;
@@ -413,8 +420,14 @@ void Curl_init_userdefined(struct Curl_easy *data)
   set->tcp_fastopen = FALSE;
   set->tcp_nodelay = TRUE;
   set->ssl_enable_alpn = TRUE;
+  set->ssl_enable_ticket = TRUE;
+  set->tls_grease = FALSE;
+  set->tls_use_new_alps_codepoint = FALSE;
   set->expect_100_timeout = 1000L; /* Wait for a second by default. */
   set->sep_headers = TRUE; /* separated header lists by default */
+#ifndef CURL_DISABLE_COOKIES
+  set->split_cookies = FALSE; /* use a single Cookie header by default */
+#endif
   set->buffer_size = READBUFFER_SIZE;
   set->upload_buffer_size = UPLOADBUFFER_DEFAULT;
   set->upload_flags = CURLULFLAG_SEEN;
@@ -1296,6 +1309,10 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
 #endif
   conn->ip_version = data->set.ipver;
   conn->bits.connect_only = (bool)data->set.connect_only;
+#ifndef CURL_DISABLE_PROXY
+  conn->bits.proxy_credential_no_reuse =
+    data->set.proxy_credential_no_reuse;
+#endif
   conn->transport_wanted = TRNSPRT_TCP; /* most of them are TCP streams */
 
   /* Store the local bind parameters that will be used for this connection */
@@ -2171,6 +2188,11 @@ static CURLcode url_create_needle(struct Curl_easy *data,
        (default) */
     if(data->set.ssl_enable_alpn)
       needle->bits.tls_enable_alpn = TRUE;
+
+    /* curl-impersonate: Turn on ALPS when requested for a protocol which
+     * supports ALPN. */
+    if(data->set.ssl_enable_alps)
+      needle->bits.tls_enable_alps = TRUE;
   }
 
   if(network_scheme) {
@@ -2373,7 +2395,7 @@ static CURLcode url_find_or_create_conn(struct Curl_easy *data)
 #endif
 
   /* Complete the easy's SSL configuration for connection cache matching */
-  result = Curl_ssl_easy_config_complete(data, needle->origin);
+  result = Curl_ssl_easy_config_complete_conn(data, needle);
   if(result)
     goto out;
 
@@ -2421,7 +2443,6 @@ static CURLcode url_find_or_create_conn(struct Curl_easy *data)
     /* We have decided that we want a new connection. We may not be able to do
        that if we have reached the limit of how many connections we are
        allowed to open. */
-
     if(waitpipe) {
       /* There is a connection that *might* become usable for multiplexing
          "soon", and we wait for that */
diff --git a/lib/urldata.h b/lib/urldata.h
index d4d336d8db..73de71edeb 100644
--- a/lib/urldata.h
+++ b/lib/urldata.h
@@ -193,6 +193,7 @@ struct ConnectBits {
   BIT(connect_only);
 #ifndef CURL_DISABLE_PROXY
   BIT(origin_is_proxy);  /* if set, the connection's origin is a proxy */
+  BIT(proxy_credential_no_reuse); /* partition TLS sessions by proxy creds */
 #endif
   /* always modify bits.close with the connclose() and connkeep() macros! */
   BIT(close); /* if set, we close the connection after this request */
@@ -220,6 +221,14 @@ struct ConnectBits {
   BIT(multiplex); /* connection is multiplexed */
   BIT(tcp_fastopen); /* use TCP Fast Open */
   BIT(tls_enable_alpn); /* TLS ALPN extension? */
+  BIT(tls_enable_alps); /* TLS ALPS extension? */
+  BIT(tls_enable_ticket); /* TLS session ticket extension? */
+  BIT(tls_permute_extensions); /* TLS extension permutations */
+  BIT(tls_use_new_alps_codepoint); /* TLS ALPS new codepoint */
+  BIT(tls_grease);  /* TLS grease? */
+#ifndef CURL_DISABLE_DOH
+  BIT(doh);
+#endif
   BIT(sock_accepted); /* TRUE if the SECONDARYSOCKET was created with
                          accept() */
   BIT(parallel_connect); /* set TRUE when a parallel connect attempt has
@@ -417,6 +426,10 @@ struct PureInfo {
   uint32_t httpauthpicked;  /* selected host auth type */
   char *contenttype; /* the content type of the object */
   char *wouldredirect; /* URL this would have been redirected to if asked to */
+  struct curl_slist *cookiechanges; /* accepted Set-Cookie mutations */
+  struct curl_slist *cookiechanges_tail; /* last cookie change */
+  struct curl_slist *redirect_history; /* followed redirects */
+  struct curl_slist *redirect_history_tail; /* last followed redirect */
   curl_off_t retry_after; /* info from Retry-After: header */
   uint32_t header_size;  /* size of read header(s) in bytes */
 
@@ -526,6 +539,7 @@ struct Curl_data_prio_node {
  */
 struct Curl_data_priority {
   int weight;
+  BIT(exclusive);
 };
 
 /* Timers */
@@ -673,6 +687,19 @@ struct UrlState {
                                     curl_easy_setopt(COOKIEFILE) calls */
 #endif
 
+  /*
+   * curl-impersonate:
+   * List of "base" headers set by CURLOPT_HTTPBASEHEADER.
+   */
+  struct curl_slist *base_headers;
+  /*
+   * curl-impersonate:
+   * Dynamically-constructed list of HTTP headers.
+   * This list is a merge of the default HTTP headers needed to impersonate a
+   * browser, together with any user-supplied headers.
+   */
+  struct curl_slist *merged_headers;
+
 #ifdef CURLVERBOSE
   struct curl_trc_feat *feat; /* opt. trace feature transfer is part of */
 #endif
@@ -769,6 +796,8 @@ enum dupstring {
   STRING_SSL_CRLFILE,     /* CRL file to check certificate */
   STRING_SSL_ISSUERCERT,  /* issuer cert file to check certificate */
   STRING_SERVICE_NAME,    /* Service name */
+  STRING_IMPERSONATE,     /* curl-impersonate */
+  STRING_FORM_BOUNDARY,   /* CURLOPT_FORM_BOUNDARY */
 #ifndef CURL_DISABLE_PROXY
   STRING_CERT_PROXY,      /* client certificate filename */
   STRING_CERT_TYPE_PROXY, /* format for certificate (default: PEM)*/
@@ -867,6 +896,7 @@ enum dupstring {
   STRING_DNS_LOCAL_IP6,
 #endif
   STRING_SSL_EC_CURVES,
+  STRING_HTTP3_SSL_EC_CURVES,
 #ifndef CURL_DISABLE_AWS
   STRING_AWS_SIGV4, /* Parameters for V4 signature */
 #endif
@@ -875,6 +905,21 @@ enum dupstring {
 #endif
   STRING_ECH_CONFIG,            /* CURLOPT_ECH_CONFIG */
   STRING_ECH_PUBLIC,            /* CURLOPT_ECH_PUBLIC */
+  STRING_HTTP3_SIG_HASH_ALGS,
+  STRING_SSL_CERT_COMPRESSION,
+  STRING_WS_SSL_CERT_COMPRESSION,
+  STRING_HTTP2_PSEUDO_HEADERS_ORDER,
+  STRING_HTTP2_SETTINGS,
+  STRING_HTTP2_STREAMS,
+  STRING_HTTP3_PSEUDO_HEADERS_ORDER,
+  STRING_HTTP3_SETTINGS,
+  STRING_QUIC_TRANSPORT_PARAMETERS,
+  STRING_HTTPHEADER_ORDER,
+  STRING_HTTP3_HTTPHEADER_ORDER,
+  STRING_WS_HTTPHEADER_ORDER,
+  STRING_TLS_EXTENSION_ORDER,
+  STRING_HTTP3_TLS_EXTENSION_ORDER,
+  STRING_TLS_DELEGATED_CREDENTIALS,
   STRING_SSL_SIGNATURE_ALGORITHMS, /* CURLOPT_SSL_SIGNATURE_ALGORITHMS */
 
   /* -- end of null-terminated strings -- */
@@ -956,6 +1001,8 @@ struct UserDefined {
                                 download */
   curl_off_t set_resume_from;  /* continue [ftp] transfer from here */
   struct curl_slist *headers; /* linked list of extra headers */
+  struct curl_slist *http3_headers; /* HTTP/3-specific extra headers */
+  struct curl_slist *ws_headers; /* WebSocket-specific extra headers */
   struct curl_httppost *httppost;  /* linked list of old POST data */
 #if !defined(CURL_DISABLE_MIME) || !defined(CURL_DISABLE_FORM_API)
   curl_mimepart *mimepostp;  /* MIME/POST data. */
@@ -1117,6 +1164,7 @@ struct UserDefined {
   BIT(sep_headers);     /* handle host and proxy headers separately */
 #ifndef CURL_DISABLE_COOKIES
   BIT(cookiesession);   /* new cookie session? */
+  BIT(split_cookies);   /* split cookies into one Cookie header per pair */
 #endif
   BIT(crlf);            /* convert crlf on ftp upload(?) */
 #ifdef USE_SSH
@@ -1133,6 +1181,7 @@ struct UserDefined {
   BIT(get_filetime);     /* get the time and get of the remote file */
 #ifndef CURL_DISABLE_PROXY
   BIT(tunnel_thru_httpproxy); /* use CONNECT through an HTTP proxy */
+  BIT(proxy_credential_no_reuse); /* no reuse of SSL sessions/connections via different proxy credentials */
 #endif
   BIT(prefer_ascii);     /* ASCII rather than binary */
   BIT(remote_append);    /* append, not overwrite, on upload */
@@ -1175,7 +1224,17 @@ struct UserDefined {
   BIT(sasl_ir);         /* Enable/disable SASL initial response */
   BIT(tcp_keepalive);  /* use TCP keepalives */
   BIT(tcp_fastopen);   /* use TCP Fast Open */
+  BIT(ssl_version_set); /* CURLOPT_SSLVERSION was explicitly set */
   BIT(ssl_enable_alpn);/* TLS ALPN extension? */
+  BIT(ssl_enable_alps);/* TLS ALPS extension? */
+  BIT(ssl_enable_ticket); /* TLS session ticket extension */
+  BIT(ws_disable_session_ticket); /* disable WebSocket TLS session ticket */
+  BIT(ssl_permute_extensions); /* TLS Permute extensions */
+  BIT(tls_grease);  /* TLS grease? */
+  BIT(tls_key_usage_no_check);  /* TLS key_usage_check? */
+  BIT(tls_signed_cert_timestamps);  /* TLS signed cert timestamps? */
+  BIT(tls_status_request);  /* TLS status request */
+  BIT(tls_use_new_alps_codepoint); /* TLS use new alps codepoint */
   BIT(path_as_is);     /* allow dotdots? */
   BIT(pipewait);       /* wait for multiplex status before starting a new
                           connection */
@@ -1197,10 +1256,15 @@ struct UserDefined {
   BIT(doh_verifystatus);   /* DoH certificate status verification */
 #endif
   BIT(http09_allowed); /* allow HTTP/0.9 responses */
+// BIT(grease);           /* grease enabled? */
 #ifndef CURL_DISABLE_WEBSOCKETS
   BIT(ws_raw_mode);
   BIT(ws_no_auto_pong);
 #endif
+  int http2_window_update;
+  int tls_record_size_limit;
+  int tls_key_shares_limit;
+  BIT(http2_no_priority);
   BIT(post301); /* keep POSTs as POSTs after a 301 request */
   BIT(post302); /* keep POSTs as POSTs after a 302 request */
   BIT(post303); /* keep POSTs as POSTs after a 303 request */
diff --git a/lib/vquic/cf-ngtcp2-cmn.c b/lib/vquic/cf-ngtcp2-cmn.c
index e1ca18cf69..c41071390f 100644
--- a/lib/vquic/cf-ngtcp2-cmn.c
+++ b/lib/vquic/cf-ngtcp2-cmn.c
@@ -63,6 +63,7 @@
 #include "http1.h"
 #include "select.h"
 #include "sockaddr.h"
+#include "strcase.h"
 #include "transfer.h"
 #include "bufref.h"
 #include "vquic/vquic.h"
@@ -119,6 +120,7 @@ CURLcode Curl_cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx,
                                  struct Curl_peer *origin,
                                  struct Curl_peer *peer,
                                  struct ssl_primary_config *sslc,
+                                 struct connectdata *conn,
                                  cf_ngtcp2_init_h3_conn *init_h3_conn_cb)
 {
   DEBUGASSERT(!ctx->initialized);
@@ -129,10 +131,11 @@ CURLcode Curl_cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx,
   Curl_bufcp_init(&ctx->stream_bufcp, H3_STREAM_CHUNK_SIZE,
                   H3_STREAM_POOL_SPARES);
   curlx_dyn_init(&ctx->scratch, CURL_MAX_HTTP_HEADER);
+  curlx_dyn_init(&ctx->tp_raw, CURL_MAX_INPUT_LENGTH);
   Curl_uint32_hash_init(&ctx->streams, 63, h3_stream_hash_free);
   ctx->init_h3_conn_cb = init_h3_conn_cb;
   ctx->initialized = TRUE;
-  return Curl_vquic_tls_peer_init(origin, peer, sslc, &ctx->ssl_peer);
+  return Curl_vquic_tls_peer_init(origin, peer, sslc, &ctx->ssl_peer, conn);
 }
 
 void Curl_cf_ngtcp2_ctx_cleanup(struct cf_ngtcp2_ctx *ctx)
@@ -142,6 +145,7 @@ void Curl_cf_ngtcp2_ctx_cleanup(struct cf_ngtcp2_ctx *ctx)
     vquic_ctx_free(&ctx->q);
     Curl_bufcp_free(&ctx->stream_bufcp);
     curlx_dyn_free(&ctx->scratch);
+    curlx_dyn_free(&ctx->tp_raw);
     Curl_uint32_hash_destroy(&ctx->streams);
     Curl_ssl_peer_cleanup(&ctx->ssl_peer);
     curlx_safefree(ctx->tunnel_inbuf);
@@ -188,12 +192,727 @@ static void qlog_callback(void *user_data, uint32_t flags,
   }
 }
 
-static void quic_settings(struct cf_ngtcp2_ctx *ctx,
-                          struct Curl_easy *data,
-                          struct cf_ngtcp2_io_ctx *pktx)
+/* Walk the filter chain to find the active socket for QUIC logging. */
+static CURLcode cf_ngtcp2_peek_socket(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      curl_socket_t *psock,
+                                      const struct Curl_sockaddr_ex **paddr,
+                                      struct ip_quadruple *pip)
+{
+  bool got_sock = FALSE;
+  bool got_addr = FALSE;
+  bool got_ip = FALSE;
+  int dummy = 0;
+
+  for(; cf; cf = cf->next) {
+    if(!got_sock && (psock || pip) &&
+       !Curl_cf_socket_peek(cf, data, psock, NULL, pip)) {
+      got_sock = (psock != NULL);
+      got_ip = (pip != NULL);
+    }
+    if(paddr && !got_addr) {
+      const struct Curl_sockaddr_ex *addr = NULL;
+      if(!cf->cft->query(cf, data, CF_QUERY_REMOTE_ADDR, &dummy, &addr) &&
+         addr) {
+        *paddr = addr;
+        got_addr = TRUE;
+      }
+    }
+    if((!psock || got_sock) && (!paddr || got_addr) && (!pip || got_ip))
+      return CURLE_OK;
+  }
+  return CURLE_FAILED_INIT;
+}
+
+static bool quic_has_empty_initial_scid(const char *params)
+{
+  const char *p = params;
+
+  if(!p || !*p)
+    return FALSE;
+
+  while(*p) {
+    const char *end;
+    size_t len;
+
+    while(*p == ';')
+      ++p;
+    if(!*p)
+      break;
+
+    end = strchr(p, ';');
+    len = end ? (size_t)(end - p) : strlen(p);
+    if((len == 3) && (p[0] == '1') && (p[1] == '5') && (p[2] == ':'))
+      return TRUE;
+
+    p = end ? (end + 1) : (p + len);
+  }
+
+  return FALSE;
+}
+
+/* https://www.iana.org/assignments/quic/quic.xhtml */
+static CURLcode quic_apply_transport_param(ngtcp2_transport_params *t,
+                                           uint64_t id,
+                                           uint64_t value,
+                                           bool has_value,
+                                           struct Curl_easy *data)
+{
+  switch(id) {
+  case 0x00: /* original_destination_connection_id (server only) */
+  case 0x02: /* stateless_reset_token (server only) */
+  case 0x0d: /* preferred_address (server only) */
+  case 0x10: /* retry_source_connection_id (server only) */
+  case 0x11: /* version_information (server only) */
+    failf(data, "QUIC transport param %" PRIu64 " is server-only",
+          (uint64_t)id);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  case 0x0f: /* initial_source_connection_id (set by library) */
+    failf(data, "QUIC transport param %" PRIu64
+          " is managed by the library", (uint64_t)id);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  case 0x01: /* max_idle_timeout (milliseconds) */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->max_idle_timeout = (ngtcp2_duration)value * NGTCP2_MILLISECONDS;
+    break;
+  case 0x03: /* max_udp_payload_size */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->max_udp_payload_size = value;
+    break;
+  case 0x04: /* initial_max_data */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->initial_max_data = value;
+    break;
+  case 0x05: /* initial_max_stream_data_bidi_local */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->initial_max_stream_data_bidi_local = value;
+    break;
+  case 0x06: /* initial_max_stream_data_bidi_remote */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->initial_max_stream_data_bidi_remote = value;
+    break;
+  case 0x07: /* initial_max_stream_data_uni */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->initial_max_stream_data_uni = value;
+    break;
+  case 0x08: /* initial_max_streams_bidi */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->initial_max_streams_bidi = value;
+    break;
+  case 0x09: /* initial_max_streams_uni */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->initial_max_streams_uni = value;
+    break;
+  case 0x0a: /* ack_delay_exponent */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->ack_delay_exponent = value;
+    break;
+  case 0x0b: /* max_ack_delay (milliseconds) */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->max_ack_delay = (ngtcp2_duration)value * NGTCP2_MILLISECONDS;
+    break;
+  case 0x0c: /* disable_active_migration */
+    t->disable_active_migration = (uint8_t)(!has_value || value);
+    break;
+  case 0x0e: /* active_connection_id_limit */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->active_connection_id_limit = value;
+    break;
+  case 0x20: /* max_datagram_frame_size */
+    if(!has_value)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    t->max_datagram_frame_size = value;
+    break;
+  case 0x2ab2: /* grease_quic_bit */
+    t->grease_quic_bit = (uint8_t)(!has_value || value);
+    break;
+  default:
+    infof(data, "QUIC transport param %" PRIu64
+          " is not mapped to ngtcp2_transport_params",
+          (uint64_t)id);
+    break;
+  }
+
+  return CURLE_OK;
+}
+
+#define QUIC_VARINT_MAX UINT64_C(0x3fffffffffffffff)
+#define QUIC_TP_INITIAL_SOURCE_CONNECTION_ID UINT64_C(0x0f)
+#define QUIC_TP_VERSION_INFORMATION          UINT64_C(0x11)
+#define QUIC_TP_INITIAL_RTT                  UINT64_C(0x3127)
+#define QUIC_TP_GOOGLE_VERSION               UINT64_C(0x4752)
+#define QUIC_TP_GREASE_ID_BASE              UINT64_C(27)
+#define QUIC_TP_GREASE_ID_STEP              UINT64_C(31)
+#define QUIC_TP_GREASE_VALUE_MAXLEN         8
+#define QUIC_INITIAL_RTT_US_BASE             UINT64_C(333000)
+#define QUIC_INITIAL_RTT_US_JITTER           UINT64_C(50000)
+
+static uint64_t quic_initial_rtt_auto_us(struct Curl_easy *data)
+{
+  /* Use RFC9002 default initial RTT with moderate jitter for
+   * fingerprinting. */
+  uint64_t value = QUIC_INITIAL_RTT_US_BASE;
+  unsigned char rnd[2];
+  uint64_t span;
+  uint64_t off;
+
+  if(Curl_rand(data, rnd, sizeof(rnd)))
+    return value;
+
+  span = (QUIC_INITIAL_RTT_US_JITTER * 2) + 1;
+  off = ((((uint64_t)rnd[0]) << 8) | rnd[1]) % span;
+  value = (QUIC_INITIAL_RTT_US_BASE - QUIC_INITIAL_RTT_US_JITTER) + off;
+  return value;
+}
+
+static uint32_t quic_version_grease(struct Curl_easy *data)
+{
+  unsigned char rnd[4];
+  uint32_t v = 0x0a0a0a0aU;
+
+  if(Curl_rand(data, rnd, sizeof(rnd)))
+    return v;
+
+  v = (uint32_t)(((rnd[0] & 0xf0U) | 0x0aU) << 24);
+  v |= (uint32_t)(((rnd[1] & 0xf0U) | 0x0aU) << 16);
+  v |= (uint32_t)(((rnd[2] & 0xf0U) | 0x0aU) << 8);
+  v |= (uint32_t)((rnd[3] & 0xf0U) | 0x0aU);
+  return v;
+}
+
+static CURLcode quic_rand_u64(struct Curl_easy *data, uint64_t *val)
+{
+  unsigned char rnd[sizeof(uint64_t)];
+  CURLcode result;
+  size_t i;
+
+  result = Curl_rand(data, rnd, sizeof(rnd));
+  if(result)
+    return result;
+
+  *val = 0;
+  for(i = 0; i < sizeof(rnd); ++i)
+    *val = (*val << 8) | rnd[i];
+
+  return CURLE_OK;
+}
+
+static CURLcode quic_generate_grease_tp(struct Curl_easy *data,
+                                        uint64_t *pid,
+                                        unsigned char *value,
+                                        size_t *vlen)
+{
+  uint64_t n;
+  uint64_t max_n = (QUIC_VARINT_MAX - QUIC_TP_GREASE_ID_BASE) /
+                   QUIC_TP_GREASE_ID_STEP;
+  unsigned char lenrnd;
+  CURLcode result;
+
+  result = quic_rand_u64(data, &n);
+  if(result)
+    return result;
+
+  *pid = (QUIC_TP_GREASE_ID_STEP * (n % (max_n + 1))) +
+         QUIC_TP_GREASE_ID_BASE;
+
+  result = Curl_rand(data, &lenrnd, sizeof(lenrnd));
+  if(result)
+    return result;
+
+  *vlen = (size_t)(lenrnd % QUIC_TP_GREASE_VALUE_MAXLEN) + 1;
+  return Curl_rand(data, value, *vlen);
+}
+
+static CURLcode quic_permute_token_order(char **tokens, size_t ntokens,
+                                         struct Curl_easy *data)
+{
+  size_t i;
+
+  DEBUGASSERT(ntokens > 1);
+  for(i = ntokens - 1; i > 0; --i) {
+    uint64_t r;
+    size_t j;
+    char *tmp;
+    CURLcode result = quic_rand_u64(data, &r);
+    if(result)
+      return result;
+    j = (size_t)(r % (i + 1));
+    if(i == j)
+      continue;
+    tmp = tokens[i];
+    tokens[i] = tokens[j];
+    tokens[j] = tmp;
+  }
+
+  return CURLE_OK;
+}
+
+static size_t quic_varint_encode(uint8_t *buf, uint64_t value)
+{
+  if(value <= UINT64_C(0x3f)) {
+    buf[0] = (uint8_t)value;
+    return 1;
+  }
+  if(value <= UINT64_C(0x3fff)) {
+    buf[0] = (uint8_t)(0x40 | (value >> 8));
+    buf[1] = (uint8_t)value;
+    return 2;
+  }
+  if(value <= UINT64_C(0x3fffffff)) {
+    buf[0] = (uint8_t)(0x80 | (value >> 24));
+    buf[1] = (uint8_t)(value >> 16);
+    buf[2] = (uint8_t)(value >> 8);
+    buf[3] = (uint8_t)value;
+    return 4;
+  }
+  if(value <= QUIC_VARINT_MAX) {
+    buf[0] = (uint8_t)(0xc0 | (value >> 56));
+    buf[1] = (uint8_t)(value >> 48);
+    buf[2] = (uint8_t)(value >> 40);
+    buf[3] = (uint8_t)(value >> 32);
+    buf[4] = (uint8_t)(value >> 24);
+    buf[5] = (uint8_t)(value >> 16);
+    buf[6] = (uint8_t)(value >> 8);
+    buf[7] = (uint8_t)value;
+    return 8;
+  }
+  return 0;
+}
+
+static CURLcode quic_raw_append_param(struct dynbuf *raw,
+                                      uint64_t id,
+                                      uint64_t value,
+                                      bool has_value)
+{
+  uint8_t idbuf[8];
+  uint8_t lenbuf[8];
+  uint8_t valbuf[8];
+  size_t idlen;
+  size_t vlen = 0;
+  size_t lenlen;
+  CURLcode result;
+
+  idlen = quic_varint_encode(idbuf, id);
+  if(!idlen)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  if(has_value) {
+    vlen = quic_varint_encode(valbuf, value);
+    if(!vlen)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+
+  lenlen = quic_varint_encode(lenbuf, (uint64_t)vlen);
+  if(!lenlen)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  result = curlx_dyn_addn(raw, (const char *)idbuf, idlen);
+  if(result)
+    return result;
+  result = curlx_dyn_addn(raw, (const char *)lenbuf, lenlen);
+  if(result)
+    return result;
+  if(vlen) {
+    result = curlx_dyn_addn(raw, (const char *)valbuf, vlen);
+    if(result)
+      return result;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode quic_raw_append_param_bytes(struct dynbuf *raw,
+                                            uint64_t id,
+                                            const uint8_t *value,
+                                            size_t vlen)
+{
+  uint8_t idbuf[8];
+  uint8_t lenbuf[8];
+  size_t idlen;
+  size_t lenlen;
+  CURLcode result;
+
+  if(vlen && !value)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  idlen = quic_varint_encode(idbuf, id);
+  if(!idlen)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  lenlen = quic_varint_encode(lenbuf, (uint64_t)vlen);
+  if(!lenlen)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  result = curlx_dyn_addn(raw, (const char *)idbuf, idlen);
+  if(result)
+    return result;
+  result = curlx_dyn_addn(raw, (const char *)lenbuf, lenlen);
+  if(result)
+    return result;
+  if(vlen) {
+    result = curlx_dyn_addn(raw, (const char *)value, vlen);
+    if(result)
+      return result;
+  }
+
+  return CURLE_OK;
+}
+
+static CURLcode quic_dyn_add_u32be(struct dynbuf *db, uint32_t value)
+{
+  unsigned char b[4];
+  b[0] = (unsigned char)(value >> 24);
+  b[1] = (unsigned char)(value >> 16);
+  b[2] = (unsigned char)(value >> 8);
+  b[3] = (unsigned char)value;
+  return curlx_dyn_addn(db, (const char *)b, sizeof(b));
+}
+
+static CURLcode quic_parse_version_token(const char *tok,
+                                         bool allow_grease,
+                                         struct Curl_easy *data,
+                                         uint32_t *pver)
+{
+  unsigned long long v;
+  char *end = NULL;
+
+  if(allow_grease && curl_strequal(tok, "GREASE")) {
+    *pver = quic_version_grease(data);
+    return CURLE_OK;
+  }
+
+  v = strtoull(tok, &end, 0);
+  if(!*tok || (end && *end) || (v > 0xffffffffULL))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  *pver = (uint32_t)v;
+  return CURLE_OK;
+}
+
+static CURLcode quic_append_version_information(struct dynbuf *raw,
+                                                const char *value_str,
+                                                struct Curl_easy *data)
+{
+  struct dynbuf vb;
+  CURLcode result = CURLE_OK;
+  char *tmp;
+  char *chosen_tok;
+  char *available_list;
+  char *p;
+  char *sep;
+  size_t available_count = 0;
+  uint32_t ver;
+
+  if(!value_str || !*value_str)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  tmp = curlx_strdup(value_str);
+  if(!tmp)
+    return CURLE_OUT_OF_MEMORY;
+
+  sep = strchr(tmp, '@');
+  if(!sep || !*tmp || !*(sep + 1)) {
+    curlx_free(tmp);
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  }
+  *sep = '\0';
+  chosen_tok = tmp;
+  available_list = sep + 1;
+
+  curlx_dyn_init(&vb, 64);
+  result = quic_parse_version_token(chosen_tok, FALSE, data, &ver);
+  if(result)
+    goto out;
+  result = quic_dyn_add_u32be(&vb, ver);
+  if(result)
+    goto out;
+
+  p = available_list;
+  while(*p) {
+    char *comma = strchr(p, ',');
+    if(comma)
+      *comma = '\0';
+    result = quic_parse_version_token(p, TRUE, data, &ver);
+    if(result)
+      goto out;
+    result = quic_dyn_add_u32be(&vb, ver);
+    if(result)
+      goto out;
+    ++available_count;
+    if(!comma)
+      break;
+    if(!*(comma + 1)) {
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto out;
+    }
+    p = comma + 1;
+  }
+
+  if(!available_count) {
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
+  result = quic_raw_append_param_bytes(raw, QUIC_TP_VERSION_INFORMATION,
+                                       (const uint8_t *)curlx_dyn_ptr(&vb),
+                                       curlx_dyn_len(&vb));
+
+out:
+  curlx_free(tmp);
+  curlx_dyn_free(&vb);
+  return result;
+}
+
+static CURLcode quic_transport_params_from_string(ngtcp2_transport_params *t,
+                                                  struct dynbuf *raw,
+                                                  const ngtcp2_cid *scid,
+                                                  struct Curl_easy *data)
+{
+  const char *params = data->set.str[STRING_QUIC_TRANSPORT_PARAMETERS];
+  bool permute = data->set.ssl_permute_extensions;
+  char *tmp;
+  char *p;
+  char **tokens = NULL;
+  size_t ntokens = 0;
+  size_t talloc = 0;
+  size_t i;
+  char *setting;
+  CURLcode result = CURLE_OK;
+
+  if(!params || !*params)
+    return CURLE_OK;
+
+  tmp = curlx_strdup(params);
+  if(!tmp)
+    return CURLE_OUT_OF_MEMORY;
+
+  p = tmp;
+  while(*p) {
+    char **newtokens;
+    size_t newalloc;
+
+    while(*p == ';')
+      ++p;
+    if(!*p)
+      break;
+
+    if(ntokens == talloc) {
+      newalloc = talloc ? (talloc * 2) : 8;
+      newtokens = curlx_realloc(tokens, newalloc * sizeof(*tokens));
+      if(!newtokens) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+      tokens = newtokens;
+      talloc = newalloc;
+    }
+
+    tokens[ntokens++] = p;
+    while(*p && (*p != ';'))
+      ++p;
+    if(*p) {
+      *p = '\0';
+      ++p;
+    }
+  }
+
+  if(permute && (ntokens > 1)) {
+    result = quic_permute_token_order(tokens, ntokens, data);
+    if(result)
+      goto out;
+  }
+
+  for(i = 0; i < ntokens; ++i) {
+    char *colon;
+    char *value_str = NULL;
+    char *end = NULL;
+    uint64_t id;
+    uint64_t value = 0;
+    bool has_value = FALSE;
+    bool value_is_auto = FALSE;
+    bool value_is_empty_initial_scid = FALSE;
+    bool value_is_initial_rtt_auto = FALSE;
+    bool value_is_hex_bytes = FALSE;
+
+    setting = tokens[i];
+    colon = strchr(setting, ':');
+
+    if(curl_strequal(setting, "GREASE")) {
+      unsigned char grease_value[QUIC_TP_GREASE_VALUE_MAXLEN];
+      size_t grease_vlen;
+
+      result = quic_generate_grease_tp(data, &id, grease_value,
+                                        &grease_vlen);
+      if(result)
+        goto out;
+      result = quic_raw_append_param_bytes(raw, id, grease_value,
+                                            grease_vlen);
+      if(result)
+        goto out;
+      continue;
+    }
+
+    if(colon) {
+      *colon = '\0';
+      has_value = TRUE;
+      value_str = colon + 1;
+    }
+
+    id = strtoull(setting, &end, 10);
+    if(!*setting || (end && *end)) {
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto out;
+    }
+    if(has_value) {
+      if(id == QUIC_TP_INITIAL_SOURCE_CONNECTION_ID &&
+         curl_strequal(value_str, "AUTO"))
+        value_is_auto = TRUE;
+      else if(id == QUIC_TP_INITIAL_SOURCE_CONNECTION_ID && !*value_str)
+        value_is_empty_initial_scid = TRUE;
+      else if(id == QUIC_TP_INITIAL_RTT &&
+              (curl_strequal(value_str, "AUTO") ||
+               curl_strequal(value_str, "RANDOM")))
+        value_is_initial_rtt_auto = TRUE;
+      else if(id == QUIC_TP_VERSION_INFORMATION) {
+        /* Parsed by dedicated handler below. */
+      }
+      else if(value_str[0] == '0' && (value_str[1] == 'x' ||
+                                       value_str[1] == 'X'))
+        value_is_hex_bytes = TRUE;
+      else {
+        value = strtoull(value_str, &end, 10);
+        if(!*value_str || (end && *end)) {
+          result = CURLE_BAD_FUNCTION_ARGUMENT;
+          goto out;
+        }
+      }
+    }
+
+    if(has_value && id == QUIC_TP_VERSION_INFORMATION) {
+      result = quic_append_version_information(raw, value_str, data);
+      if(result)
+        goto out;
+      continue;
+    }
+    if(id == QUIC_TP_GOOGLE_VERSION) {
+      unsigned char ver[4];
+
+      if(!has_value || (value > UINT_MAX)) {
+        failf(data, "QUIC transport param %" PRIu64
+              " requires a 32-bit version value", (uint64_t)id);
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto out;
+      }
+      ver[0] = (unsigned char)(value >> 24);
+      ver[1] = (unsigned char)(value >> 16);
+      ver[2] = (unsigned char)(value >> 8);
+      ver[3] = (unsigned char)value;
+      result = quic_apply_transport_param(t, id, value, has_value, data);
+      if(result)
+        goto out;
+      result = quic_raw_append_param_bytes(raw, id, ver, sizeof(ver));
+      if(result)
+        goto out;
+      continue;
+    }
+
+    if(value_is_auto) {
+      if(!scid) {
+        failf(data, "QUIC transport param 15:AUTO has no local SCID pointer");
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto out;
+      }
+      result = quic_raw_append_param_bytes(raw, id,
+                                           (const uint8_t *)scid->data,
+                                           scid->datalen);
+      if(result)
+        goto out;
+      continue;
+    }
+    if(value_is_empty_initial_scid) {
+      result = quic_raw_append_param_bytes(raw, id, NULL, 0);
+      if(result)
+        goto out;
+      continue;
+    }
+    if(value_is_hex_bytes) {
+      const char *hex = value_str + 2; /* skip "0x" */
+      size_t hex_len = strlen(hex);
+      size_t byte_len;
+      unsigned char *bytes;
+      size_t j;
+
+      if((hex_len == 0) || (hex_len % 2 != 0)) {
+        failf(data, "QUIC transport param %" PRIu64
+              " has invalid hex value", (uint64_t)id);
+        result = CURLE_BAD_FUNCTION_ARGUMENT;
+        goto out;
+      }
+      byte_len = hex_len / 2;
+      bytes = curlx_malloc(byte_len);
+      if(!bytes) {
+        result = CURLE_OUT_OF_MEMORY;
+        goto out;
+      }
+      for(j = 0; j < byte_len; j++) {
+        unsigned int byte_val;
+        if(sscanf(hex + 2 * j, "%2x", &byte_val) != 1) {
+          curlx_free(bytes);
+          failf(data, "QUIC transport param %" PRIu64
+                " has invalid hex value", (uint64_t)id);
+          result = CURLE_BAD_FUNCTION_ARGUMENT;
+          goto out;
+        }
+        bytes[j] = (unsigned char)byte_val;
+      }
+      result = quic_raw_append_param_bytes(raw, id, bytes, byte_len);
+      curlx_free(bytes);
+      if(result)
+        goto out;
+      continue;
+    }
+    if(value_is_initial_rtt_auto)
+      value = quic_initial_rtt_auto_us(data);
+
+    if(id > QUIC_VARINT_MAX || (has_value && value > QUIC_VARINT_MAX)) {
+      failf(data, "QUIC transport param value exceeds varint range");
+      result = CURLE_BAD_FUNCTION_ARGUMENT;
+      goto out;
+    }
+
+    result = quic_apply_transport_param(t, id, value, has_value, data);
+    if(result)
+      goto out;
+    result = quic_raw_append_param(raw, id, value, has_value);
+    if(result)
+      goto out;
+  }
+
+out:
+  curlx_free(tokens);
+  curlx_free(tmp);
+  return result;
+}
+
+
+static CURLcode quic_settings(struct cf_ngtcp2_ctx *ctx,
+                              struct Curl_easy *data,
+                              struct cf_ngtcp2_io_ctx *pktx)
 {
   ngtcp2_settings *s = &ctx->settings;
   ngtcp2_transport_params *t = &ctx->transport_params;
+  CURLcode result;
 
   ngtcp2_settings_default(s);
   ngtcp2_transport_params_default(t);
@@ -224,6 +943,10 @@ static void quic_settings(struct cf_ngtcp2_ctx *ctx,
   if(ctx->qlogfd != -1) {
     s->qlog_write = qlog_callback;
   }
+  curlx_dyn_reset(&ctx->tp_raw);
+  result = quic_transport_params_from_string(t, &ctx->tp_raw, &ctx->scid,
+                                             data);
+  return result;
 }
 
 #if defined(_MSC_VER) && defined(_DLL)
@@ -900,7 +1623,7 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
   CURLcode result;
   const struct Curl_sockaddr_ex *sockaddr = NULL;
   int qfd;
-  static const struct alpn_spec ALPN_SPEC_H3 = { { "h3", "h3-29" }, 2 };
+  static const struct alpn_spec ALPN_SPEC_H3 = { { "h3" }, 1 };
 
   DEBUGASSERT(ctx->initialized);
   ctx->dcid.datalen = NGTCP2_MAX_CIDLEN;
@@ -909,20 +1632,28 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
     return result;
 
   ctx->scid.datalen = NGTCP2_MAX_CIDLEN;
-  result = Curl_rand(data, ctx->scid.data, NGTCP2_MAX_CIDLEN);
-  if(result)
-    return result;
+  if(quic_has_empty_initial_scid(
+       data->set.str[STRING_QUIC_TRANSPORT_PARAMETERS]))
+    ctx->scid.datalen = 0;
+  else {
+    result = Curl_rand(data, ctx->scid.data, ctx->scid.datalen);
+    if(result)
+      return result;
+  }
 
-  (void)Curl_qlogdir(data, ctx->scid.data, NGTCP2_MAX_CIDLEN, &qfd);
+  (void)Curl_qlogdir(data, ctx->scid.data, ctx->scid.datalen, &qfd);
   ctx->qlogfd = qfd; /* -1 if failure above */
-  quic_settings(ctx, data, pktx);
+  result = quic_settings(ctx, data, pktx);
+  if(result)
+    return result;
 
   result = vquic_ctx_init(data, &ctx->q);
   if(result)
     return result;
 
   /* Query socket and remote address from sub-chain */
-  if(Curl_cf_socket_peek(cf->next, data, &ctx->q.sockfd, &sockaddr, NULL)) {
+  if(cf_ngtcp2_peek_socket(cf->next, data, &ctx->q.sockfd,
+                           &sockaddr, NULL)) {
     /* No direct socket - must be tunneled QUIC (CONNECT-UDP through proxy) */
     ctx->q.sockfd = CURL_SOCKET_BAD;
   }
@@ -952,6 +1683,7 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
     ctx->conn_ref.get_conn = get_conn;
     ctx->conn_ref.user_data = cf;
   }
+
   else {
     /* Tunneled QUIC (e.g. CONNECT-UDP): get remote address
        from the connected filter below */
@@ -997,6 +1729,19 @@ static CURLcode cf_connect_start(struct Curl_cfilter *cf,
     ctx->conn_ref.user_data = cf;
   }
 
+  if(curlx_dyn_len(&ctx->tp_raw)) {
+    ngtcp2_transport_params_raw raw = {
+      (const uint8_t *)curlx_dyn_ptr(&ctx->tp_raw),
+      curlx_dyn_len(&ctx->tp_raw)
+    };
+    rc = ngtcp2_conn_set_local_transport_params_raw(ctx->qconn, &raw);
+    if(rc) {
+      failf(data, "error setting local QUIC transport params: %s",
+            ngtcp2_strerror(rc));
+      return CURLE_QUIC_CONNECT_ERROR;
+    }
+  }
+
   result = Curl_vquic_tls_init(&ctx->tls, cf, data,
                                &ctx->ssl_peer, &ALPN_SPEC_H3,
                                cf_ngtcp2_tls_ctx_setup, &ctx->tls,
@@ -1132,7 +1877,7 @@ out:
       /* Direct UDP socket - get IP info for error reporting */
       struct ip_quadruple ip;
 
-      if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+      if(!cf_ngtcp2_peek_socket(cf->next, data, NULL, NULL, &ip))
         infof(data, "QUIC connect to %s port %u failed: %s",
               ip.remote_ip, ip.remote_port, curl_easy_strerror(result));
     }
@@ -1767,14 +2512,34 @@ CURLcode Curl_cf_ngtcp2_cmn_set_expiry(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
+static ngtcp2_duration
+cf_ngtcp2_effective_idle_timeout(struct cf_ngtcp2_ctx *ctx)
+{
+  const ngtcp2_transport_params *lp;
+  const ngtcp2_transport_params *rp;
+  ngtcp2_duration timeout = 0;
+
+  if(!ctx->qconn)
+    return 0;
+
+  lp = ngtcp2_conn_get_local_transport_params(ctx->qconn);
+  rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
+  if(lp)
+    timeout = lp->max_idle_timeout;
+  if(rp && rp->max_idle_timeout &&
+     (!timeout || rp->max_idle_timeout < timeout))
+    timeout = rp->max_idle_timeout;
+  return timeout;
+}
+
 static void cf_ngtcp2_setup_keep_alive(struct Curl_cfilter *cf,
                                        struct Curl_easy *data)
 {
   struct cf_ngtcp2_ctx *ctx = cf->ctx;
-  const ngtcp2_transport_params *rp;
-  /* Peer should have sent us its transport parameters. If it
-   * announces a positive `max_idle_timeout` it closes the
-   * connection when it does not hear from us for that time.
+  ngtcp2_duration idle_timeout;
+
+  /* If either endpoint announces a positive `max_idle_timeout`, the
+   * connection closes when it remains idle for the effective timeout.
    *
    * Some servers use this as a keep-alive timer at a rather low
    * value. We are doing HTTP/3 here and waiting for the response
@@ -1784,10 +2549,10 @@ static void cf_ngtcp2_setup_keep_alive(struct Curl_cfilter *cf,
   if(!ctx->qconn)
     return;
 
-  rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
-  if(!rp || !rp->max_idle_timeout) {
+  idle_timeout = cf_ngtcp2_effective_idle_timeout(ctx);
+  if(!idle_timeout) {
     ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, UINT64_MAX);
-    CURL_TRC_CF(data, cf, "no peer idle timeout, unset keep-alive");
+    CURL_TRC_CF(data, cf, "no idle timeout, unset keep-alive");
   }
   else if(!Curl_uint32_hash_count(&ctx->streams)) {
     ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, UINT64_MAX);
@@ -1795,11 +2560,11 @@ static void cf_ngtcp2_setup_keep_alive(struct Curl_cfilter *cf,
   }
   else {
     ngtcp2_duration keep_ns;
-    keep_ns = (rp->max_idle_timeout > 1) ? (rp->max_idle_timeout / 2) : 1;
+    keep_ns = (idle_timeout > 1) ? (idle_timeout / 2) : 1;
     ngtcp2_conn_set_keep_alive_timeout(ctx->qconn, keep_ns);
-    CURL_TRC_CF(data, cf, "peer idle timeout is %" PRIu64 "ms, "
+    CURL_TRC_CF(data, cf, "effective idle timeout is %" PRIu64 "ms, "
                 "set keep-alive to %" PRIu64 " ms.",
-                (rp->max_idle_timeout / NGTCP2_MILLISECONDS),
+                (idle_timeout / NGTCP2_MILLISECONDS),
                 (keep_ns / NGTCP2_MILLISECONDS));
   }
 }
@@ -1885,7 +2650,10 @@ bool Curl_cf_ngtcp2_cmn_conn_is_alive(struct Curl_cfilter *cf,
 {
   struct cf_ngtcp2_ctx *ctx = cf->ctx;
   bool alive = FALSE;
-  const ngtcp2_transport_params *rp;
+  bool expiry_handled = FALSE;
+  ngtcp2_tstamp expiry;
+  ngtcp2_tstamp now_ts;
+  const struct curltime *now;
   struct cf_call_data save;
 
   CF_DATA_SAVE(save, cf, data);
@@ -1893,18 +2661,19 @@ bool Curl_cf_ngtcp2_cmn_conn_is_alive(struct Curl_cfilter *cf,
   if(!ctx->qconn || ctx->shutdown_started)
     goto out;
 
-  /* We do not announce a max idle timeout, but when the peer does
-   * it closes the connection when it expires. */
-  rp = ngtcp2_conn_get_remote_transport_params(ctx->qconn);
-  if(rp && rp->max_idle_timeout) {
-    timediff_t idletime_ms =
-      curlx_ptimediff_ms(Curl_pgrs_now(data), &ctx->q.last_io);
-    if(idletime_ms > 0) {
-      uint64_t max_idle_ms =
-        (uint64_t)(rp->max_idle_timeout / NGTCP2_MILLISECONDS);
-      if((uint64_t)idletime_ms > max_idle_ms)
-        goto out;
+  /* Let ngtcp2 apply all timer rules, including the negotiated idle timeout,
+   * the 3 PTO minimum and the QUIC idle timer reset rules. */
+  now = Curl_pgrs_now(data);
+  now_ts = ((ngtcp2_tstamp)now->tv_sec * NGTCP2_SECONDS) +
+           ((ngtcp2_tstamp)now->tv_usec * NGTCP2_MICROSECONDS);
+  expiry = ngtcp2_conn_get_expiry(ctx->qconn);
+  if((expiry != UINT64_MAX) && (expiry <= now_ts)) {
+    int rv = ngtcp2_conn_handle_expiry(ctx->qconn, now_ts);
+    if(rv) {
+      Curl_cf_ngtcp2_cmn_err_set(cf, data, rv);
+      goto out;
     }
+    expiry_handled = TRUE;
   }
 
   if(!cf->next || !cf->next->cft->is_alive(cf->next, data, input_pending))
@@ -1921,6 +2690,11 @@ bool Curl_cf_ngtcp2_cmn_conn_is_alive(struct Curl_cfilter *cf,
     CURL_TRC_CF(data, cf, "is_alive, progress ingress -> %d", (int)result);
     alive = result ? FALSE : TRUE;
   }
+  if(alive && expiry_handled) {
+    CURLcode result = Curl_cf_ngtcp2_progress_egress(cf, data, NULL);
+    CURL_TRC_CF(data, cf, "is_alive, progress egress -> %d", (int)result);
+    alive = result ? FALSE : TRUE;
+  }
 
 out:
   CF_DATA_RESTORE(cf, save);
diff --git a/lib/vquic/cf-ngtcp2-cmn.h b/lib/vquic/cf-ngtcp2-cmn.h
index 88554edfb6..97a5ddd737 100644
--- a/lib/vquic/cf-ngtcp2-cmn.h
+++ b/lib/vquic/cf-ngtcp2-cmn.h
@@ -126,6 +126,7 @@ struct cf_ngtcp2_ctx {
   struct curltime handshake_at;     /* time connect handshake finished */
   struct bufc_pool stream_bufcp;    /* chunk pool for streams */
   struct dynbuf scratch;            /* temp buffer for header construction */
+  struct dynbuf tp_raw;             /* serialized local QUIC parameters */
   struct uint_hash streams;         /* hash data->mid to h3_stream_ctx */
   uint64_t used_bidi_streams;       /* bidi streams we have opened */
   uint64_t max_bidi_streams;        /* max bidi streams we can open */
@@ -152,6 +153,7 @@ CURLcode Curl_cf_ngtcp2_ctx_init(struct cf_ngtcp2_ctx *ctx,
                                  struct Curl_peer *origin,
                                  struct Curl_peer *peer,
                                  struct ssl_primary_config *sslc,
+                                 struct connectdata *conn,
                                  cf_ngtcp2_init_h3_conn *init_h3_conn_cb);
 void Curl_cf_ngtcp2_ctx_cleanup(struct cf_ngtcp2_ctx *ctx);
 void Curl_cf_ngtcp2_cmn_err_set(struct Curl_cfilter *cf,
diff --git a/lib/vquic/cf-ngtcp2-proxy.c b/lib/vquic/cf-ngtcp2-proxy.c
index fd2840890f..19e0c2b777 100644
--- a/lib/vquic/cf-ngtcp2-proxy.c
+++ b/lib/vquic/cf-ngtcp2-proxy.c
@@ -176,12 +176,13 @@ static CURLcode cf_h3_proxy_ctx_init(struct cf_h3_proxy_ctx *ctx,
                                      struct Curl_peer *origin,
                                      struct Curl_peer *peer,
                                      struct ssl_primary_config *sslc,
+                                     struct connectdata *conn,
                                      struct Curl_peer *tunnel_peer,
                                      uint8_t tunnel_transport)
 {
   CURLcode result;
   result = Curl_cf_ngtcp2_ctx_init(&ctx->ngtcp2_ctx, origin, peer,
-                                   sslc, cf_ngtcp2_proxy_h3_init);
+                                   sslc, conn, cf_ngtcp2_proxy_h3_init);
   if(!result)
     result = h3_tunnel_stream_init(&ctx->tunnel, tunnel_peer,
                                    TRNSPRT_IS_DGRAM(tunnel_transport));
@@ -1244,7 +1245,7 @@ CURLcode Curl_cf_ngtcp2_proxy_create(struct Curl_cfilter **pcf,
     goto out;
   }
   result = cf_h3_proxy_ctx_init(ctx, origin, peer, &conn->proxy_ssl_config,
-                                tunnel_peer, tunnel_transport);
+                                conn, tunnel_peer, tunnel_transport);
   if(result)
     goto out;
 
@@ -1290,7 +1291,7 @@ CURLcode Curl_cf_ngtcp2_proxy_insert_after(struct Curl_cfilter *cf_at,
     goto out;
   result = cf_h3_proxy_ctx_init(ctx, origin, peer,
                                 &cf_at->conn->proxy_ssl_config,
-                                tunnel_peer, tunnel_transport);
+                                cf_at->conn, tunnel_peer, tunnel_transport);
   if(result)
     goto out;
 
diff --git a/lib/vquic/cf-ngtcp2.c b/lib/vquic/cf-ngtcp2.c
index be1a3257c3..5c79a9e613 100644
--- a/lib/vquic/cf-ngtcp2.c
+++ b/lib/vquic/cf-ngtcp2.c
@@ -412,10 +412,182 @@ static nghttp3_callbacks ngh3_callbacks = {
 #endif
 };
 
+static void h3_apply_setting(nghttp3_settings *settings,
+                             unsigned long id, uint64_t value)
+{
+  switch(id) {
+  case 1: /* SETTINGS_QPACK_MAX_TABLE_CAPACITY */
+    if(value > (uint64_t)SIZE_MAX)
+      value = (uint64_t)SIZE_MAX;
+    settings->qpack_max_dtable_capacity = (size_t)value;
+    settings->qpack_encoder_max_dtable_capacity = (size_t)value;
+    break;
+  case 6: /* SETTINGS_MAX_FIELD_SECTION_SIZE */
+    settings->max_field_section_size = value;
+    break;
+  case 7: /* SETTINGS_QPACK_BLOCKED_STREAMS */
+    if(value > (uint64_t)SIZE_MAX)
+      value = (uint64_t)SIZE_MAX;
+    settings->qpack_blocked_streams = (size_t)value;
+    break;
+  case 8: /* SETTINGS_ENABLE_CONNECT_PROTOCOL */
+    settings->enable_connect_protocol = (uint8_t)(value ? 1 : 0);
+    break;
+  case 51: /* SETTINGS_H3_DATAGRAM */
+    settings->h3_datagram = (uint8_t)(value ? 1 : 0);
+    break;
+  default:
+    break;
+  }
+}
+
+static bool h3_setting_supported(unsigned long id)
+{
+  switch(id) {
+  case 1:
+  case 6:
+  case 7:
+  case 8:
+  case 51:
+  case 727725890:
+  case 16765559:
+    return TRUE;
+  default:
+    return FALSE;
+  }
+}
+
+/* HTTP/3 GREASE setting identifiers follow: 0x1f * N + 0x21 */
+#define H3_SETTINGS_GREASE_ID_BASE  UINT64_C(0x21)
+#define H3_SETTINGS_GREASE_ID_STEP  UINT64_C(0x1f)
+
+/* Chrome uses a narrower uint32_t range than RFC 9114 allows:
+   https://quiche.googlesource.com/quiche/+/refs/heads/main/quiche/quic/core/http/quic_send_control_stream.cc */
+static bool h3_rand_u32(struct Curl_easy *data, uint32_t *val)
+{
+  unsigned char rnd[sizeof(uint32_t)];
+  CURLcode result;
+  size_t i;
+
+  result = Curl_rand(data, rnd, sizeof(rnd));
+  if(result)
+    return FALSE;
+
+  *val = 0;
+  for(i = 0; i < sizeof(rnd); ++i)
+    *val = (*val << 8) | rnd[i];
+
+  return TRUE;
+}
+
+static bool h3_generate_grease_setting(struct Curl_easy *data,
+                                       nghttp3_settings_entry *iv)
+{
+  uint32_t n;
+  uint32_t value;
+
+  if(!h3_rand_u32(data, &n) || !h3_rand_u32(data, &value))
+    return FALSE;
+
+  iv->id = (H3_SETTINGS_GREASE_ID_STEP * (uint64_t)n) +
+           H3_SETTINGS_GREASE_ID_BASE;
+  iv->value = value;
+  return TRUE;
+}
+
+static size_t h3_settings_count(const char *h3_settings)
+{
+  size_t count = 0;
+
+  if(h3_settings && *h3_settings) {
+    const char *p;
+
+    count = 1;
+    for(p = h3_settings; *p; ++p) {
+      if(*p == ';')
+        ++count;
+    }
+  }
+
+  return count;
+}
+
+static size_t populate_h3_settings(nghttp3_settings_entry *iv,
+                                   size_t ivlen,
+                                   nghttp3_settings *settings,
+                                   struct Curl_easy *data)
+{
+  const char *h3_settings = data->set.str[STRING_HTTP3_SETTINGS];
+  char *tmp;
+  char *setting;
+  size_t i = 0;
+
+  if(!h3_settings || !*h3_settings)
+    return 0;
+
+  tmp = curlx_strdup(h3_settings);
+  if(!tmp)
+    return 0;
+
+  setting = strtok(tmp, ";");
+  while(setting) {
+    char *colon = strchr(setting, ':');
+    char *end = NULL;
+    unsigned long id;
+    unsigned long long value;
+
+    if(curl_strequal(setting, "GREASE")) {
+      if(iv && (i < ivlen)) {
+        if(h3_generate_grease_setting(data, &iv[i]))
+          ++i;
+      }
+      setting = strtok(NULL, ";");
+      continue;
+    }
+
+    if(!colon) {
+      setting = strtok(NULL, ";");
+      continue;
+    }
+    *colon = '\0';
+    id = strtoul(setting, &end, 10);
+    if(!*setting || (end && *end)) {
+      setting = strtok(NULL, ";");
+      continue;
+    }
+    value = strtoull(colon + 1, &end, 10);
+    if(!*(colon + 1) || (end && *end)) {
+      setting = strtok(NULL, ";");
+      continue;
+    }
+
+    if(!h3_setting_supported(id)) {
+      setting = strtok(NULL, ";");
+      continue;
+    }
+
+    h3_apply_setting(settings, id, (uint64_t)value);
+    if(iv && (i < ivlen)) {
+      iv[i].id = id;
+      iv[i].value = (uint64_t)value;
+      ++i;
+    }
+    setting = strtok(NULL, ";");
+  }
+
+  curlx_free(tmp);
+  return i;
+}
+
+
 static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,
                                struct Curl_easy *data,
                                struct cf_ngtcp2_ctx *ctx)
 {
+  const char *h3_settings = data->set.str[STRING_HTTP3_SETTINGS];
+  nghttp3_settings_entry *h3iv = NULL;
+  size_t h3ivalloc = 0;
+  size_t h3ivlen = 0;
   int rc;
 
   if(ngtcp2_conn_get_streams_uni_left(ctx->qconn) < 3) {
@@ -423,7 +595,16 @@ static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,
     return CURLE_QUIC_CONNECT_ERROR;
   }
 
+  h3ivalloc = h3_settings_count(h3_settings);
+  if(h3ivalloc) {
+    h3iv = curlx_malloc(h3ivalloc * sizeof(*h3iv));
+    if(!h3iv)
+      return CURLE_OUT_OF_MEMORY;
+  }
+
   nghttp3_settings_default(&ctx->h3settings);
+  h3ivlen = populate_h3_settings(h3iv, h3ivalloc,
+                                 &ctx->h3settings, data);
 
   rc = nghttp3_conn_client_new(&ctx->h3conn,
                                &ngh3_callbacks,
@@ -431,10 +612,23 @@ static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,
                                Curl_nghttp3_mem(),
                                cf);
   if(rc) {
+    curlx_free(h3iv);
     failf(data, "error creating nghttp3 connection instance");
     return CURLE_OUT_OF_MEMORY;
   }
 
+  if(h3ivlen) {
+    rc = nghttp3_conn_submit_settings(ctx->h3conn, 0, h3iv, h3ivlen);
+    curlx_free(h3iv);
+    if(rc) {
+      failf(data, "error submitting HTTP/3 settings: %s",
+            nghttp3_strerror(rc));
+      return CURLE_QUIC_CONNECT_ERROR;
+    }
+  }
+  else
+    curlx_free(h3iv);
+
   return Curl_cf_ngtcp2_h3_init_ctrls(ctx, data);
 }
 
@@ -1105,7 +1299,7 @@ CURLcode Curl_cf_ngtcp2_create(struct Curl_cfilter **pcf,
     goto out;
   }
   result = Curl_cf_ngtcp2_ctx_init(ctx, origin, peer,
-                                   &conn->ssl_config, init_ngh3_conn);
+                                   &conn->ssl_config, conn, init_ngh3_conn);
   if(!result)
     result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
   if(result)
@@ -1146,7 +1340,8 @@ CURLcode Curl_cf_ngtcp2_insert_after(struct Curl_cfilter *cf_at,
     goto out;
   }
   result = Curl_cf_ngtcp2_ctx_init(ctx, origin, peer,
-                                   &cf_at->conn->ssl_config, init_ngh3_conn);
+                                   &cf_at->conn->ssl_config, cf_at->conn,
+                                   init_ngh3_conn);
   if(!result)
     result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
   if(result)
diff --git a/lib/vquic/cf-quiche.c b/lib/vquic/cf-quiche.c
index 31a3957ec3..db1d63db0a 100644
--- a/lib/vquic/cf-quiche.c
+++ b/lib/vquic/cf-quiche.c
@@ -110,7 +110,8 @@ static void h3_stream_hash_free(unsigned int id, void *stream);
 static CURLcode cf_quiche_ctx_init(struct cf_quiche_ctx *ctx,
                                    struct Curl_peer *origin,
                                    struct Curl_peer *peer,
-                                   struct ssl_primary_config *sslc)
+                                   struct ssl_primary_config *sslc,
+                                   struct connectdata *conn)
 {
   DEBUGASSERT(!ctx->initialized);
 #ifdef DEBUG_QUICHE
@@ -125,7 +126,7 @@ static CURLcode cf_quiche_ctx_init(struct cf_quiche_ctx *ctx,
                   BUFQ_OPT_SOFT_LIMIT);
   ctx->data_recvd = 0;
   ctx->initialized = TRUE;
-  return Curl_vquic_tls_peer_init(origin, peer, sslc, &ctx->ssl_peer);
+  return Curl_vquic_tls_peer_init(origin, peer, sslc, &ctx->ssl_peer, conn);
 }
 
 static void cf_quiche_ctx_free(struct cf_quiche_ctx *ctx)
@@ -1654,7 +1655,7 @@ CURLcode Curl_cf_quiche_create(struct Curl_cfilter **pcf,
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  result = cf_quiche_ctx_init(ctx, origin, peer, &conn->ssl_config);
+  result = cf_quiche_ctx_init(ctx, origin, peer, &conn->ssl_config, conn);
   if(!result)
     result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
   if(result)
@@ -1693,7 +1694,8 @@ CURLcode Curl_cf_quiche_insert_after(struct Curl_cfilter *cf_at,
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
-  result = cf_quiche_ctx_init(ctx, origin, peer, &cf_at->conn->ssl_config);
+  result = cf_quiche_ctx_init(ctx, origin, peer, &cf_at->conn->ssl_config,
+                              cf_at->conn);
   if(!result)
     result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
   if(result)
diff --git a/lib/vquic/vquic-tls.c b/lib/vquic/vquic-tls.c
index 58f139306a..5e9a7cf836 100644
--- a/lib/vquic/vquic-tls.c
+++ b/lib/vquic/vquic-tls.c
@@ -52,7 +52,8 @@
 CURLcode Curl_vquic_tls_peer_init(struct Curl_peer *origin,
                                   struct Curl_peer *peer,
                                   struct ssl_primary_config *sslc,
-                                  struct ssl_peer *ssl_peer)
+                                  struct ssl_peer *ssl_peer,
+                                  struct connectdata *conn)
 {
   char tls_id[80];
 
@@ -69,7 +70,7 @@ CURLcode Curl_vquic_tls_peer_init(struct Curl_peer *origin,
   if(ssl_peer->origin || ssl_peer->peer)
     Curl_ssl_peer_cleanup(ssl_peer);
   return Curl_ssl_peer_init(ssl_peer, origin, peer, sslc,
-                            tls_id, TRNSPRT_QUIC);
+                            tls_id, TRNSPRT_QUIC, conn);
 }
 
 CURLcode Curl_vquic_tls_init(struct curl_tls_ctx *ctx,
diff --git a/lib/vquic/vquic-tls.h b/lib/vquic/vquic-tls.h
index e8d2418b06..37a74ba094 100644
--- a/lib/vquic/vquic-tls.h
+++ b/lib/vquic/vquic-tls.h
@@ -69,7 +69,8 @@ typedef CURLcode Curl_vquic_session_reuse_cb(struct Curl_cfilter *cf,
 CURLcode Curl_vquic_tls_peer_init(struct Curl_peer *origin,
                                   struct Curl_peer *peer,
                                   struct ssl_primary_config *sslc,
-                                  struct ssl_peer *ssl_peer);
+                                  struct ssl_peer *ssl_peer,
+                                  struct connectdata *conn);
 
 /**
  * Initialize the QUIC TLS instances based of the SSL configurations
diff --git a/lib/vquic/vquic.c b/lib/vquic/vquic.c
index dfb8346c1a..602402e256 100644
--- a/lib/vquic/vquic.c
+++ b/lib/vquic/vquic.c
@@ -41,6 +41,9 @@
 #include "curlx/dynbuf.h"
 #include "curlx/fopen.h"
 #include "cfilters.h"
+#include "cf-socket.h"
+#include "sockaddr.h"
+#include "socks.h"
 #include "vquic/cf-ngtcp2.h"
 #include "vquic/cf-ngtcp2-cmn.h"
 #include "vquic/cf-ngtcp2-proxy.h"
@@ -52,6 +55,38 @@
 #include "curlx/strerr.h"
 #include "curlx/strparse.h"
 
+static CURLcode vquic_peek_socket(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct ip_quadruple *pip)
+{
+  for(; cf; cf = cf->next) {
+    if(!Curl_cf_socket_peek(cf, data, NULL, NULL, pip))
+      return CURLE_OK;
+  }
+  return CURLE_FAILED_INIT;
+}
+
+/* Resolve the relay address from the active socket for recv callbacks. */
+static bool vquic_get_remote_addr(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct sockaddr_storage *remote_addr,
+                                  socklen_t *remote_addrlen)
+{
+  const struct Curl_sockaddr_ex *peer_addr = NULL;
+  int dummy = 0;
+
+  for(; cf; cf = cf->next) {
+    if(!cf->cft->query(cf, data, CF_QUERY_REMOTE_ADDR, &dummy,
+                       &peer_addr) && peer_addr) {
+      memset(remote_addr, 0, sizeof(*remote_addr));
+      memcpy(remote_addr, &peer_addr->curl_sa_addr, peer_addr->addrlen);
+      *remote_addrlen = (socklen_t)peer_addr->addrlen;
+      return TRUE;
+    }
+  }
+  return FALSE;
+}
+
 
 #define NW_CHUNK_SIZE     (64 * 1024)
 #define NW_SEND_CHUNKS    1
@@ -307,6 +342,38 @@ static CURLcode vquic_send_packets(struct Curl_cfilter *cf,
                                    size_t gsolen, size_t *psent)
 {
   CURLcode result;
+
+  if(Curl_cf_socks_proxy_is_udp_associate(cf->next)) {
+    size_t sent_total = 0;
+    const uint8_t *p = pkt;
+    size_t pktstep = gsolen ? gsolen : pktlen;
+
+    /* SOCKS UDP ASSOCIATE needs per-packet encapsulation in the filter. */
+    infof(data, "QUIC over SOCKS UDP send: bytes=%zu gso=%zu",
+          pktlen, gsolen);
+    qctx->no_gso = TRUE;
+    while(sent_total < pktlen) {
+      size_t len = CURLMIN(pktstep, pktlen - sent_total);
+      size_t nwritten = 0;
+
+      result = Curl_conn_cf_send(cf->next, data, p, len, FALSE, &nwritten);
+      if(result) {
+        if(result == CURLE_AGAIN) {
+          *psent = sent_total;
+          return result;
+        }
+        return result;
+      }
+      if(nwritten != len)
+        return CURLE_SEND_ERROR;
+      sent_total += nwritten;
+      p += nwritten;
+    }
+    *psent = sent_total;
+    qctx->last_io = qctx->last_op;
+    return CURLE_OK;
+  }
+
 #ifdef DEBUGBUILD
   /* simulate network blocking/partial writes */
   if(qctx->wblock_percent > 0) {
@@ -492,7 +559,7 @@ static CURLcode recvmmsg_packets(struct Curl_cfilter *cf,
       }
       if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {
         struct ip_quadruple ip;
-        if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+        if(!vquic_peek_socket(cf->next, data, &ip))
           failf(data, "QUIC: connection to %s port %u refused",
                 ip.remote_ip, ip.remote_port);
         result = CURLE_COULDNT_CONNECT;
@@ -578,7 +645,7 @@ static CURLcode recvmsg_packets(struct Curl_cfilter *cf,
       }
       if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {
         struct ip_quadruple ip;
-        if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+        if(!vquic_peek_socket(cf->next, data, &ip))
           failf(data, "QUIC: connection to %s port %u refused",
                 ip.remote_ip, ip.remote_port);
         result = CURLE_COULDNT_CONNECT;
@@ -649,7 +716,7 @@ static CURLcode recvfrom_packets(struct Curl_cfilter *cf,
       }
       if(!cf->connected && SOCKERRNO == SOCKECONNREFUSED) {
         struct ip_quadruple ip;
-        if(!Curl_cf_socket_peek(cf->next, data, NULL, NULL, &ip))
+        if(!vquic_peek_socket(cf->next, data, &ip))
           failf(data, "QUIC: connection to %s port %u refused",
                 ip.remote_ip, ip.remote_port);
         result = CURLE_COULDNT_CONNECT;
@@ -692,7 +759,55 @@ CURLcode vquic_recv_packets(struct Curl_cfilter *cf,
                             vquic_recv_pkts_cb *recv_cb, void *userp)
 {
   CURLcode result;
-#ifdef HAVE_SENDMMSG
+
+  if(Curl_cf_socks_proxy_is_udp_associate(cf->next)) {
+    uint8_t buf[NW_CHUNK_SIZE];
+    struct sockaddr_storage remote_addr;
+    socklen_t remote_addrlen = 0;
+    size_t total_nread = 0;
+    size_t pkts = 0;
+
+    result = CURLE_OK;
+    /* SOCKS UDP ASSOCIATE recv path goes through the filter chain. */
+    infof(data, "QUIC over SOCKS UDP recv: max_pkts=%zu", max_pkts);
+    for(pkts = 0, total_nread = 0; pkts < max_pkts;) {
+      size_t nread = 0;
+      result = Curl_conn_cf_recv(cf->next, data, (char *)buf, sizeof(buf),
+                                 &nread);
+      if(result) {
+        if(result == CURLE_AGAIN) {
+          result = CURLE_OK;
+          break;
+        }
+        if(!cf->connected && data->state.os_errno == SOCKECONNREFUSED) {
+          struct ip_quadruple ip;
+          if(!vquic_peek_socket(cf->next, data, &ip))
+            failf(data, "QUIC: connection to %s port %u refused",
+                  ip.remote_ip, ip.remote_port);
+          return CURLE_COULDNT_CONNECT;
+        }
+        return result;
+      }
+
+      if(!vquic_get_remote_addr(cf->next, data, &remote_addr,
+                                &remote_addrlen))
+        return CURLE_FAILED_INIT;
+      if(!nread)
+        continue;
+      ++pkts;
+      total_nread += nread;
+      result = recv_cb(buf, nread, nread, &remote_addr,
+                       remote_addrlen, 0, userp);
+      if(result)
+        return result;
+    }
+
+    if(total_nread || result)
+      CURL_TRC_CF(data, cf, "recvd %zu packets with %zu bytes -> %d",
+                  pkts, total_nread, result);
+  }
+  else
+#if defined(HAVE_SENDMMSG)
   result = recvmmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
 #elif defined(HAVE_SENDMSG)
   result = recvmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
@@ -872,14 +987,7 @@ CURLcode Curl_conn_may_http3(struct Curl_easy *data,
     failf(data, "HTTP/3 requested for non-HTTPS URL");
     return CURLE_URL_MALFORMAT;
   }
-#ifndef CURL_DISABLE_PROXY
-  if(conn->socks_proxy.peer) {
-    failf(data, "HTTP/3 is not supported over a SOCKS proxy");
-    return CURLE_URL_MALFORMAT;
-  }
-#else
   (void)conn;
-#endif
 
   return CURLE_OK;
 }
diff --git a/lib/vtls/openssl.c b/lib/vtls/openssl.c
index 010bbb9825..a5bdd880be 100644
--- a/lib/vtls/openssl.c
+++ b/lib/vtls/openssl.c
@@ -68,9 +68,24 @@
 #include <openssl/rsa.h>
 #include <openssl/bio.h>
 #include <openssl/pkcs12.h>
+#ifdef OPENSSL_IS_BORINGSSL
+#include <openssl/pool.h>
+#endif
 #include <openssl/tls1.h>
 #include <openssl/evp.h>
 
+#ifdef OPENSSL_IS_BORINGSSL
+#ifdef HAVE_LIBZ
+#include <zlib.h>
+#endif
+#ifdef HAVE_BROTLI
+#include <brotli/decode.h>
+#endif
+#ifdef HAVE_ZSTD
+#include <zstd.h>
+#endif
+#endif
+
 #if defined(HAVE_SSL_SET1_ECH_CONFIG_LIST) && !defined(HAVE_BORINGSSL_LIKE)
 #include <openssl/ech.h>
 #endif
@@ -165,6 +180,117 @@
 
 #ifdef HAVE_BORINGSSL_LIKE
 typedef size_t numcert_t;
+
+#if defined(OPENSSL_IS_BORINGSSL)
+#define HAVE_SSL_CTX_SET_VERIFY_ALGORITHM_PREFS
+
+/*
+ * kMaxSignatureAlgorithmNameLen and kSignatureAlgorithmNames
+ * Taken from BoringSSL, see ssl/ssl_privkey.cc
+ * */
+static const size_t kMaxSignatureAlgorithmNameLen = 23;
+
+static const struct {
+  uint16_t signature_algorithm;
+  const char *name;
+} kSignatureAlgorithmNames[] = {
+    {SSL_SIGN_RSA_PKCS1_MD5_SHA1, "rsa_pkcs1_md5_sha1"},
+    {SSL_SIGN_RSA_PKCS1_SHA1, "rsa_pkcs1_sha1"},
+    {SSL_SIGN_RSA_PKCS1_SHA256, "rsa_pkcs1_sha256"},
+    {SSL_SIGN_RSA_PKCS1_SHA384, "rsa_pkcs1_sha384"},
+    {SSL_SIGN_RSA_PKCS1_SHA512, "rsa_pkcs1_sha512"},
+    {SSL_SIGN_ECDSA_SHA1, "ecdsa_sha1"},
+    {SSL_SIGN_ECDSA_SECP256R1_SHA256, "ecdsa_secp256r1_sha256"},
+    {SSL_SIGN_ECDSA_SECP384R1_SHA384, "ecdsa_secp384r1_sha384"},
+    {SSL_SIGN_ECDSA_SECP521R1_SHA512, "ecdsa_secp521r1_sha512"},
+    {SSL_SIGN_RSA_PSS_RSAE_SHA256, "rsa_pss_rsae_sha256"},
+    {SSL_SIGN_RSA_PSS_RSAE_SHA384, "rsa_pss_rsae_sha384"},
+    {SSL_SIGN_RSA_PSS_RSAE_SHA512, "rsa_pss_rsae_sha512"},
+    {SSL_SIGN_ED25519, "ed25519"},
+    {SSL_SIGN_ML_DSA_44, "mldsa44"},
+    {SSL_SIGN_ML_DSA_65, "mldsa65"},
+    {SSL_SIGN_ML_DSA_87, "mldsa87"},
+};
+
+#define MAX_SIG_ALGS \
+  sizeof(kSignatureAlgorithmNames) / sizeof(kSignatureAlgorithmNames[0])
+
+/* Default signature hash algorithms taken from Chrome/Chromium.
+ * See kVerifyPeers @ net/socket/ssl_client_socket_impl.cc */
+static const uint16_t default_sig_algs[] = {
+  SSL_SIGN_ECDSA_SECP256R1_SHA256, SSL_SIGN_RSA_PSS_RSAE_SHA256,
+  SSL_SIGN_RSA_PKCS1_SHA256,       SSL_SIGN_ECDSA_SECP384R1_SHA384,
+  SSL_SIGN_RSA_PSS_RSAE_SHA384,    SSL_SIGN_RSA_PKCS1_SHA384,
+  SSL_SIGN_RSA_PSS_RSAE_SHA512,    SSL_SIGN_RSA_PKCS1_SHA512,
+};
+
+#define DEFAULT_SIG_ALGS_LENGTH  \
+  sizeof(default_sig_algs) / sizeof(default_sig_algs[0])
+
+static CURLcode parse_sig_algs(struct Curl_easy *data,
+                               const char *sigalgs,
+                               uint16_t *algs,
+                               size_t *nalgs)
+{
+  *nalgs = 0;
+  while(sigalgs && sigalgs[0]) {
+    int i;
+    bool found = FALSE;
+    const char *end;
+    size_t len;
+    char algname[kMaxSignatureAlgorithmNameLen + 1];
+
+    end = strpbrk(sigalgs, ":,");
+    if(end)
+      len = end - sigalgs;
+    else
+      len = strlen(sigalgs);
+
+    if(len > kMaxSignatureAlgorithmNameLen) {
+      failf(data, "Bad signature hash algorithm list");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+
+    if(!len) {
+      ++sigalgs;
+      continue;
+    }
+
+    if(*nalgs == MAX_SIG_ALGS) {
+      /* Reached the maximum number of possible algorithms, but more data
+       * available in the list. */
+      failf(data, "Bad signature hash algorithm list");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+
+    memcpy(algname, sigalgs, len);
+    algname[len] = 0;
+
+    for(i = 0; i < MAX_SIG_ALGS; i++) {
+      if(curl_strequal(algname, kSignatureAlgorithmNames[i].name)) {
+        algs[*nalgs] = kSignatureAlgorithmNames[i].signature_algorithm;
+        (*nalgs)++;
+        found = TRUE;
+        break;
+      }
+    }
+
+    if(!found) {
+      failf(data, "Unknown signature hash algorithm: '%s'", algname);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+
+    if(end)
+      sigalgs = ++end;
+    else
+      break;
+  }
+
+  return CURLE_OK;
+}
+
+#endif
+
 typedef uint32_t sslerr_t;
 #else
 typedef int numcert_t;
@@ -2453,6 +2579,191 @@ static const char *tls_rt_type(int type)
   }
 }
 
+#ifdef OPENSSL_IS_BORINGSSL
+
+#ifdef HAVE_LIBZ
+int DecompressZlibCert(SSL *ssl,
+                       CRYPTO_BUFFER** out,
+                       size_t uncompressed_len,
+                       const uint8_t* in,
+                       size_t in_len)
+{
+  z_stream strm;
+  uint8_t* data;
+  CRYPTO_BUFFER* decompressed = CRYPTO_BUFFER_alloc(&data, uncompressed_len);
+  if(!decompressed) {
+    return 0;
+  }
+
+  strm.zalloc = NULL;
+  strm.zfree = NULL;
+  strm.opaque = NULL;
+  strm.next_in = (Bytef *)in;
+  strm.avail_in = in_len;
+  strm.next_out = (Bytef *)data;
+  strm.avail_out = uncompressed_len;
+
+  if(inflateInit(&strm) != Z_OK) {
+    CRYPTO_BUFFER_free(decompressed);
+    return 0;
+  }
+
+  if(inflate(&strm, Z_FINISH) != Z_STREAM_END ||
+    strm.avail_in != 0 ||
+    strm.avail_out != 0) {
+    inflateEnd(&strm);
+    CRYPTO_BUFFER_free(decompressed);
+    return 0;
+  }
+
+  inflateEnd(&strm);
+  *out = decompressed;
+  return 1;
+}
+#endif
+
+#ifdef HAVE_BROTLI
+
+/* Taken from Chromium and adapted to C,
+ * see net/ssl/cert_compression.cc
+ */
+int DecompressBrotliCert(SSL* ssl,
+                         CRYPTO_BUFFER** out,
+                         size_t uncompressed_len,
+                         const uint8_t* in,
+                         size_t in_len) {
+  uint8_t* data;
+  CRYPTO_BUFFER* decompressed = CRYPTO_BUFFER_alloc(&data, uncompressed_len);
+  if (!decompressed) {
+    return 0;
+  }
+
+  size_t output_size = uncompressed_len;
+  if (BrotliDecoderDecompress(in_len, in, &output_size, data) !=
+          BROTLI_DECODER_RESULT_SUCCESS ||
+      output_size != uncompressed_len) {
+    CRYPTO_BUFFER_free(decompressed);
+    return 0;
+  }
+
+  *out = decompressed;
+  return 1;
+}
+#endif
+
+/* curl-impersonate: decompress the zstd cert */
+#ifdef HAVE_ZSTD
+int DecompressZstdCert(SSL* ssl,
+                       CRYPTO_BUFFER** out,
+                       size_t uncompressed_len,
+                       const uint8_t* in,
+                       size_t in_len) {
+  size_t result;
+  uint8_t* data;
+  CRYPTO_BUFFER* decompressed = CRYPTO_BUFFER_alloc(&data, uncompressed_len);
+  if (!decompressed) {
+    return 0;
+  }
+
+  /* zstd returns the size of decompressed content */
+  result = ZSTD_decompress(data, uncompressed_len, in, in_len);
+  if (ZSTD_isError(result)) {
+    CRYPTO_BUFFER_free(decompressed);
+    return 0;
+  }
+
+  *out = decompressed;
+  return 1;
+}
+
+#endif
+
+
+#if defined(HAVE_LIBZ) || defined(HAVE_BROTLI) || defined(HAVE_ZSTD)
+static struct {
+  char *alg_name;
+  uint16_t alg_id;
+  ssl_cert_compression_func_t compress;
+  ssl_cert_decompression_func_t decompress;
+} cert_compress_algs[] = {
+#ifdef HAVE_LIBZ
+  {"zlib", TLSEXT_cert_compression_zlib, NULL, DecompressZlibCert},
+#endif
+#ifdef HAVE_BROTLI
+  {"brotli", TLSEXT_cert_compression_brotli, NULL, DecompressBrotliCert},
+#endif
+#ifdef HAVE_ZSTD
+  {"zstd", TLSEXT_cert_compression_zstd, NULL, DecompressZstdCert},
+#endif
+};
+
+#define NUM_CERT_COMPRESSION_ALGS \
+  sizeof(cert_compress_algs) / sizeof(cert_compress_algs[0])
+
+/*
+ * curl-impersonate:
+ * Add support for TLS extension 27 - compress_certificate.
+ * This calls the BoringSSL-specific API SSL_CTX_add_cert_compression_alg
+ * for each algorithm specified in cert_compression, which is a comma separated list.
+ */
+static CURLcode add_cert_compression(struct Curl_easy *data,
+                                     SSL_CTX *ctx,
+                                     const char *algorithms)
+{
+  int i;
+  const char *s = algorithms;
+  char *alg_name;
+  size_t alg_name_len;
+  bool found;
+
+  while (s && s[0]) {
+    found = FALSE;
+
+    for(i = 0; i < NUM_CERT_COMPRESSION_ALGS; i++) {
+      alg_name = cert_compress_algs[i].alg_name;
+      alg_name_len = strlen(alg_name);
+      if(strlen(s) >= alg_name_len &&
+         curl_strnequal(s, alg_name, alg_name_len) &&
+         (s[alg_name_len] == ',' || s[alg_name_len] == 0)) {
+        if(!SSL_CTX_add_cert_compression_alg(ctx,
+                    cert_compress_algs[i].alg_id,
+                    cert_compress_algs[i].compress,
+                    cert_compress_algs[i].decompress)) {
+          failf(data, "Error adding certificate compression algorithm '%s'",
+                alg_name);
+          return CURLE_SSL_CIPHER;
+        }
+        s += alg_name_len;
+        if(*s == ',')
+          s += 1;
+        found = TRUE;
+        break;
+      }
+    }
+
+    if(!found) {
+      failf(data, "Invalid compression algorithm list");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+  }
+
+  return CURLE_OK;
+}
+#else
+static CURLcode add_cert_compression(struct Curl_easy *data,
+                                     SSL_CTX *ctx,
+                                     const char *algorithms)
+{
+  /* No compression algorithms are available. */
+  (void)data;
+  (void)ctx;
+  (void)algorithms;
+  return CURLE_BAD_FUNCTION_ARGUMENT;
+}
+#endif
+
+#endif /* OPENSSL_IS_BORINGSSL */
+
 /*
  * Our callback from the SSL/TLS layers.
  */
@@ -3449,6 +3760,11 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
   if(!CURLECH_ENABLED(data))
     return CURLE_OK;
 
+#ifdef HAVE_BORINGSSL_LIKE
+  if(data->set.tls_ech == CURLECH_ENABLE)
+    SSL_set_enable_ech_grease(octx->ssl, 1);
+#endif
+
   if(data->set.tls_ech == CURLECH_GREASE) {
     infof(data, "ECH: will GREASE ClientHello");
 #ifdef HAVE_BORINGSSL_LIKE
@@ -3545,11 +3861,18 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
     }
   }
 #endif /* HAVE_BORINGSSL_LIKE */
-  if(trying_ech_now &&
-     SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {
+  /*
+   * BoringSSL/AWS-LC handle ECH's TLS version rules internally between
+   * ClientHelloInner/Outer. Do not force a global TLS minimum here so the
+   * outer behavior can match browsers.
+   */
+#ifndef HAVE_BORINGSSL_LIKE
+  if(trying_ech_now
+     && SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {
     infof(data, "ECH: cannot force TLSv1.3 [ERROR]");
     return CURLE_SSL_CONNECT_ERROR;
   }
+#endif
 
   return CURLE_OK;
 }
@@ -3569,6 +3892,11 @@ static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
                               void *ssl_user_data,
                               Curl_ossl_init_session_reuse_cb *sess_reuse_cb)
 {
+#ifdef OPENSSL_IS_BORINGSSL
+  struct ssl_connect_data *connssl = cf->ctx;
+  const struct alpn_spec *alps = NULL;
+#endif
+
   /* Let's make an SSL structure */
   if(octx->ssl)
     SSL_free(octx->ssl);
@@ -3580,6 +3908,34 @@ static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
 
   SSL_set_app_data(octx->ssl, ssl_user_data);
 
+#ifdef OPENSSL_IS_BORINGSSL
+  if(data->set.ssl_enable_alps) {
+    if(peer->transport == TRNSPRT_QUIC)
+      alps = alpns_requested;
+    else
+      alps = connssl->alps;
+  }
+  if(alps) {
+    size_t i;
+    struct alpn_proto_buf proto;
+
+    /* Select the ALPS codepoint before adding any application settings. */
+    SSL_set_alps_use_new_codepoint(
+      octx->ssl, data->set.tls_use_new_alps_codepoint ? 1 : 0);
+
+    for(i = 0; i < alps->count; ++i) {
+      /* curl-impersonate: Add the ALPS extension like Chrome does. */
+      /* Firefox does not enable this. */
+      SSL_add_application_settings(octx->ssl, alps->entries[i],
+                                   strlen(alps->entries[i]), NULL,
+                                   0);
+    }
+
+    Curl_alpn_to_proto_str(&proto, alps);
+    infof(data, VTLS_INFOF_ALPS_OFFER_1STR, proto.data);
+  }
+#endif
+
 #ifndef OPENSSL_NO_OCSP
   if(Curl_ssl_cf_get_primary_config(cf)->verifystatus)
     SSL_set_tlsext_status_type(octx->ssl, TLSEXT_STATUSTYPE_ocsp);
@@ -3759,7 +4115,15 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
      SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit must not be set.
   */
 
-  ctx_options = SSL_OP_ALL | SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION;
+  ctx_options = SSL_OP_ALL;
+
+  if(conn_config->enable_ticket) {
+    /* Enable the TLS session ticket extension when requested. */
+    ctx_options &= ~SSL_OP_NO_TICKET;
+  }
+  else
+    ctx_options |= SSL_OP_NO_TICKET;
+  ctx_options |= SSL_OP_NO_COMPRESSION;
 
   /* mitigate CVE-2010-4180 */
   ctx_options &= ~(ctx_option_t)SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;
@@ -3815,6 +4179,21 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
   /* We do retry writes sometimes from another buffer address */
   SSL_CTX_set_mode(octx->ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
 
+#ifdef OPENSSL_IS_BORINGSSL
+  SSL_CTX_set_options(octx->ssl_ctx, SSL_OP_LEGACY_SERVER_CONNECT);
+  SSL_CTX_set_mode(octx->ssl_ctx,
+                   SSL_MODE_CBC_RECORD_SPLITTING |
+                   SSL_MODE_ENABLE_FALSE_START);
+
+  /* Enable TLS extension 18, signed_certificate_timestamp. */
+  if(data->set.tls_signed_cert_timestamps)
+    SSL_CTX_enable_signed_cert_timestamps(octx->ssl_ctx);
+
+  /* Enable TLS extension 5, status_request. */
+  if(data->set.tls_status_request)
+    SSL_CTX_enable_ocsp_stapling(octx->ssl_ctx);
+#endif
+
   ciphers = conn_config->cipher_list;
   if(!ciphers && (peer->transport != TRNSPRT_QUIC))
     ciphers = NULL;
@@ -3873,7 +4252,8 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
     }
   }
 
-#ifdef HAVE_SSL_CTX_SET1_SIGALGS
+#if defined(HAVE_SSL_CTX_SET1_SIGALGS) && \
+  !defined(OPENSSL_IS_BORINGSSL)
 #define OSSL_SIGALG_CAST(x) OSSL_CURVE_CAST(x)
   {
     const char *signature_algorithms = conn_config->signature_algorithms;
@@ -3888,6 +4268,34 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
   }
 #endif
 
+#ifdef HAVE_SSL_CTX_SET_VERIFY_ALGORITHM_PREFS
+  {
+    uint16_t algs[MAX_SIG_ALGS];
+    size_t nalgs;
+    /* curl-impersonate: Set the signature algorithms (TLS extension 13). */
+    const char *signature_algorithms = conn_config->signature_algorithms;
+    if(signature_algorithms) {
+      CURLcode result = parse_sig_algs(data, signature_algorithms, algs,
+                                       &nalgs);
+      if(result)
+        return result;
+    }
+    else {
+      memcpy(algs, default_sig_algs, sizeof(default_sig_algs));
+      nalgs = DEFAULT_SIG_ALGS_LENGTH;
+    }
+    if(!SSL_CTX_set_signing_algorithm_prefs(octx->ssl_ctx, algs, nalgs) ||
+       !SSL_CTX_set_verify_algorithm_prefs(octx->ssl_ctx, algs, nalgs)) {
+      if(signature_algorithms)
+        failf(data, "failed setting signature algorithms: '%s'",
+              signature_algorithms);
+      else
+        failf(data, "failed setting default signature algorithms");
+      return CURLE_SSL_CIPHER;
+    }
+  }
+#endif
+
 #if defined(HAVE_OPENSSL_SRP) && defined(USE_TLS_SRP)
   if(ssl_config->primary.username && Curl_auth_allowed_to_host(data)) {
     char * const ssl_username = ssl_config->primary.username;
@@ -3913,6 +4321,56 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
   }
 #endif /* HAVE_OPENSSL_SRP && USE_TLS_SRP */
 
+#ifdef OPENSSL_IS_BORINGSSL
+  /* curl-impersonate:
+   * Configure BoringSSL to behave like Chrome.
+   * See Constructor of SSLContext at net/socket/ssl_client_socket_impl.cc
+   * and SSLClientSocketImpl::Init()
+   * in the Chromium's source code. */
+
+  /* curl-impersonate: Disable TLS GREASE for HTTP/3 (QUIC). */
+  if(peer->transport == TRNSPRT_QUIC)
+    SSL_CTX_set_grease_enabled(octx->ssl_ctx, 0);
+  else if(data->set.tls_grease)
+    SSL_CTX_set_grease_enabled(octx->ssl_ctx, 1);
+
+  /*
+   * curl-impersonate: Enable TLS extension permutation, enabled by default
+   * since Chrome 110.
+   */
+  if(data->set.ssl_permute_extensions)
+    SSL_CTX_set_permute_extensions(octx->ssl_ctx, 1);
+
+  /* curl-impersonate: Set TLS extensions order. */
+  if(conn_config->tls_extension_order)
+    SSL_CTX_set_extension_order(octx->ssl_ctx,
+                                conn_config->tls_extension_order);
+
+  if(data->set.str[STRING_TLS_DELEGATED_CREDENTIALS])
+    SSL_CTX_set_delegated_credentials(
+      octx->ssl_ctx, data->set.str[STRING_TLS_DELEGATED_CREDENTIALS]);
+
+  if(data->set.tls_record_size_limit)
+    SSL_CTX_set_record_size_limit(octx->ssl_ctx,
+                                  data->set.tls_record_size_limit);
+
+  if(data->set.tls_key_shares_limit)
+    SSL_CTX_set_key_shares_limit(octx->ssl_ctx,
+                                 data->set.tls_key_shares_limit);
+
+  /* curl-impersonate: Set key usage check. */
+  if(data->set.tls_key_usage_no_check)
+    SSL_CTX_set_key_usage_check_enabled(octx->ssl_ctx, 0);
+  else
+    SSL_CTX_set_key_usage_check_enabled(octx->ssl_ctx, 1);
+
+  if(conn_config->cert_compression && conn_config->cert_compression[0] &&
+     add_cert_compression(data,
+                          octx->ssl_ctx,
+                          conn_config->cert_compression))
+    return CURLE_SSL_CIPHER;
+#endif /* OPENSSL_IS_BORINGSSL */
+
   /* OpenSSL always tries to verify the peer. By setting the failure mode
    * to NONE, we allow the connect to complete, regardless of the outcome.
    * We then explicitly check the result and may try alternatives like
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index 82ce007b3d..7a7531c187 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -123,6 +123,20 @@ static const struct alpn_spec *alpn_get_spec(http_majors wanted,
 #endif
   return &ALPN_SPEC_H11;
 }
+
+static const struct alpn_spec *alps_get_spec(http_majors wanted,
+                                             bool use_alps)
+{
+  if(!use_alps)
+    return NULL;
+#ifdef USE_HTTP2
+  if(wanted & CURL_HTTP_V2x)
+    return &ALPN_SPEC_H2;
+#else
+  (void)wanted;
+#endif
+  return NULL;
+}
 #endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_PROXY */
 #endif /* USE_SSL */
 
@@ -188,7 +202,8 @@ static bool ssl_prefs_check(struct Curl_easy *data)
 }
 
 static struct ssl_connect_data *cf_ctx_new(struct Curl_easy *data,
-                                           const struct alpn_spec *alpn)
+                                           const struct alpn_spec *alpn,
+                                           const struct alpn_spec *alps)
 {
   struct ssl_connect_data *ctx;
 
@@ -199,6 +214,7 @@ static struct ssl_connect_data *cf_ctx_new(struct Curl_easy *data,
 
   ctx->ssl_impl = Curl_ssl;
   ctx->alpn = alpn;
+  ctx->alps = alps;
   Curl_bufq_init2(&ctx->earlydata, CURL_SSL_EARLY_MAX, 1, BUFQ_OPT_NO_SPARES);
   ctx->backend = curlx_calloc(1, ctx->ssl_impl->sizeof_ssl_backend_data);
   if(!ctx->backend) {
@@ -914,7 +930,8 @@ CURLcode Curl_ssl_peer_init(struct ssl_peer *ssl_peer,
                             struct Curl_peer *peer,
                             struct ssl_primary_config *sslc,
                             const char *tls_id,
-                            uint8_t transport)
+                            uint8_t transport,
+                            struct connectdata *conn)
 {
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
@@ -946,8 +963,8 @@ CURLcode Curl_ssl_peer_init(struct ssl_peer *ssl_peer,
     }
   }
 
-  result = Curl_ssl_peer_key_make(ssl_peer, sslc, tls_id,
-                                  &ssl_peer->scache_key);
+  result = Curl_ssl_peer_key_make_conn(ssl_peer, sslc, conn, tls_id,
+                                       &ssl_peer->scache_key);
 
 out:
   if(result)
@@ -1365,12 +1382,14 @@ static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
   (void)conn;
   /* We only support ALPN for HTTP so far. */
   DEBUGASSERT(!conn->bits.tls_enable_alpn);
-  ctx = cf_ctx_new(data, NULL);
+  ctx = cf_ctx_new(data, NULL, NULL);
 #else
   ctx = cf_ctx_new(data, alpn_get_spec(data->state.http_neg.wanted,
                                        data->state.http_neg.preferred,
                                        (bool)data->state.http_neg.only_10,
-                                       (bool)conn->bits.tls_enable_alpn));
+                                       (bool)conn->bits.tls_enable_alpn),
+                   alps_get_spec(data->state.http_neg.wanted,
+                                 (bool)conn->bits.tls_enable_alps));
 #endif
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
@@ -1395,7 +1414,7 @@ static CURLcode cf_ssl_peer_init(struct Curl_cfilter *cf,
   char tls_id[80];
   connssl->ssl_impl->version(tls_id, sizeof(tls_id) - 1);
   return Curl_ssl_peer_init(&connssl->peer, origin, peer, sslc,
-                            tls_id, TRNSPRT_TCP);
+                            tls_id, TRNSPRT_TCP, cf->conn);
 }
 
 CURLcode Curl_ssl_cfilter_add(struct Curl_easy *data,
@@ -1447,9 +1466,9 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
   CURLcode result;
   /* ALPN is default, but if user explicitly disables it, obey */
   bool use_alpn = (bool)data->set.ssl_enable_alpn;
+  bool use_alps = (bool)conn->bits.tls_enable_alps;
   http_majors wanted = CURL_HTTP_V1x;
 
-  (void)conn;
 #ifdef USE_HTTP2
   if(conn->http_proxy.proxytype == CURLPROXY_HTTPS2) {
     use_alpn = TRUE;
@@ -1457,7 +1476,8 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
   }
 #endif
 
-  ctx = cf_ctx_new(data, alpn_get_spec(wanted, 0, FALSE, use_alpn));
+  ctx = cf_ctx_new(data, alpn_get_spec(wanted, 0, FALSE, use_alpn),
+                   alps_get_spec(wanted, use_alps));
   if(!ctx) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
index 96cb7d15ed..ca72a31d28 100644
--- a/lib/vtls/vtls.h
+++ b/lib/vtls/vtls.h
@@ -64,6 +64,8 @@ struct dynbuf;
   "ALPN: server did not agree on a protocol. Uses default."
 #define VTLS_INFOF_ALPN_OFFER_1STR    \
   "ALPN: curl offers %s"
+#define VTLS_INFOF_ALPS_OFFER_1STR    \
+  "ALPS: offers %s"
 #define VTLS_INFOF_ALPN_ACCEPTED      \
   ALPN_ACCEPTED "%.*s"
 
@@ -112,7 +114,8 @@ CURLcode Curl_ssl_peer_init(struct ssl_peer *ssl_peer,
                             struct Curl_peer *peer,
                             struct ssl_primary_config *sslc,
                             const char *tls_id,
-                            uint8_t transport);
+                            uint8_t transport,
+                            struct connectdata *conn);
 /**
  * Free all allocated data and reset peer information.
  */
diff --git a/lib/vtls/vtls_config.c b/lib/vtls/vtls_config.c
index 4a9b69654b..d3c73e598a 100644
--- a/lib/vtls/vtls_config.c
+++ b/lib/vtls/vtls_config.c
@@ -127,6 +127,8 @@ void Curl_ssl_config_cleanup(struct ssl_primary_config *sslc)
     curlx_safefree(sslc->issuercert_blob);
     curlx_safefree(sslc->key_blob);
     curlx_safefree(sslc->curves);
+    curlx_safefree(sslc->tls_extension_order);
+    curlx_safefree(sslc->cert_compression);
     curlx_safefree(sslc->signature_algorithms);
     curlx_safefree(sslc->CRLfile);
     curlx_safefree(sslc->cert_type);
@@ -152,6 +154,7 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
      (c1->verifypeer == c2->verifypeer) &&
      (c1->verifyhost == c2->verifyhost) &&
      (c1->verifystatus == c2->verifystatus) &&
+     (c1->enable_ticket == c2->enable_ticket) &&
      blobcmp(c1->cert_blob, c2->cert_blob) &&
      blobcmp(c1->ca_info_blob, c2->ca_info_blob) &&
      blobcmp(c1->issuercert_blob, c2->issuercert_blob) &&
@@ -167,6 +170,8 @@ static bool match_ssl_primary_config(struct Curl_easy *data,
      curl_strequal(c1->cipher_list, c2->cipher_list) &&
      curl_strequal(c1->cipher_list13, c2->cipher_list13) &&
      curl_strequal(c1->curves, c2->curves) &&
+     curl_strequal(c1->tls_extension_order, c2->tls_extension_order) &&
+     curl_strequal(c1->cert_compression, c2->cert_compression) &&
      curl_strequal(c1->signature_algorithms, c2->signature_algorithms) &&
      Curl_safecmp(c1->CRLfile, c2->CRLfile) &&
      Curl_safecmp(c1->pinned_key, c2->pinned_key) &&
@@ -205,6 +210,7 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
   dest->verifyhost = source->verifyhost;
   dest->verifystatus = source->verifystatus;
   dest->cache_session = source->cache_session;
+  dest->enable_ticket = source->enable_ticket;
   dest->ssl_options = source->ssl_options;
 
   CLONE_BLOB(cert_blob);
@@ -217,6 +223,8 @@ static bool clone_ssl_primary_config(struct ssl_primary_config *source,
   CLONE_STRING(cipher_list13);
   CLONE_STRING(pinned_key);
   CLONE_STRING(curves);
+  CLONE_STRING(tls_extension_order);
+  CLONE_STRING(cert_compression);
   CLONE_STRING(signature_algorithms);
   CLONE_STRING(CRLfile);
   /* SSL credentials: client certificate, SRP auth */
@@ -253,10 +261,14 @@ static void ssl_easy_config_compl_options(struct Curl_peer *origin,
                            !!(options & CURLSSLOPT_AUTO_CLIENT_CERT);
 }
 
-CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
-                                       struct Curl_peer *origin)
+static CURLcode ssl_easy_config_complete(struct Curl_easy *data,
+                                         struct Curl_peer *origin,
+                                         struct connectdata *conn)
 {
   struct ssl_config_data *sslc = &data->set.ssl;
+  const bool is_h3 = conn && conn->transport_wanted == TRNSPRT_QUIC;
+  const bool is_wss = conn && conn->scheme &&
+    (conn->scheme->protocol & CURLPROTO_WSS);
 #if defined(CURL_CA_PATH) || defined(CURL_CA_BUNDLE)
   struct UserDefined *set = &data->set;
   CURLcode result;
@@ -293,6 +305,29 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
     data->set.str[STRING_SSL_SIGNATURE_ALGORITHMS];
   sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO];
   sslc->primary.curves = data->set.str[STRING_SSL_EC_CURVES];
+  sslc->primary.tls_extension_order =
+    data->set.str[STRING_TLS_EXTENSION_ORDER];
+  sslc->primary.cert_compression =
+    data->set.str[STRING_SSL_CERT_COMPRESSION];
+  sslc->primary.enable_ticket = data->set.ssl_enable_ticket;
+
+  if(is_wss) {
+    if(data->set.ws_disable_session_ticket)
+      sslc->primary.enable_ticket = FALSE;
+    if(data->set.str[STRING_WS_SSL_CERT_COMPRESSION])
+      sslc->primary.cert_compression =
+        data->set.str[STRING_WS_SSL_CERT_COMPRESSION];
+  }
+  else if(is_h3) {
+    if(data->set.str[STRING_HTTP3_SSL_EC_CURVES])
+      sslc->primary.curves = data->set.str[STRING_HTTP3_SSL_EC_CURVES];
+    if(data->set.str[STRING_HTTP3_SIG_HASH_ALGS])
+      sslc->primary.signature_algorithms =
+        data->set.str[STRING_HTTP3_SIG_HASH_ALGS];
+    if(data->set.str[STRING_HTTP3_TLS_EXTENSION_ORDER])
+      sslc->primary.tls_extension_order =
+        data->set.str[STRING_HTTP3_TLS_EXTENSION_ORDER];
+  }
   /* Maybe these should not be used for another origin. But for
    * backwards compatibility, keep them in. */
   sslc->primary.issuercert = data->set.str[STRING_SSL_ISSUERCERT];
@@ -358,6 +393,7 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
   sslc->primary.CApath = data->set.str[STRING_SSL_CAPATH_PROXY];
   sslc->primary.cipher_list = data->set.str[STRING_SSL_CIPHER_LIST_PROXY];
   sslc->primary.cipher_list13 = data->set.str[STRING_SSL_CIPHER13_LIST_PROXY];
+  sslc->primary.enable_ticket = data->set.ssl_enable_ticket;
   sslc->primary.pinned_key = data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY];
   sslc->primary.cert_blob = data->set.blobs[BLOB_CERT_PROXY];
   sslc->primary.ca_info_blob = data->set.blobs[BLOB_CAINFO_PROXY];
@@ -379,6 +415,18 @@ CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
   return CURLE_OK;
 }
 
+CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
+                                       struct Curl_peer *origin)
+{
+  return ssl_easy_config_complete(data, origin, NULL);
+}
+
+CURLcode Curl_ssl_easy_config_complete_conn(struct Curl_easy *data,
+                                            struct connectdata *conn)
+{
+  return ssl_easy_config_complete(data, conn->origin, conn);
+}
+
 CURLcode Curl_ssl_conn_config_init(struct Curl_easy *data,
                                    struct connectdata *conn)
 {
diff --git a/lib/vtls/vtls_config.h b/lib/vtls/vtls_config.h
index 44e691dd26..be680be477 100644
--- a/lib/vtls/vtls_config.h
+++ b/lib/vtls/vtls_config.h
@@ -52,6 +52,8 @@ struct ssl_primary_config {
   char *password; /* TLS password (for, e.g., SRP) */
 #endif
   char *curves;          /* list of curves to use */
+  char *tls_extension_order; /* TLS extension order to use */
+  char *cert_compression; /* certificate compression algorithms */
   uint32_t version_max; /* max supported version the client wants to use */
   uint8_t ssl_options;  /* the CURLOPT_SSL_OPTIONS bitmask */
   uint8_t version;    /* what version the client wants to use */
@@ -59,6 +61,7 @@ struct ssl_primary_config {
   BIT(verifyhost);       /* set TRUE if CN/SAN must match hostname */
   BIT(verifystatus);     /* set TRUE if certificate status must be checked */
   BIT(cache_session);    /* cache session or not */
+  BIT(enable_ticket);    /* enable the TLS session ticket extension */
   BIT(deep_copy);        /* members are deep copies, eg. owned here */
 };
 
@@ -96,6 +99,12 @@ void Curl_ssl_config_cleanup(struct ssl_primary_config *sslc);
 CURLcode Curl_ssl_easy_config_complete(struct Curl_easy *data,
                                        struct Curl_peer *origin);
 
+/**
+ * Complete the easy handle SSL configuration for a new connection.
+ */
+CURLcode Curl_ssl_easy_config_complete_conn(struct Curl_easy *data,
+                                            struct connectdata *conn);
+
 /**
  * Init SSL configs (main + proxy) for a new connection from the easy handle.
  */
diff --git a/lib/vtls/vtls_int.h b/lib/vtls/vtls_int.h
index fa5da6e4d5..45aeb422c2 100644
--- a/lib/vtls/vtls_int.h
+++ b/lib/vtls/vtls_int.h
@@ -114,6 +114,7 @@ struct ssl_connect_data {
   const struct Curl_ssl *ssl_impl;  /* TLS backend for this filter */
   struct ssl_peer peer;             /* peer the filter talks to */
   const struct alpn_spec *alpn;     /* ALPN to use or NULL for none */
+  const struct alpn_spec *alps;     /* ALPS to use or NULL for none */
   void *backend;                    /* vtls backend specific props */
   struct cf_call_data call_data;    /* data handle used in current call */
   struct curltime handshake_done;   /* time when handshake finished */
diff --git a/lib/vtls/vtls_scache.c b/lib/vtls/vtls_scache.c
index 98beeac036..187f21dbc6 100644
--- a/lib/vtls/vtls_scache.c
+++ b/lib/vtls/vtls_scache.c
@@ -228,6 +228,7 @@ static CURLcode ssl_peer_key_add_vrfy(struct dynbuf *buf,
 
 static CURLcode ssl_peer_key_build(struct ssl_primary_config *ssl,
                                    const struct ssl_peer *peer,
+                                   const struct connectdata *conn,
                                    const char *tls_id,
                                    char **ppeer_key)
 {
@@ -260,6 +261,11 @@ static CURLcode ssl_peer_key_build(struct ssl_primary_config *ssl,
     if(result)
       goto out;
   }
+  if(!ssl->enable_ticket) {
+    result = curlx_dyn_add(&buf, ":NOTICKET");
+    if(result)
+      goto out;
+  }
   if(ssl->cipher_list) {
     result = curlx_dyn_addf(&buf, ":CIPHER-%s", ssl->cipher_list);
     if(result)
@@ -281,6 +287,45 @@ static CURLcode ssl_peer_key_build(struct ssl_primary_config *ssl,
     if(result)
       goto out;
   }
+#ifndef CURL_DISABLE_PROXY
+  /* Keep sessions started through one proxy from being resumed through a
+   * different proxy when credential reuse is disabled. */
+  if(conn && conn->bits.proxy_credential_no_reuse) {
+    const struct proxy_info *proxy = NULL;
+    const char *proxy_type = NULL;
+
+    if(conn->http_proxy.peer) {
+      proxy = &conn->http_proxy;
+      proxy_type = "HTTP";
+    }
+    else if(conn->socks_proxy.peer) {
+      proxy = &conn->socks_proxy;
+      proxy_type = "SOCKS";
+    }
+
+    if(proxy) {
+      result = curlx_dyn_addf(&buf, ":PTYPE-%s:PHOST-%s:PPORT-%u",
+                              proxy_type, proxy->peer->hostname,
+                              proxy->peer->port);
+      if(result)
+        goto out;
+      if(Curl_creds_has_user(proxy->creds)) {
+        result = curlx_dyn_addf(&buf, ":PUSER-%s", proxy->creds->user);
+        if(result)
+          goto out;
+      }
+      if(Curl_creds_has_passwd(proxy->creds)) {
+        /* Do not put the password in the key, but distinguish authenticated
+         * proxies from proxies without a password. */
+        result = curlx_dyn_add(&buf, ":PPW");
+        if(result)
+          goto out;
+      }
+    }
+  }
+#else
+  (void)conn;
+#endif
   if(ssl->verifypeer) {
     result = cf_ssl_peer_key_add_path(&buf, "CA", ssl->CAfile, &is_local);
     if(result)
@@ -356,7 +401,16 @@ CURLcode Curl_ssl_peer_key_make(const struct ssl_peer *peer,
                                 const char *tls_id,
                                 char **ppeer_key)
 {
-  return ssl_peer_key_build(sslc, peer, tls_id, ppeer_key);
+  return ssl_peer_key_build(sslc, peer, NULL, tls_id, ppeer_key);
+}
+
+CURLcode Curl_ssl_peer_key_make_conn(const struct ssl_peer *peer,
+                                     struct ssl_primary_config *sslc,
+                                     const struct connectdata *conn,
+                                     const char *tls_id,
+                                     char **ppeer_key)
+{
+  return ssl_peer_key_build(sslc, peer, conn, tls_id, ppeer_key);
 }
 
 struct Curl_ssl_scache {
diff --git a/lib/vtls/vtls_scache.h b/lib/vtls/vtls_scache.h
index effb1d8f96..a0a8e2f596 100644
--- a/lib/vtls/vtls_scache.h
+++ b/lib/vtls/vtls_scache.h
@@ -66,6 +66,12 @@ CURLcode Curl_ssl_peer_key_make(const struct ssl_peer *peer,
                                 const char *tls_id,
                                 char **ppeer_key);
 
+CURLcode Curl_ssl_peer_key_make_conn(const struct ssl_peer *peer,
+                                     struct ssl_primary_config *sslc,
+                                     const struct connectdata *conn,
+                                     const char *tls_id,
+                                     char **ppeer_key);
+
 /* Return if there is a session cache shall be used.
  * An SSL session might not be configured or not available for
  * "connect-only" transfers.
diff --git a/lib/ws.c b/lib/ws.c
index 9820c3e4bd..fd125d35d4 100644
--- a/lib/ws.c
+++ b/lib/ws.c
@@ -27,6 +27,20 @@
 
 #ifndef CURL_DISABLE_WEBSOCKETS
 
+/* Include architecture-specific SIMD intrinsics and CPUID headers. MSVC
+ * requires <intrin.h>, while GCC and Clang use <cpuid.h>. */
+#if defined(__x86_64__) || defined(_M_X64) || \
+    defined(__i386__) || defined(_M_IX86)
+#include <immintrin.h>
+#ifdef _MSC_VER
+#include <intrin.h>
+#else
+#include <cpuid.h>
+#endif
+#elif defined(__aarch64__) || defined(_M_ARM64) || defined(__ARM_NEON)
+#include <arm_neon.h>
+#endif
+
 #include "url.h"
 #include "bufq.h"
 #include "curlx/dynbuf.h"
@@ -71,8 +85,225 @@
 #define WSBIT_MASK 0x80
 
 /* buffer dimensioning */
-#define WS_CHUNK_SIZE  65535
-#define WS_CHUNK_COUNT 2
+#define WS_CHUNK_SIZE  131072
+#define WS_CHUNK_COUNT 4
+
+#ifndef WS_ENC_XBUF_SIZE
+#define WS_ENC_XBUF_SIZE 8192
+#endif
+
+/* Feature bitmask constants. */
+#define WS_CPU_FEAT_INIT   (1 << 0)
+#define WS_CPU_FEAT_AVX2   (1 << 1)
+#define WS_CPU_FEAT_AVX512 (1 << 2)
+
+/* Determine endianness across supported compilers and operating systems. */
+#if (defined(__BYTE_ORDER__) && \
+     (__BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__)) || \
+    defined(_WIN32) || defined(_WIN64) || defined(__LITTLE_ENDIAN__) || \
+    defined(__ARMEL__) || defined(__AARCH64EL__) || \
+    defined(_M_IX86) || defined(_M_X64) || \
+    defined(_M_ARM) || defined(_M_ARM64)
+#define WS_IS_LITTLE_ENDIAN 1
+#else
+#define WS_IS_LITTLE_ENDIAN 0
+#endif
+
+/* Identify architectures with native 64-bit scalar operations. */
+#if defined(__x86_64__) || defined(_M_X64) || \
+    defined(__aarch64__) || defined(_M_ARM64)
+#define WS_64BIT_NATIVE 1
+#else
+#define WS_64BIT_NATIVE 0
+#endif
+
+/* SIMD configuration. */
+#if WS_IS_LITTLE_ENDIAN
+
+#if defined(__x86_64__) || defined(_M_X64) || \
+    defined(__i386__) || defined(_M_IX86)
+#define WS_HAVE_X86_SIMD 1
+#if defined(__GNUC__) || defined(__clang__)
+#if defined(__has_attribute)
+#if __has_attribute(target)
+#define WS_TARGET_AVX2 __attribute__((target("avx2")))
+#if defined(__clang__) && \
+    ((defined(__apple_build_version__) && __clang_major__ >= 16) || \
+     (!defined(__apple_build_version__) && __clang_major__ >= 18))
+#define WS_TARGET_AVX512 \
+  __attribute__((target("avx512f,evex512")))
+#else
+#define WS_TARGET_AVX512 __attribute__((target("avx512f")))
+#endif
+#define WS_SUPPORT_AVX_RUNTIME 1
+#else
+#define WS_TARGET_AVX2
+#define WS_TARGET_AVX512
+#endif
+#else
+#define WS_TARGET_AVX2
+#define WS_TARGET_AVX512
+#endif
+#else
+#define WS_TARGET_AVX2
+#define WS_TARGET_AVX512
+#endif
+
+#ifdef _MSC_VER
+#define WS_ATOMIC_LOAD(var) \
+  (uint32_t)_InterlockedOr((volatile long *)&(var), 0)
+#define WS_ATOMIC_STORE(var, val) \
+  _InterlockedExchange((volatile long *)&(var), (long)(val))
+#else
+#define WS_ATOMIC_LOAD(var) \
+  __atomic_load_n(&(var), __ATOMIC_RELAXED)
+#define WS_ATOMIC_STORE(var, val) \
+  __atomic_store_n(&(var), (val), __ATOMIC_RELAXED)
+#endif
+#endif
+
+/* ARM SIMD configuration. */
+#if defined(__aarch64__) || defined(_M_ARM64) || defined(__ARM_NEON)
+#define WS_HAVE_ARM_SIMD 1
+#endif
+
+#ifdef WS_HAVE_X86_SIMD
+
+/* AVX-512 path: 128 bytes per iteration, unrolled twice. */
+#if defined(WS_SUPPORT_AVX_RUNTIME) || defined(__AVX512F__)
+WS_TARGET_AVX512
+static size_t ws_xor_avx512(const uint8_t *src, uint8_t *dst,
+                            size_t len, uint32_t m32)
+{
+  size_t i = 0;
+  __m512i vmask = _mm512_set1_epi32((int)m32);
+  for(; i + 128 <= len; i += 128) {
+    __m512i v0 = _mm512_loadu_si512((const __m512i *)(const void *)
+                                    (src + i));
+    __m512i v1 = _mm512_loadu_si512((const __m512i *)(const void *)
+                                    (src + i + 64));
+    _mm512_storeu_si512((__m512i *)(void *)(dst + i),
+                        _mm512_xor_si512(v0, vmask));
+    _mm512_storeu_si512((__m512i *)(void *)(dst + i + 64),
+                        _mm512_xor_si512(v1, vmask));
+  }
+  return i;
+}
+#endif
+
+/* AVX2 path: 64 bytes per iteration, unrolled twice. */
+#if defined(WS_SUPPORT_AVX_RUNTIME) || defined(__AVX2__)
+WS_TARGET_AVX2
+static size_t ws_xor_avx2(const uint8_t *src, uint8_t *dst,
+                          size_t len, uint32_t m32)
+{
+  size_t i = 0;
+  __m256i vmask = _mm256_set1_epi32((int)m32);
+  for(; i + 64 <= len; i += 64) {
+    __m256i v0 = _mm256_loadu_si256((const __m256i *)(const void *)
+                                    (src + i));
+    __m256i v1 = _mm256_loadu_si256((const __m256i *)(const void *)
+                                    (src + i + 32));
+    _mm256_storeu_si256((__m256i *)(void *)(dst + i),
+                        _mm256_xor_si256(v0, vmask));
+    _mm256_storeu_si256((__m256i *)(void *)(dst + i + 32),
+                        _mm256_xor_si256(v1, vmask));
+  }
+  return i;
+}
+#endif
+
+/* Check both CPU feature bits and operating-system SIMD support. */
+static uint32_t ws_get_cpu_features(void)
+{
+  uint32_t features = WS_CPU_FEAT_INIT;
+
+#ifdef _MSC_VER
+  int cpuinfo[4];
+  int max_leaf;
+  unsigned __int64 xcr0;
+
+  /* Check the maximum supported CPUID leaf. */
+  __cpuid(cpuinfo, 0);
+  max_leaf = cpuinfo[0];
+  if(max_leaf < 1)
+    return features;
+
+  __cpuidex(cpuinfo, 1, 0);
+  /* Check XSAVE, OSXSAVE and AVX. */
+  if((cpuinfo[2] & ((1 << 26) | (1 << 27) | (1 << 28))) !=
+     ((1 << 26) | (1 << 27) | (1 << 28)))
+    return features;
+
+  xcr0 = _xgetbv(0);
+  if((xcr0 & 0x06) != 0x06)
+    return features;
+
+  if(max_leaf >= 7) {
+    __cpuidex(cpuinfo, 7, 0);
+    if(cpuinfo[1] & (1 << 5))
+      features |= WS_CPU_FEAT_AVX2;
+    if(((xcr0 & 0xe6) == 0xe6) && (cpuinfo[1] & (1 << 16)))
+      features |= WS_CPU_FEAT_AVX512;
+  }
+#elif defined(__GNUC__) || defined(__clang__)
+  unsigned int eax = 0;
+  unsigned int ebx = 0;
+  unsigned int ecx = 0;
+  unsigned int edx = 0;
+  unsigned int max_leaf;
+  uint32_t xcr0_eax;
+  uint32_t xcr0_edx;
+
+  /* Check the maximum supported CPUID leaf. */
+  max_leaf = __get_cpuid_max(0, NULL);
+  if(max_leaf < 1)
+    return features;
+  if(!__get_cpuid(1, &eax, &ebx, &ecx, &edx))
+    return features;
+  /* Check XSAVE, OSXSAVE and AVX. */
+  if((ecx & ((1 << 26) | (1 << 27) | (1 << 28))) !=
+     ((1 << 26) | (1 << 27) | (1 << 28)))
+    return features;
+
+  __asm__ volatile("xgetbv" : "=a"(xcr0_eax), "=d"(xcr0_edx) : "c"(0));
+  (void)xcr0_edx;
+  if((xcr0_eax & 0x06) != 0x06)
+    return features;
+
+  if(max_leaf >= 7) {
+    __cpuid_count(7, 0, eax, ebx, ecx, edx);
+    if(ebx & (1 << 5))
+      features |= WS_CPU_FEAT_AVX2;
+    if(((xcr0_eax & 0xe6) == 0xe6) && (ebx & (1 << 16)))
+      features |= WS_CPU_FEAT_AVX512;
+  }
+#endif
+
+  return features;
+}
+#endif
+
+#ifdef WS_HAVE_ARM_SIMD
+/* NEON path: 32 bytes per iteration, unrolled twice. */
+static size_t ws_xor_neon(const uint8_t *src, uint8_t *dst,
+                          size_t len, uint32_t m32)
+{
+  size_t i = 0;
+  uint32x4_t vmask = vdupq_n_u32(m32);
+  for(; i + 32 <= len; i += 32) {
+    uint8x16_t v0 = vld1q_u8(src + i);
+    uint8x16_t v1 = vld1q_u8(src + i + 16);
+    v0 = veorq_u8(v0, vreinterpretq_u8_u32(vmask));
+    v1 = veorq_u8(v1, vreinterpretq_u8_u32(vmask));
+    vst1q_u8(dst + i, v0);
+    vst1q_u8(dst + i + 16, v1);
+  }
+  return i;
+}
+#endif
+
+#endif /* WS_IS_LITTLE_ENDIAN */
 
 /* a client-side WS frame decoder, parsing frame headers and
  * payload, keeping track of current position and stats */
@@ -102,6 +333,7 @@ struct ws_encoder {
   uint8_t mask[4]; /* 32-bit mask for this connection */
   uint8_t firstbyte; /* first byte of frame we encode */
   BIT(contfragment); /* set TRUE if the previous fragment sent was not final */
+  uint8_t xbuf[WS_ENC_XBUF_SIZE]; /* staging buffer for XOR masking */
 };
 
 /* Control frames are allowed up to 125 characters, rfc6455, ch. 5.5 */
@@ -753,9 +985,10 @@ static CURLcode ws_cw_write(struct Curl_easy *data,
     }
   }
 
-  if((type & CLIENTWRITE_EOS) && !Curl_bufq_is_empty(&ctx->buf)) {
-    failf(data, "[WS] decode ending with %zu frame bytes remaining",
-          Curl_bufq_len(&ctx->buf));
+  if((type & CLIENTWRITE_EOS) &&
+     (!Curl_bufq_is_empty(&ctx->buf) || ws->dec.state != WS_DEC_INIT)) {
+    failf(data, "[WS] decode ending with %zu bytes remaining and "
+          "incomplete frame", Curl_bufq_len(&ctx->buf));
     result = CURLE_RECV_ERROR;
   }
 
@@ -951,34 +1184,121 @@ static CURLcode ws_enc_write_payload(struct ws_encoder *enc,
                                      const uint8_t *buf, size_t buflen,
                                      struct bufq *out, size_t *pnwritten)
 {
-  CURLcode result;
-  size_t i, len, n, remain;
+  CURLcode result = CURLE_OK;
+  size_t i = 0;
+  size_t len;
+  size_t remain;
+#if defined(WS_HAVE_X86_SIMD) && WS_IS_LITTLE_ENDIAN
+  static uint32_t cpu_feats;
+  uint32_t features;
+#endif
 
   *pnwritten = 0;
   if(Curl_bufq_is_full(out))
     return CURLE_AGAIN;
 
-  /* not the most performant way to do this */
+  /* A completed payload has nothing more to buffer. */
+  if(enc->payload_remain <= 0) {
+    ws_enc_info(enc, data, "buffered");
+    return CURLE_OK;
+  }
+
   len = buflen;
   remain = curlx_sotouz_range(enc->payload_remain, 0, SIZE_MAX);
   if(remain < len)
     len = remain;
 
-  for(i = 0; i < len; ++i) {
-    uint8_t c = buf[i] ^ enc->mask[enc->xori];
-    result = Curl_bufq_write(out, &c, 1, &n);
-    if(result) {
-      if((result != CURLE_AGAIN) || !i)
-        return result;
-      break;
+#if defined(WS_HAVE_X86_SIMD) && WS_IS_LITTLE_ENDIAN
+  /* Evaluate the process-global CPU feature cache once. */
+  features = WS_ATOMIC_LOAD(cpu_feats);
+  if(!(features & WS_CPU_FEAT_INIT)) {
+    features = ws_get_cpu_features();
+    WS_ATOMIC_STORE(cpu_feats, features);
+  }
+  (void)features;
+#endif
+
+  while(i < len) {
+    uint8_t mask[4];
+    size_t chunk = CURLMIN(len - i, (size_t)WS_ENC_XBUF_SIZE);
+    size_t j = 0;
+    size_t xbuf_idx = 0;
+#if WS_IS_LITTLE_ENDIAN
+    uint32_t mask32;
+#endif
+
+    /* Rotate the four-byte mask to the current frame offset. */
+    mask[0] = enc->mask[enc->xori];
+    mask[1] = enc->mask[(enc->xori + 1) & 3];
+    mask[2] = enc->mask[(enc->xori + 2) & 3];
+    mask[3] = enc->mask[(enc->xori + 3) & 3];
+
+#if WS_IS_LITTLE_ENDIAN
+    memcpy(&mask32, mask, sizeof(mask32));
+
+    /* SIMD ladder: 128, 64 or 32 bytes per iteration. */
+#ifdef WS_HAVE_X86_SIMD
+#if defined(WS_SUPPORT_AVX_RUNTIME) || defined(__AVX512F__)
+    if(features & WS_CPU_FEAT_AVX512)
+      j = ws_xor_avx512(buf + i, enc->xbuf, chunk, mask32);
+#endif
+#if defined(WS_SUPPORT_AVX_RUNTIME) || defined(__AVX2__)
+    if(!j && (features & WS_CPU_FEAT_AVX2))
+      j = ws_xor_avx2(buf + i, enc->xbuf, chunk, mask32);
+#endif
+#elif defined(WS_HAVE_ARM_SIMD)
+    j = ws_xor_neon(buf + i, enc->xbuf, chunk, mask32);
+#endif
+
+    /* Scalar ladder: eight or four bytes per iteration. */
+#if WS_64BIT_NATIVE
+    {
+      uint64_t mask64 = ((uint64_t)mask32 << 32) | mask32;
+      for(; j + 8 <= chunk; j += 8) {
+        uint64_t data64;
+        memcpy(&data64, buf + i + j, sizeof(data64));
+        data64 ^= mask64;
+        memcpy(enc->xbuf + j, &data64, sizeof(data64));
+      }
+    }
+#endif
+    for(; j + 4 <= chunk; j += 4) {
+      uint32_t data32;
+      memcpy(&data32, buf + i + j, sizeof(data32));
+      data32 ^= mask32;
+      memcpy(enc->xbuf + j, &data32, sizeof(data32));
+    }
+#endif /* WS_IS_LITTLE_ENDIAN */
+
+    /* Final remainder: one byte per iteration. */
+    for(; j < chunk; ++j)
+      enc->xbuf[j] = buf[i + j] ^ mask[j & 3];
+
+    /* Flush the staging buffer to the connection queue. Short writes and
+     * zero-byte stalls leave the remaining data for a later retry. */
+    while(xbuf_idx < chunk) {
+      size_t n = 0;
+      result = Curl_bufq_write(out, enc->xbuf + xbuf_idx,
+                               chunk - xbuf_idx, &n);
+      if(n) {
+        /* Advance for bytes accepted before a later retry or error. */
+        xbuf_idx += n;
+        i += n;
+        enc->xori = (enc->xori + (unsigned int)n) & 3;
+      }
+      if(result || !n) {
+        if(!result)
+          result = CURLE_AGAIN;
+        goto out;
+      }
     }
-    enc->xori++;
-    enc->xori &= 3;
   }
+
+out:
   *pnwritten = i;
   enc->payload_remain -= (curl_off_t)i;
   ws_enc_info(enc, data, "buffered");
-  return CURLE_OK;
+  return result;
 }
 
 static CURLcode ws_enc_add_pending(struct Curl_easy *data,
@@ -1677,6 +1997,12 @@ static CURLcode ws_flush(struct Curl_easy *data, struct websocket *ws,
           result = CURLE_AGAIN;
       }
 
+      /* A send can report an error after writing a partial amount. */
+      if(n) {
+        CURL_TRC_WS(data, "flushed %zu bytes", n);
+        Curl_bufq_skip(&ws->sendbuf, n);
+      }
+
       if(result == CURLE_AGAIN) {
         CURL_TRC_WS(data, "flush EAGAIN, %zu bytes remain in buffer",
                     Curl_bufq_len(&ws->sendbuf));
@@ -1686,10 +2012,6 @@ static CURLcode ws_flush(struct Curl_easy *data, struct websocket *ws,
         failf(data, "[WS] flush, write error %d", (int)result);
         return result;
       }
-      else {
-        CURL_TRC_WS(data, "flushed %zu bytes", n);
-        Curl_bufq_skip(&ws->sendbuf, n);
-      }
     }
   }
   return CURLE_OK;
diff --git a/libcurl.pc.in b/libcurl.pc.in
index c0ba5244a8..b5e9cb4eed 100644
--- a/libcurl.pc.in
+++ b/libcurl.pc.in
@@ -35,7 +35,7 @@ Description: Library to transfer files with HTTP, FTP, etc.
 Version: @CURLVERSION@
 Requires: @LIBCURL_PC_REQUIRES@
 Requires.private: @LIBCURL_PC_REQUIRES_PRIVATE@
-Libs: -L${libdir} -lcurl @LIBCURL_PC_LIBS@
+Libs: -L${libdir} -lcurl-impersonate @LIBCURL_PC_LIBS@
 Libs.private: @LIBCURL_PC_LDFLAGS_PRIVATE@ @LIBCURL_PC_LIBS_PRIVATE@
 Cflags: -I${includedir} @LIBCURL_PC_CFLAGS@
 Cflags.private: @LIBCURL_PC_CFLAGS_PRIVATE@
diff --git a/m4/curl-compilers.m4 b/m4/curl-compilers.m4
index 8b7da20caa..8f5aebac5b 100644
--- a/m4/curl-compilers.m4
+++ b/m4/curl-compilers.m4
@@ -395,43 +395,56 @@ AC_DEFUN([CURL_CONVERT_INCLUDE_TO_ISYSTEM], [
   AC_REQUIRE([CURL_SHFUNC_SQUEEZE])
   AC_REQUIRE([CURL_CHECK_COMPILER])
   AC_MSG_CHECKING([convert -I options to -isystem])
-  if test "$compiler_id" = "GNU_C" ||
-     test "$compiler_id" = "CLANG" ||
-     test "$compiler_id" = "APPLECLANG"; then
-    AC_MSG_RESULT([yes])
-    tmp_has_include="no"
-    tmp_chg_FLAGS="$CFLAGS"
-    for word1 in $tmp_chg_FLAGS; do
-      case "$word1" in
-        -I*)
-          tmp_has_include="yes"
-          ;;
-      esac
-    done
-    if test "$tmp_has_include" = "yes"; then
-      tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/^-I/ -isystem /g'`
-      tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/ -I/ -isystem /g'`
-      CFLAGS="$tmp_chg_FLAGS"
-      squeeze CFLAGS
-    fi
-    tmp_has_include="no"
-    tmp_chg_FLAGS="$CPPFLAGS"
-    for word1 in $tmp_chg_FLAGS; do
-      case "$word1" in
-        -I*)
-          tmp_has_include="yes"
-          ;;
-      esac
-    done
-    if test "$tmp_has_include" = "yes"; then
-      tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/^-I/ -isystem /g'`
-      tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/ -I/ -isystem /g'`
-      CPPFLAGS="$tmp_chg_FLAGS"
-      squeeze CPPFLAGS
-    fi
-  else
+  case $host_os in
+  darwin*)
+    dnl curl-impersonate: On macos, clang gives priority to /usr/local/include
+    dnl over locations specified with -isystem for some unknown reason. In turn
+    dnl this causes clang to use the system's openssl, which conflicts with
+    dnl curl-impersonate's boringssl headers.
+    dnl To prevent that, disable curl's automatic conversion of -I flags to
+    dnl -isystem.
     AC_MSG_RESULT([no])
-  fi
+    ;;
+  *)
+    if test "$compiler_id" = "GNU_C" ||
+      test "$compiler_id" = "CLANG" ||
+      test "$compiler_id" = "APPLECLANG"; then
+      AC_MSG_RESULT([yes])
+      tmp_has_include="no"
+      tmp_chg_FLAGS="$CFLAGS"
+      for word1 in $tmp_chg_FLAGS; do
+        case "$word1" in
+          -I*)
+            tmp_has_include="yes"
+            ;;
+        esac
+      done
+      if test "$tmp_has_include" = "yes"; then
+        tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/^-I/ -isystem /g'`
+        tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/ -I/ -isystem /g'`
+        CFLAGS="$tmp_chg_FLAGS"
+        squeeze CFLAGS
+      fi
+      tmp_has_include="no"
+      tmp_chg_FLAGS="$CPPFLAGS"
+      for word1 in $tmp_chg_FLAGS; do
+        case "$word1" in
+          -I*)
+            tmp_has_include="yes"
+            ;;
+        esac
+      done
+      if test "$tmp_has_include" = "yes"; then
+        tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/^-I/ -isystem /g'`
+        tmp_chg_FLAGS=`echo "$tmp_chg_FLAGS" | "$SED" 's/ -I/ -isystem /g'`
+        CPPFLAGS="$tmp_chg_FLAGS"
+        squeeze CPPFLAGS
+      fi
+    else
+      AC_MSG_RESULT([no])
+    fi
+    ;;
+  esac
 ])
 
 
diff --git a/scripts/Makefile.am b/scripts/Makefile.am
index 7ffa98ed9b..523834b5bb 100644
--- a/scripts/Makefile.am
+++ b/scripts/Makefile.am
@@ -26,10 +26,15 @@ EXTRA_DIST = coverage.sh completion.pl firefox-db2pem.sh checksrc.pl          \
   checksrc-all.pl mk-ca-bundle.pl mk-unity.pl schemetable.c cd2nroff nroff2cd \
   cdall cd2cd managen dmaketgz maketgz release-tools.sh verify-release        \
   cmakelint.sh mdlinkcheck CMakeLists.txt perlcheck.sh pythonlint.sh          \
-  spacecheck.pl randdisable wcurl top-complexity extract-unit-protos          \
+  spacecheck.pl randdisable wcurl-impersonate top-complexity extract-unit-protos \
   .checksrc badwords badwords-all badwords.txt top-length
 
-dist_bin_SCRIPTS = wcurl
+dist_bin_SCRIPTS = wcurl-impersonate
+
+wcurl-impersonate: $(srcdir)/wcurl-impersonate
+	if test "x$(srcdir)" != "x."; then \
+	  cp -f "$(srcdir)/wcurl-impersonate" "$@"; \
+	fi
 
 if USE_ZSH_COMPLETION
 ZSH_COMPLETION_FUNCTION_FILENAME = _curl
diff --git a/scripts/singleuse.pl b/scripts/singleuse.pl
index fc6cc7f111..2cd18b8873 100755
--- a/scripts/singleuse.pl
+++ b/scripts/singleuse.pl
@@ -65,6 +65,7 @@ my %api = (
     'curl_easy_escape' => 'API',
     'curl_easy_getinfo' => 'API',
     'curl_easy_init' => 'API',
+    'curl_easy_impersonate' => 'API',
     'curl_easy_pause' => 'API',
     'curl_easy_perform' => 'API',
     'curl_easy_recv' => 'API',
diff --git a/scripts/wcurl b/scripts/wcurl-impersonate
similarity index 88%
rename from scripts/wcurl
rename to scripts/wcurl-impersonate
index a5c1f95e1c..8a1b6e6d52 100755
--- a/scripts/wcurl
+++ b/scripts/wcurl-impersonate
@@ -1,8 +1,9 @@
 #!/bin/sh
 
-# wcurl - a simple wrapper around curl to easily download files.
+# wcurl-impersonate - a simple wrapper around curl-impersonate to easily
+# download files.
 #
-# Requires curl >= 7.46.0 (2015)
+# Requires curl-impersonate >= 7.46.0 (2015)
 #
 # Copyright (C) Samuel Henrique <samueloph@debian.org>, Sergio Durigan
 # Junior <sergiodj@debian.org> and many contributors, see the AUTHORS
@@ -46,7 +47,7 @@ _EOF_
 usage()
 {
     cat << _EOF_
-${PROGRAM_NAME} -- a simple wrapper around curl to easily download files.
+${PROGRAM_NAME} -- a simple wrapper around curl-impersonate to easily download files.
 
 Usage: ${PROGRAM_NAME} <URL>...
        ${PROGRAM_NAME} [--curl-options <CURL_OPTIONS>]... [--no-decode-filename] [-o|-O|--output <PATH>] [--dry-run] [--] <URL>...
@@ -56,29 +57,32 @@ Usage: ${PROGRAM_NAME} <URL>...
 
 Options:
 
-  --curl-options <CURL_OPTIONS>: Specify extra options to be passed when invoking curl. May be
-                                 specified more than once.
+  --curl-options <CURL_OPTIONS>: Specify extra options to be passed when invoking
+                                 curl-impersonate. May be specified more than once.
 
   -o, -O, --output <PATH>: Use the provided output path instead of getting it from the URL. If
                            multiple URLs are provided, resulting files share the same name with a
-                           number appended to the end (curl >= 7.83.0). If this option is provided
-                           multiple times, only the last value is considered.
+                           number appended to the end (curl-impersonate >= 7.83.0).
+                           If this option is provided multiple times, only the last
+                           value is considered.
 
   --no-decode-filename: Do not percent-decode the output filename, even if the percent-encoding in
-                        the URL was done by wcurl, e.g.: The URL contained whitespace.
+                        the URL was done by ${PROGRAM_NAME}, e.g.: The URL contained whitespace.
 
-  --dry-run: Do not actually execute curl, only print what would be invoked.
+  --dry-run: Do not actually execute curl-impersonate, only print what would be invoked.
 
   -V, --version: Print version information.
 
   -h, --help: Print this usage message.
 
-  <CURL_OPTIONS>: Any option supported by curl can be set here. This is not used by wcurl; it is
-                 instead forwarded to the curl invocation.
+  <CURL_OPTIONS>: Any option supported by curl-impersonate can be set here. This
+                 is not used by ${PROGRAM_NAME}; it is instead forwarded to the
+                 curl-impersonate invocation.
 
   <URL>: URL to be downloaded. Anything that is not a parameter is considered
-         an URL. Whitespace is percent-encoded and the URL is passed to curl, which
-         then performs the parsing. May be specified more than once.
+         an URL. Whitespace is percent-encoded and the URL is passed to
+         curl-impersonate, which then performs the parsing. May be specified
+         more than once.
 _EOF_
 }
 
@@ -89,7 +93,7 @@ error()
     exit 1
 }
 
-# Extra curl options provided by the user.
+# Extra curl-impersonate options provided by the user.
 # This is set per-URL for every URL provided.
 # Some options are global, but we are erroring on the side of needlessly setting
 # them multiple times instead of causing issues with parameters that needs to
@@ -104,7 +108,7 @@ URLS=""
 OUTPUT_PATH=""
 HAS_USER_SET_OUTPUT="false"
 
-# The parameters that are passed per-URL to curl.
+# The parameters that are passed per-URL to curl-impersonate.
 readonly PER_URL_PARAMETERS="\
     --fail \
     --globoff \
@@ -121,7 +125,7 @@ readonly PER_URL_PARAMETERS="\
 # 3A = :
 readonly UNSAFE_PERCENT_ENCODE="%2F %5C %3A"
 
-# Whether to invoke curl or not.
+# Whether to invoke curl-impersonate or not.
 DRY_RUN="false"
 
 # Sanitize parameters.
@@ -200,10 +204,10 @@ get_url_filename()
     # No slash means there was only a hostname and no path; return empty string.
 }
 
-# Execute curl with the list of URLs provided by the user.
+# Execute curl-impersonate with the list of URLs provided by the user.
 exec_curl()
 {
-    CMD="curl "
+    CMD="curl-impersonate "
 
     # Store version to check if it supports --no-clobber, --parallel and --parallel-max-host.
     curl_version=$($CMD --version | cut -f2 -d' ' | head -n1)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 1f76839009..b5fc35f8a2 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -21,7 +21,7 @@
 # SPDX-License-Identifier: curl
 #
 ###########################################################################
-
+set(EXE_NAME curl-impersonate)
 set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "${CURL_DEBUG_MACROS}")
 
 set(_curl_cfiles_gen "")
diff --git a/src/Makefile.am b/src/Makefile.am
index 69554ee490..d0052604bd 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -46,7 +46,7 @@ AM_CPPFLAGS = -I$(top_srcdir)/include        \
               -I$(top_srcdir)/lib            \
               -I$(srcdir)
 
-bin_PROGRAMS = curl
+bin_PROGRAMS = curl-impersonate
 
 curlinfo_SOURCES = curlinfo.c
 noinst_PROGRAMS = curlinfo
@@ -79,18 +79,18 @@ if USE_UNITY
 curltool_unity.c: $(top_srcdir)/scripts/mk-unity.pl $(CURL_CFILES) $(curl_cfiles_gen) $(curlx_csrc)
 	@PERL@ $(top_srcdir)/scripts/mk-unity.pl --include $(CURL_CFILES) $(curl_cfiles_gen) $(curlx_csrc) > curltool_unity.c
 
-nodist_curl_SOURCES = curltool_unity.c
-curl_SOURCES =
+nodist_curl_impersonate_SOURCES = curltool_unity.c
+curl_impersonate_SOURCES =
 CLEANFILES += curltool_unity.c
 else
-curl_SOURCES = $(CURL_CFILES) $(CURL_HFILES) $(curl_cfiles_gen) $(curl_hfiles_gen) $(curlx_csrc) $(curlx_hsrc)
+curl_impersonate_SOURCES = $(CURL_CFILES) $(CURL_HFILES) $(curl_cfiles_gen) $(curl_hfiles_gen) $(curlx_csrc) $(curlx_hsrc)
 endif
 if HAVE_WINDRES
-curl_SOURCES += $(CURL_RCFILES)
+curl_impersonate_SOURCES += $(CURL_RCFILES)
 $(CURL_RCFILES): tool_version.h
 endif
 
-curl_LDFLAGS = $(CURL_LDFLAGS_BIN) $(UNICODEFLAG)
+curl_impersonate_LDFLAGS = $(CURL_LDFLAGS_BIN) $(UNICODEFLAG)
 
 # This might hold -Werror
 CFLAGS += @CURL_CFLAG_EXTRAS@
@@ -98,7 +98,7 @@ CFLAGS += @CURL_CFLAG_EXTRAS@
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-curl_LDADD = $(top_builddir)/lib/libcurl.la @LIBCURL_PC_LIBS_PRIVATE@
+curl_impersonate_LDADD = $(top_builddir)/lib/libcurl-impersonate.la @LIBCURL_PC_LIBS_PRIVATE@
 
 # if unit tests are enabled, build a static library to link them with
 if BUILD_UNITTESTS
diff --git a/src/config2setopts.c b/src/config2setopts.c
index 8933668a2c..98b8a70847 100644
--- a/src/config2setopts.c
+++ b/src/config2setopts.c
@@ -383,6 +383,9 @@ static CURLcode ssl_setopts(struct OperationConfig *config, CURL *curl)
 
   if(config->ssl_ec_curves)
     MY_SETOPT_STR(curl, CURLOPT_SSL_EC_CURVES, config->ssl_ec_curves);
+  if(config->http3_ssl_ec_curves)
+    MY_SETOPT_STR(curl, CURLOPT_HTTP3_SSL_EC_CURVES,
+                  config->http3_ssl_ec_curves);
 
   if(config->ssl_signature_algorithms)
     MY_SETOPT_STR(curl, CURLOPT_SSL_SIGNATURE_ALGORITHMS,
@@ -422,9 +425,11 @@ static CURLcode ssl_setopts(struct OperationConfig *config, CURL *curl)
   if(config->doh_verifystatus)
     my_setopt_long(curl, CURLOPT_DOH_SSL_VERIFYSTATUS, 1);
 
-  my_setopt_SSLVERSION(curl, CURLOPT_SSLVERSION,
-                       tlsversion(config->ssl_version,
-                                  config->ssl_version_max));
+  /* Only set the version when requested, so impersonation can provide it. */
+  if(config->ssl_version || config->ssl_version_max)
+    my_setopt_SSLVERSION(curl, CURLOPT_SSLVERSION,
+                         tlsversion(config->ssl_version,
+                                    config->ssl_version_max));
   if(config->proxy)
     my_setopt_SSLVERSION(curl, CURLOPT_PROXY_SSLVERSION,
                          config->proxy_ssl_version);
@@ -479,6 +484,53 @@ static CURLcode ssl_setopts(struct OperationConfig *config, CURL *curl)
             "--proxy-tls13-ciphers", ssl_backend());
   }
 
+  if(config->ssl_cert_compression)
+    my_setopt_str(curl, CURLOPT_SSL_CERT_COMPRESSION,
+                  config->ssl_cert_compression);
+  if(config->ws_ssl_cert_compression)
+    my_setopt_str(curl, CURLOPT_WS_SSL_CERT_COMPRESSION,
+                  config->ws_ssl_cert_compression);
+
+  if(config->ssl_permute_extensions)
+    my_setopt_long(curl, CURLOPT_SSL_PERMUTE_EXTENSIONS, 1L);
+
+  if(config->tls_grease)
+    my_setopt_long(curl, CURLOPT_TLS_GREASE, 1L);
+
+  if(config->tls_extension_order)
+    my_setopt_str(curl, CURLOPT_TLS_EXTENSION_ORDER, config->tls_extension_order);
+
+  if (config->tls_use_new_alps_codepoint)
+    my_setopt_long(curl, CURLOPT_TLS_USE_NEW_ALPS_CODEPOINT, 1L);
+
+  if(config->tls_delegated_credentials)
+    my_setopt_str(curl, CURLOPT_TLS_DELEGATED_CREDENTIALS, config->tls_delegated_credentials);
+ 
+  if(config->tls_record_size_limit)
+    my_setopt_long(curl, CURLOPT_TLS_RECORD_SIZE_LIMIT,
+                   config->tls_record_size_limit);
+ 
+  if(config->tls_key_shares_limit)
+    my_setopt_long(curl, CURLOPT_TLS_KEY_SHARES_LIMIT,
+                   config->tls_key_shares_limit);
+
+  if(config->alps) {
+    my_setopt_long(curl, CURLOPT_SSL_ENABLE_ALPS, 1L);
+  }
+
+  if (config->noticket) {
+    my_setopt_long(curl, CURLOPT_SSL_ENABLE_TICKET, 0L);
+  }
+  if(config->ws_disable_session_ticket)
+    my_setopt_long(curl, CURLOPT_WS_SSL_DISABLE_TICKET, 1L);
+
+  if(config->tls_signed_cert_timestamps) {
+    my_setopt_long(curl, CURLOPT_TLS_SIGNED_CERT_TIMESTAMPS, 1L);
+  }
+
+  my_setopt_long(curl, CURLOPT_TLS_STATUS_REQUEST, 1L);
+  /* end of curl-impersonate */
+
   /* curl 7.16.0 */
   if(config->disable_sessionid)
     /* disable it */
@@ -552,6 +604,9 @@ static CURLcode cookie_setopts(struct OperationConfig *config, CURL *curl)
     MY_SETOPT_STR(curl, CURLOPT_COOKIEJAR, config->cookiejar);
 
   my_setopt_long(curl, CURLOPT_COOKIESESSION, config->cookiesession);
+  my_setopt_long(curl, CURLOPT_SPLIT_COOKIES, config->split_cookies);
+  if(config->form_boundary)
+    MY_SETOPT_STR(curl, CURLOPT_FORM_BOUNDARY, config->form_boundary);
 
   return result;
 }
@@ -604,6 +659,79 @@ static CURLcode http_setopts(struct OperationConfig *config, CURL *curl,
   if(config->hsts)
     MY_SETOPT_STR(curl, CURLOPT_HSTS, config->hsts);
 
+  /* curl-impersonate */
+  if(config->http2_no_priority)
+    my_setopt_long(curl, CURLOPT_HTTP2_NO_PRIORITY,
+                   config->http2_no_priority);
+
+  if(config->http2_pseudo_headers_order)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP2_PSEUDO_HEADERS_ORDER,
+                  config->http2_pseudo_headers_order);
+
+  if(config->http_header_order)
+    my_setopt_str(curl,
+                  CURLOPT_HTTPHEADER_ORDER,
+                  config->http_header_order);
+
+  if(config->http2_settings)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP2_SETTINGS,
+                  config->http2_settings);
+
+  if(config->http2_window_update)
+    my_setopt_long(curl, CURLOPT_HTTP2_WINDOW_UPDATE,
+                   config->http2_window_update);
+
+  if(config->http2_stream_exclusive)
+    my_setopt_long(curl, CURLOPT_STREAM_EXCLUSIVE,
+                   config->http2_stream_exclusive);
+
+  if(config->http2_stream_weight)
+    my_setopt_long(curl, CURLOPT_STREAM_WEIGHT,
+                   config->http2_stream_weight);
+
+  if(config->http2_streams)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP2_STREAMS,
+                  config->http2_streams);
+
+  if(config->http3_pseudo_headers_order)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP3_PSEUDO_HEADERS_ORDER,
+                  config->http3_pseudo_headers_order);
+
+  if(config->http3_http_header_order)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP3_HTTPHEADER_ORDER,
+                  config->http3_http_header_order);
+
+  if(config->http3_settings)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP3_SETTINGS,
+                  config->http3_settings);
+
+  if(config->http3_sig_hash_algs)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP3_SIG_HASH_ALGS,
+                  config->http3_sig_hash_algs);
+
+  if(config->ws_http_header_order)
+    my_setopt_str(curl,
+                  CURLOPT_WS_HTTPHEADER_ORDER,
+                  config->ws_http_header_order);
+
+  if(config->http3_tls_extension_order)
+    my_setopt_str(curl,
+                  CURLOPT_HTTP3_TLS_EXTENSION_ORDER,
+                  config->http3_tls_extension_order);
+
+  if(config->quic_transport_parameters)
+    my_setopt_str(curl,
+                  CURLOPT_QUIC_TRANSPORT_PARAMETERS,
+                  config->quic_transport_parameters);
+  /* end of curl-impersonate */
+
   if(config->expect100timeout_ms > 0)
     my_setopt_long(curl, CURLOPT_EXPECT_100_TIMEOUT_MS,
                    config->expect100timeout_ms);
@@ -773,6 +901,10 @@ static CURLcode proxy_setopts(struct OperationConfig *config, CURL *curl)
   if(config->haproxy_clientip)
     MY_SETOPT_STR(curl, CURLOPT_HAPROXY_CLIENT_IP, config->haproxy_clientip);
 
+  /* curl-impersonate */
+  if(config->proxy_credential_no_reuse)
+    my_setopt_long(curl, CURLOPT_PROXY_CREDENTIAL_NO_REUSE, 1L);
+
   return result;
 }
 
@@ -926,11 +1058,13 @@ CURLcode config2setopts(struct OperationConfig *config,
     my_setopt_bitmask(curl, CURLOPT_HTTPAUTH, config->authtype);
 
   my_setopt_slist(curl, CURLOPT_HTTPHEADER, config->headers);
+  my_setopt_slist(curl, CURLOPT_HTTP3_HTTPHEADER, config->http3_headers);
+  my_setopt_slist(curl, CURLOPT_WS_HTTPHEADER, config->ws_headers);
 
   if(proto_http || proto_rtsp) {
     MY_SETOPT_STR(curl, CURLOPT_REFERER, config->referer);
-    MY_SETOPT_STR(curl, CURLOPT_USERAGENT, config->useragent ?
-                  config->useragent : CURL_NAME "/" CURL_VERSION);
+    if(config->useragent)
+      MY_SETOPT_STR(curl, CURLOPT_USERAGENT, config->useragent);
   }
 
   result = http_setopts(config, curl, use_proto);
@@ -939,6 +1073,13 @@ CURLcode config2setopts(struct OperationConfig *config,
   if(result)
     return result;
 
+  /* curl-impersonate: apply after HTTP version/options are configured */
+  if(config->impersonate) {
+    result = my_setopt_str(curl, CURLOPT_IMPERSONATE, config->impersonate);
+    if(result)
+      return result;
+  }
+
   my_setopt_long(curl, CURLOPT_LOW_SPEED_LIMIT, config->low_speed_limit);
   my_setopt_long(curl, CURLOPT_LOW_SPEED_TIME, config->low_speed_time);
   my_setopt_offt(curl, CURLOPT_MAX_SEND_SPEED_LARGE, config->sendpersecond);
diff --git a/src/tool_cfgable.c b/src/tool_cfgable.c
index 3feb3e7824..41722dcb4a 100644
--- a/src/tool_cfgable.c
+++ b/src/tool_cfgable.c
@@ -106,6 +106,25 @@ static void free_config_fields(struct OperationConfig *config)
   curlx_safefree(config->proto_str);
   curlx_safefree(config->proto_redir_str);
 
+  /* curl-impersonate */
+  curlx_safefree(config->ssl_signature_algorithms);
+  curlx_safefree(config->ssl_cert_compression);
+  curlx_safefree(config->ws_ssl_cert_compression);
+  curlx_safefree(config->http_header_order);
+  curlx_safefree(config->http2_pseudo_headers_order);
+  curlx_safefree(config->http2_settings);
+  curlx_safefree(config->http2_streams);
+  curlx_safefree(config->http3_pseudo_headers_order);
+  curlx_safefree(config->http3_settings);
+  curlx_safefree(config->http3_http_header_order);
+  curlx_safefree(config->http3_ssl_ec_curves);
+  curlx_safefree(config->http3_sig_hash_algs);
+  curlx_safefree(config->http3_tls_extension_order);
+  curlx_safefree(config->quic_transport_parameters);
+  curlx_safefree(config->ws_http_header_order);
+  curlx_safefree(config->tls_extension_order);
+  curlx_safefree(config->impersonate);
+
   urlnode = config->url_list;
   while(urlnode) {
     struct getout *next = urlnode->next;
@@ -154,7 +173,7 @@ static void free_config_fields(struct OperationConfig *config)
   curlx_safefree(config->etag_save_file);
   curlx_safefree(config->etag_compare_file);
   curlx_safefree(config->ssl_ec_curves);
-  curlx_safefree(config->ssl_signature_algorithms);
+  curlx_safefree(config->form_boundary);
   curlx_safefree(config->request_target);
   curlx_safefree(config->customrequest);
   curlx_safefree(config->krblevel);
@@ -169,6 +188,8 @@ static void free_config_fields(struct OperationConfig *config)
   curl_slist_free_all(config->prequote);
 
   curl_slist_free_all(config->headers);
+  curl_slist_free_all(config->http3_headers);
+  curl_slist_free_all(config->ws_headers);
   curl_slist_free_all(config->proxyheaders);
 
   curl_mime_free(config->mimepost);
diff --git a/src/tool_cfgable.h b/src/tool_cfgable.h
index 0f8bc6fe08..d961a8943d 100644
--- a/src/tool_cfgable.h
+++ b/src/tool_cfgable.h
@@ -124,6 +124,7 @@ struct OperationConfig {
   char *proxy_key_type;
   char *key_passwd;
   char *proxy_key_passwd;
+  bool proxy_credential_no_reuse;
   char *pubkey;
   char *hostpubmd5;
   char *hostpubsha256;
@@ -132,15 +133,45 @@ struct OperationConfig {
   char *etag_compare_file;
   char *customrequest;
   char *ssl_ec_curves;
+  char *ssl_cert_compression;
+  char *ws_ssl_cert_compression;
   char *ssl_signature_algorithms;
+  char *form_boundary;
   char *krblevel;
   char *request_target;
+  char *http_header_order;
+  char *http2_pseudo_headers_order;
+  char *http2_settings;
+  long http2_window_update;
+  long http2_stream_weight;
+  long http2_stream_exclusive;
+  char *http2_streams;
+  char *http3_pseudo_headers_order;
+  char *http3_settings;
+  char *http3_http_header_order;
+  char *http3_ssl_ec_curves;
+  char *http3_sig_hash_algs;
+  char *http3_tls_extension_order;
+  char *quic_transport_parameters;
+  char *ws_http_header_order;
+  bool ws_disable_session_ticket;
+  char *impersonate;
+  bool http2_no_priority;
+  bool tls_grease;
+  char *tls_extension_order;
+  char *tls_delegated_credentials;
+  long tls_record_size_limit;
+  long tls_key_shares_limit;
+  bool tls_use_new_alps_codepoint;
   char *writeout;           /* %-styled format string to output */
   char *httpgetfields;
   struct curl_slist *quote;
   struct curl_slist *postquote;
   struct curl_slist *prequote;
+  bool ssl_permute_extensions;
   struct curl_slist *headers;
+  struct curl_slist *http3_headers;
+  struct curl_slist *ws_headers;
   struct curl_slist *proxyheaders;
   struct tool_mime *mimeroot;
   struct tool_mime *mimecurrent;
@@ -194,6 +225,9 @@ struct OperationConfig {
   long alivetime;           /* keepalive-time */
   long alivecnt;            /* keepalive-cnt */
   long gssapi_delegation;
+  bool alps;                      /* enable/disable TLS ALPS extension */
+  bool noticket;                  /* enable/disable TLS session ticket */
+  bool tls_signed_cert_timestamps;    /* curl-impersonate: enable extension 18 */
   long expect100timeout_ms;
   long happy_eyeballs_timeout_ms; /* happy eyeballs timeout in milliseconds.
                                      0 is valid. default: CURL_HET_DEFAULT. */
@@ -220,6 +254,7 @@ struct OperationConfig {
   BIT(remote_name_all);   /* --remote-name-all */
   BIT(remote_time);
   BIT(cookiesession);       /* new session? */
+  BIT(split_cookies);       /* split cookies into separate Cookie headers */
   BIT(encoding);            /* Accept-Encoding please */
   BIT(tr_encoding);         /* Transfer-Encoding please */
   BIT(use_resume);
diff --git a/src/tool_getparam.c b/src/tool_getparam.c
index 35c01b1d92..1cf592678c 100644
--- a/src/tool_getparam.c
+++ b/src/tool_getparam.c
@@ -76,6 +76,7 @@ static ParameterError getstrn(char **str, const char *val,
 static const struct LongShort aliases[]= {
   {"abstract-unix-socket",       ARG_FILE, ' ', C_ABSTRACT_UNIX_SOCKET},
   {"alpn",                       ARG_BOOL|ARG_NO|ARG_TLS, ' ', C_ALPN},
+  {"alps",                       ARG_BOOL, ' ', C_ALPS},  // curl-impersonate
   {"alt-svc",                    ARG_STRG, ' ', C_ALT_SVC},
   {"anyauth",                    ARG_NONE, ' ', C_ANYAUTH},
   {"append",                     ARG_BOOL, 'a', C_APPEND},
@@ -86,6 +87,7 @@ static const struct LongShort aliases[]= {
   {"cacert",                     ARG_FILE|ARG_TLS, ' ', C_CACERT},
   {"capath",                     ARG_FILE|ARG_TLS, ' ', C_CAPATH},
   {"cert",                       ARG_FILE|ARG_TLS|ARG_CLEAR, 'E', C_CERT},
+  {"cert-compression",           ARG_STRG|ARG_TLS, ' ', C_CERT_COMPRESSION},  // curl-impersonate
   {"cert-status",                ARG_BOOL|ARG_TLS, ' ', C_CERT_STATUS},
   {"cert-type",                  ARG_STRG|ARG_TLS, ' ', C_CERT_TYPE},
   {"ciphers",                    ARG_STRG|ARG_TLS, ' ', C_CIPHERS},
@@ -137,6 +139,7 @@ static const struct LongShort aliases[]= {
   {"false-start",                ARG_BOOL, ' ', C_FALSE_START},
   {"follow",                     ARG_BOOL, ' ', C_FOLLOW},
   {"form",                       ARG_STRG, 'F', C_FORM},
+  {"form-boundary",              ARG_STRG, ' ', C_FORM_BOUNDARY},
   {"form-escape",                ARG_BOOL, ' ', C_FORM_ESCAPE},
   {"form-string",                ARG_STRG, ' ', C_FORM_STRING},
   {"ftp-account",                ARG_STRG, ' ', C_FTP_ACCOUNT},
@@ -163,14 +166,30 @@ static const struct LongShort aliases[]= {
   {"hostpubmd5",                 ARG_STRG, ' ', C_HOSTPUBMD5},
   {"hostpubsha256",              ARG_STRG, ' ', C_HOSTPUBSHA256},
   {"hsts",                       ARG_STRG|ARG_TLS, ' ', C_HSTS},
+  {"http-header-order",          ARG_STRG, ' ', C_HTTP_HEADER_ORDER},
   {"http0.9",                    ARG_BOOL, ' ', C_HTTP0_9},
   {"http1.0",                    ARG_NONE, '0', C_HTTP1_0},
   {"http1.1",                    ARG_NONE, ' ', C_HTTP1_1},
   {"http2",                      ARG_NONE, ' ', C_HTTP2},
+  {"http2-no-priority",          ARG_BOOL, ' ', C_HTTP2_NO_PRIORITY},  // curl-impersonate
   {"http2-prior-knowledge",      ARG_NONE, ' ', C_HTTP2_PRIOR_KNOWLEDGE},
+  {"http2-pseudo-headers-order", ARG_STRG, ' ', C_HTTP2_PSEUDO_HEADERS_ORDER},  // curl-impersonate
+  {"http2-settings",             ARG_STRG, ' ', C_HTTP2_SETTINGS},  // curl-impersonate
+  {"http2-stream-exclusive",     ARG_STRG, ' ', C_HTTP2_STREAM_EXCLUSIVE},  // curl-impersonate
+  {"http2-stream-weight",        ARG_STRG, ' ', C_HTTP2_STREAM_WEIGHT},  // curl-impersonate
+  {"http2-streams",              ARG_STRG, ' ', C_HTTP2_STREAMS},  // curl-impersonate
+  {"http2-window-update",        ARG_STRG, ' ', C_HTTP2_WINDOW_UPDATE},  // curl-impersonate
   {"http3",                      ARG_NONE|ARG_TLS, ' ', C_HTTP3},
+  {"http3-curves",               ARG_STRG|ARG_TLS, ' ', C_HTTP3_CURVES},  // curl-impersonate
+  {"http3-httpheader",           ARG_STRG, ' ', C_HTTP3_HTTPHEADER},  // curl-impersonate
+  {"http3-httpheader-order",     ARG_STRG, ' ', C_HTTP3_HTTPHEADER_ORDER},  // curl-impersonate
   {"http3-only",                 ARG_NONE|ARG_TLS, ' ', C_HTTP3_ONLY},
+  {"http3-pseudo-headers-order", ARG_STRG, ' ', C_HTTP3_PSEUDO_HEADERS_ORDER},  // curl-impersonate
+  {"http3-settings",             ARG_STRG, ' ', C_HTTP3_SETTINGS},  // curl-impersonate
+  {"http3-sig-hash-algs",        ARG_STRG, ' ', C_HTTP3_SIG_HASH_ALGS},  // curl-impersonate
+  {"http3-tls-extension-order",  ARG_STRG, ' ', C_HTTP3_TLS_EXTENSION_ORDER},  // curl-impersonate
   {"ignore-content-length",      ARG_BOOL, ' ', C_IGNORE_CONTENT_LENGTH},
+  {"impersonate",                ARG_STRG, ' ', C_IMPERSONATE},
   {"include",                    ARG_BOOL, ' ', C_INCLUDE},
   {"insecure",                   ARG_BOOL, 'k', C_INSECURE},
   {"interface",                  ARG_STRG, ' ', C_INTERFACE},
@@ -195,6 +214,7 @@ static const struct LongShort aliases[]= {
   {"list-only",                  ARG_BOOL, 'l', C_LIST_ONLY},
   {"local-port",                 ARG_STRG, ' ', C_LOCAL_PORT},
   {"location",                   ARG_BOOL, 'L', C_LOCATION},
+  {"location-safe",              ARG_BOOL, ' ', C_LOCATION_SAFE},
   {"location-trusted",           ARG_BOOL, ' ', C_LOCATION_TRUSTED},
   {"login-options",              ARG_STRG, ' ', C_LOGIN_OPTIONS},
   {"mail-auth",                  ARG_STRG, ' ', C_MAIL_AUTH},
@@ -246,6 +266,7 @@ static const struct LongShort aliases[]= {
    C_PROXY_CERT},
   {"proxy-cert-type",            ARG_STRG|ARG_TLS, ' ', C_PROXY_CERT_TYPE},
   {"proxy-ciphers",              ARG_STRG|ARG_TLS, ' ', C_PROXY_CIPHERS},
+  {"proxy-credential-no-reuse",  ARG_BOOL|ARG_TLS, ' ', C_PROXY_CREDENTIAL_NO_REUSE},
   {"proxy-crlfile",              ARG_FILE|ARG_TLS, ' ', C_PROXY_CRLFILE},
   {"proxy-digest",               ARG_BOOL, ' ', C_PROXY_DIGEST},
   {"proxy-header",               ARG_STRG, ' ', C_PROXY_HEADER},
@@ -272,6 +293,7 @@ static const struct LongShort aliases[]= {
   {"proxy1.0",                   ARG_STRG, ' ', C_PROXY1_0},
   {"proxytunnel",                ARG_BOOL, 'p', C_PROXYTUNNEL},
   {"pubkey",                     ARG_STRG, ' ', C_PUBKEY},
+  {"quic-transport-params",      ARG_STRG|ARG_TLS, ' ', C_QUIC_TRANSPORT_PARAMETERS},  // curl-impersonate
   {"quote",                      ARG_STRG, 'Q', C_QUOTE},
   {"random-file",                ARG_FILE|ARG_DEPR, ' ', C_RANDOM_FILE},
   {"range",                      ARG_STRG, 'r', C_RANGE},
@@ -297,8 +319,8 @@ static const struct LongShort aliases[]= {
   {"sessionid",                  ARG_BOOL|ARG_NO, ' ', C_SESSIONID},
   {"show-error",                 ARG_BOOL, 'S', C_SHOW_ERROR},
   {"show-headers",               ARG_BOOL, 'i', C_SHOW_HEADERS},
-  {"sigalgs",                    ARG_STRG|ARG_TLS, ' ',
-   C_SIGNATURE_ALGORITHMS},
+  {"sigalgs",                    ARG_STRG|ARG_TLS, ' ', C_SIGNATURE_ALGORITHMS},
+  {"signature-hashes",           ARG_STRG, ' ', C_SIGNATURE_HASHES}, // curl-impersonate
   {"silent",                     ARG_BOOL, 's', C_SILENT},
   {"skip-existing",              ARG_BOOL, ' ', C_SKIP_EXISTING},
   {"socks4",                     ARG_STRG, ' ', C_SOCKS4},
@@ -311,6 +333,7 @@ static const struct LongShort aliases[]= {
   {"socks5-hostname",            ARG_STRG, ' ', C_SOCKS5_HOSTNAME},
   {"speed-limit",                ARG_UNUM, 'Y', C_SPEED_LIMIT},
   {"speed-time",                 ARG_UNUM, 'y', C_SPEED_TIME},
+  {"split-cookies",              ARG_BOOL, ' ', C_SPLIT_COOKIES},
   {"ssl",                        ARG_BOOL|ARG_TLS, ' ', C_SSL},
   {"ssl-allow-beast",            ARG_BOOL|ARG_TLS, ' ', C_SSL_ALLOW_BEAST},
   {"ssl-auto-client-cert",       ARG_BOOL|ARG_TLS, ' ',
@@ -335,8 +358,17 @@ static const struct LongShort aliases[]= {
   {"tftp-blksize",               ARG_UNUM, ' ', C_TFTP_BLKSIZE},
   {"tftp-no-options",            ARG_BOOL, ' ', C_TFTP_NO_OPTIONS},
   {"time-cond",                  ARG_STRG, 'z', C_TIME_COND},
+  {"tls-delegated-credentials",  ARG_STRG, ' ', C_TLS_DELEGATED_CREDENTIALS},  // curl-impersonate
   {"tls-earlydata",              ARG_BOOL|ARG_TLS, ' ', C_TLS_EARLYDATA},
+  {"tls-extension-order",        ARG_STRG, ' ', C_TLS_EXTENSION_ORDER},  // curl-impersonate
+  {"tls-grease",                 ARG_BOOL, ' ', C_TLS_GREASE},  // curl-impersonate
+  {"tls-key-shares-limit",       ARG_STRG, ' ', C_TLS_KEY_SHARES_LIMIT},  // curl-impersonate
   {"tls-max",                    ARG_STRG|ARG_TLS, ' ', C_TLS_MAX},
+  {"tls-permute-extensions",     ARG_BOOL, ' ', C_TLS_PERMUTE_EXTENSIONS},  // curl-impersonate
+  {"tls-record-size-limit",      ARG_STRG, ' ', C_TLS_RECORD_SIZE_LIMIT},  // curl-impersonate
+  {"tls-session-ticket",         ARG_BOOL, ' ', C_TLS_SESSION_TICKET},  // curl-impersonate
+  {"tls-signed-cert-timestamps", ARG_BOOL, ' ', C_TLS_SIGNED_CERT_TIMESTAMPS}, // curl-impersonate
+  {"tls-use-new-alps-codepoint", ARG_BOOL, ' ', C_TLS_USE_NEW_ALPS_CODEPOINT},  // curl-impersonate
   {"tls13-ciphers",              ARG_STRG|ARG_TLS, ' ', C_TLS13_CIPHERS},
   {"tlsauthtype",                ARG_STRG|ARG_TLS, ' ', C_TLSAUTHTYPE},
   {"tlspassword",              ARG_STRG|ARG_TLS|ARG_CLEAR, ' ', C_TLSPASSWORD},
@@ -367,6 +399,10 @@ static const struct LongShort aliases[]= {
 #ifdef USE_WATT32
   {"wdebug",                     ARG_BOOL, ' ', C_WDEBUG},
 #endif
+  {"ws-cert-compression",        ARG_STRG|ARG_TLS, ' ', C_WS_CERT_COMPRESSION},  // curl-impersonate
+  {"ws-disable-session-ticket",  ARG_BOOL, ' ', C_WS_DISABLE_SESSION_TICKET},  // curl-impersonate
+  {"ws-httpheader",              ARG_STRG, ' ', C_WS_HTTPHEADER},  // curl-impersonate
+  {"ws-httpheader-order",        ARG_STRG, ' ', C_WS_HTTPHEADER_ORDER},  // curl-impersonate
   {"write-out",                  ARG_STRG, 'w', C_WRITE_OUT},
   {"xattr",                      ARG_BOOL, ' ', C_XATTR},
 };
@@ -1305,9 +1341,14 @@ static ParameterError parse_header(struct OperationConfig *config,
       curlx_dyn_init(&line, 1024 * 100);
       while(my_get_line(file, &line, &error)) {
         const char *ptr = curlx_dyn_ptr(&line);
-        err = add2list(cmd == C_PROXY_HEADER ? /* --proxy-header? */
-                       &config->proxyheaders :
-                       &config->headers, ptr);
+        struct curl_slist **headers = &config->headers;
+        if(cmd == C_PROXY_HEADER) /* --proxy-header */
+          headers = &config->proxyheaders;
+        else if(cmd == C_HTTP3_HTTPHEADER) /* --http3-httpheader */
+          headers = &config->http3_headers;
+        else if(cmd == C_WS_HTTPHEADER) /* --ws-httpheader */
+          headers = &config->ws_headers;
+        err = add2list(headers, ptr);
         if(err)
           break;
       }
@@ -1325,6 +1366,10 @@ static ParameterError parse_header(struct OperationConfig *config,
     }
     if(cmd == C_PROXY_HEADER) /* --proxy-header */
       err = add2list(&config->proxyheaders, nextarg);
+    else if(cmd == C_HTTP3_HTTPHEADER) /* --http3-httpheader */
+      err = add2list(&config->http3_headers, nextarg);
+    else if(cmd == C_WS_HTTPHEADER) /* --ws-httpheader */
+      err = add2list(&config->ws_headers, nextarg);
     else
       err = add2list(&config->headers, nextarg);
   }
@@ -1834,6 +1879,9 @@ static ParameterError opt_bool(struct OperationConfig *config,
   case C_ALPN: /* --alpn */
     config->noalpn = !toggle;
     break;
+  case C_ALPS:  /* --alps curl-impersonate */
+    config->alps = toggle;
+    break;
   case C_DISABLE_EPSV: /* --disable-epsv */
     config->disable_epsv = toggle;
     break;
@@ -2009,6 +2057,29 @@ static ParameterError opt_bool(struct OperationConfig *config,
   case C_TLS_EARLYDATA: /* --tls-earlydata */
     config->ssl_allow_earlydata = toggle;
     break;
+  case C_TLS_SIGNED_CERT_TIMESTAMPS:
+    config->tls_signed_cert_timestamps = toggle;
+    break;
+  case C_TLS_SESSION_TICKET:  /* --tls-session-ticket curl-impersonate */
+    config->noticket = (!toggle)?TRUE:FALSE;
+    break;
+  case C_WS_DISABLE_SESSION_TICKET:  /* --ws-disable-session-ticket curl-impersonate */
+    config->ws_disable_session_ticket = toggle;
+    break;
+  case C_TLS_PERMUTE_EXTENSIONS:  /* --tls-permute-extensions curl-impersonate */
+    config->ssl_permute_extensions = toggle;
+    break;
+  case C_TLS_GREASE:  /* --tls-grease curl-impersonate */
+    config->tls_grease = toggle;
+    break;
+  case C_TLS_USE_NEW_ALPS_CODEPOINT: /* --tls-use-new-alps-codepoint curl-impersonate */
+    config->tls_use_new_alps_codepoint = toggle;
+    break;
+  case C_HTTP2_NO_PRIORITY:
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    config->http2_no_priority = toggle;
+    break;
   case C_SUPPRESS_CONNECT_HEADERS: /* --suppress-connect-headers */
     config->suppress_connect_headers = toggle;
     break;
@@ -2135,6 +2206,9 @@ static ParameterError opt_bool(struct OperationConfig *config,
   case C_JUNK_SESSION_COOKIES: /* --junk-session-cookies */
     config->cookiesession = toggle;
     break;
+  case C_SPLIT_COOKIES: /* --split-cookies */
+    config->split_cookies = toggle;
+    break;
   case C_HEAD: /* --head */
     config->no_body = toggle;
     config->show_headers = toggle;
@@ -2154,6 +2228,9 @@ static ParameterError opt_bool(struct OperationConfig *config,
   case C_LIST_ONLY: /* --list-only */
     config->dirlistonly = toggle; /* only list names of the FTP directory */
     break;
+  case C_LOCATION_SAFE: /* --location-safe */
+    config->followlocation = toggle ? CURLFOLLOW_SAFE : 0;
+    break;
   case C_MANUAL: /* --manual */
     if(toggle)   /* --no-manual shows no manual... */
       return PARAM_MANUAL_REQUESTED;
@@ -2213,6 +2290,9 @@ static ParameterError opt_bool(struct OperationConfig *config,
   case C_MPTCP: /* --mptcp */
     config->mptcp = toggle;
     break;
+  case C_PROXY_CREDENTIAL_NO_REUSE: /*  --proxy-credential-no-reuse */
+    config->proxy_credential_no_reuse = toggle;
+    break;
   case C_LOCATION_TRUSTED: /* --location-trusted */
     config->unrestricted_auth = toggle;
     FALLTHROUGH();
@@ -2680,6 +2760,104 @@ static ParameterError opt_string(struct OperationConfig *config,
       err = PARAM_BAD_USE;
     }
     break;
+  case C_TLS_RECORD_SIZE_LIMIT:
+    err = str2unum(&config->tls_record_size_limit, nextarg);
+    break;
+  case C_TLS_KEY_SHARES_LIMIT:
+    err = str2unum(&config->tls_key_shares_limit, nextarg);
+    break;
+  case C_TLS_EXTENSION_ORDER:  /* --tls-extension-order curl-impersonate */
+    err = getstr(&config->tls_extension_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_TLS_DELEGATED_CREDENTIALS:
+    err = getstr(&config->tls_delegated_credentials, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP2_PSEUDO_HEADERS_ORDER: /* --http2-pseudo-headers-order curl-impersonate */
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http2_pseudo_headers_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP_HEADER_ORDER: /* --http-header-order curl-impersonate */
+    err = getstr(&config->http_header_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP2_SETTINGS:  /* --http2-settings curl-impersonate */
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http2_settings, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP2_STREAM_EXCLUSIVE:
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = str2num(&config->http2_stream_exclusive, nextarg);
+    if(config->http2_stream_exclusive < 0) return PARAM_BAD_NUMERIC;
+    break;
+  case C_HTTP2_STREAM_WEIGHT:
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = str2num(&config->http2_stream_weight, nextarg);
+    if(config->http2_stream_weight < 0) return PARAM_BAD_NUMERIC;
+    break;
+  case C_HTTP2_WINDOW_UPDATE:  /* --http2-window-update curl-impersonate */
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = str2num(&config->http2_window_update, nextarg);
+    if(config->http2_window_update < -1) return PARAM_BAD_NUMERIC;
+    break;
+  case C_HTTP2_STREAMS:  /* --http2-streams curl-impersonate */
+    if(!feature_http2)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http2_streams, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP3_PSEUDO_HEADERS_ORDER: /* --http3-pseudo-headers-order curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http3_pseudo_headers_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP3_HTTPHEADER_ORDER: /* --http3-httpheader-order curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http3_http_header_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP3_SETTINGS:  /* --http3-settings curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http3_settings, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP3_CURVES:  /* --http3-curves curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http3_ssl_ec_curves, nextarg, DENY_BLANK);
+    break;
+  case C_HTTP3_SIG_HASH_ALGS:  /* --http3-sig-hash-algs curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http3_sig_hash_algs, nextarg, ALLOW_BLANK);
+    break;
+  case C_HTTP3_TLS_EXTENSION_ORDER:  /* --http3-tls-extension-order curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->http3_tls_extension_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_WS_HTTPHEADER_ORDER:  /* --ws-httpheader-order curl-impersonate */
+    err = getstr(&config->ws_http_header_order, nextarg, ALLOW_BLANK);
+    break;
+  case C_QUIC_TRANSPORT_PARAMETERS:  /* --quic-transport-params curl-impersonate */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = getstr(&config->quic_transport_parameters, nextarg, ALLOW_BLANK);
+    break;
+  case C_CERT_COMPRESSION:  /* --cert-compression curl-impersonate */
+    err = getstr(&config->ssl_cert_compression, nextarg, ALLOW_BLANK);
+    break;
+  case C_WS_CERT_COMPRESSION:  /* --ws-cert-compression curl-impersonate */
+    err = getstr(&config->ws_ssl_cert_compression, nextarg, ALLOW_BLANK);
+    break;
+  case C_SIGNATURE_HASHES: /* --signature-hashes */
+    err = getstr(&config->ssl_signature_algorithms, nextarg, ALLOW_BLANK);
+    break;
+  case C_FORM_BOUNDARY: /* --form-boundary */
+    err = getstr(&config->form_boundary, nextarg, DENY_BLANK);
+    break;
   case C_TRACE_CONFIG: /* --trace-config */
     global->trace_set = TRUE;
     if(set_trace_config(nextarg))
@@ -2709,6 +2887,9 @@ static ParameterError opt_string(struct OperationConfig *config,
     else
       err = getstr(&config->hsts, nextarg, ALLOW_BLANK);
     break;
+  case C_IMPERSONATE: /* --impersonate */
+    err = getstr(&config->impersonate, nextarg, DENY_BLANK);
+    break;
   case C_COOKIE: /* --cookie */
     if(strchr(nextarg, '=')) {
       /* A cookie string must have a =-letter */
@@ -2870,8 +3051,14 @@ static ParameterError opt_string(struct OperationConfig *config,
   case C_REQUEST_TARGET: /* --request-target */
     err = getstr(&config->request_target, nextarg, DENY_BLANK);
     break;
+  case C_HTTP3_HTTPHEADER: /* --http3-httpheader */
+    if(!feature_http3)
+      return PARAM_LIBCURL_DOESNT_SUPPORT;
+    err = parse_header(config, (cmdline_t)a->cmd, nextarg);
+    break;
   case C_HEADER: /* --header */
   case C_PROXY_HEADER: /* --proxy-header */
+  case C_WS_HTTPHEADER: /* --ws-httpheader */
     err = parse_header(config, (cmdline_t)a->cmd, nextarg);
     break;
   case C_OUTPUT_DIR: /* --output-dir */
diff --git a/src/tool_getparam.h b/src/tool_getparam.h
index 32476d3776..01084730d2 100644
--- a/src/tool_getparam.h
+++ b/src/tool_getparam.h
@@ -31,6 +31,7 @@
 typedef enum {
   C_ABSTRACT_UNIX_SOCKET,
   C_ALPN,
+  C_ALPS,
   C_ALT_SVC,
   C_ANYAUTH,
   C_APPEND,
@@ -41,6 +42,7 @@ typedef enum {
   C_CACERT,
   C_CAPATH,
   C_CERT,
+  C_CERT_COMPRESSION,
   C_CERT_STATUS,
   C_CERT_TYPE,
   C_CIPHERS,
@@ -92,6 +94,7 @@ typedef enum {
   C_FALSE_START,
   C_FOLLOW,
   C_FORM,
+  C_FORM_BOUNDARY,
   C_FORM_ESCAPE,
   C_FORM_STRING,
   C_FTP_ACCOUNT,
@@ -118,14 +121,30 @@ typedef enum {
   C_HOSTPUBMD5,
   C_HOSTPUBSHA256,
   C_HSTS,
+  C_HTTP_HEADER_ORDER,
   C_HTTP0_9,
   C_HTTP1_0,
   C_HTTP1_1,
   C_HTTP2,
+  C_HTTP2_NO_PRIORITY,
   C_HTTP2_PRIOR_KNOWLEDGE,
+  C_HTTP2_PSEUDO_HEADERS_ORDER,
+  C_HTTP2_SETTINGS,
+  C_HTTP2_STREAM_EXCLUSIVE,
+  C_HTTP2_STREAM_WEIGHT,
+  C_HTTP2_STREAMS,
+  C_HTTP2_WINDOW_UPDATE,
   C_HTTP3,
+  C_HTTP3_CURVES,
+  C_HTTP3_HTTPHEADER,
+  C_HTTP3_HTTPHEADER_ORDER,
   C_HTTP3_ONLY,
+  C_HTTP3_PSEUDO_HEADERS_ORDER,
+  C_HTTP3_SETTINGS,
+  C_HTTP3_SIG_HASH_ALGS,
+  C_HTTP3_TLS_EXTENSION_ORDER,
   C_IGNORE_CONTENT_LENGTH,
+  C_IMPERSONATE,
   C_INCLUDE,
   C_INSECURE,
   C_INTERFACE,
@@ -147,6 +166,7 @@ typedef enum {
   C_LIST_ONLY,
   C_LOCAL_PORT,
   C_LOCATION,
+  C_LOCATION_SAFE,
   C_LOCATION_TRUSTED,
   C_LOGIN_OPTIONS,
   C_MAIL_AUTH,
@@ -197,6 +217,7 @@ typedef enum {
   C_PROXY_CERT,
   C_PROXY_CERT_TYPE,
   C_PROXY_CIPHERS,
+  C_PROXY_CREDENTIAL_NO_REUSE,
   C_PROXY_CRLFILE,
   C_PROXY_DIGEST,
   C_PROXY_HEADER,
@@ -221,6 +242,7 @@ typedef enum {
   C_PROXY1_0,
   C_PROXYTUNNEL,
   C_PUBKEY,
+  C_QUIC_TRANSPORT_PARAMETERS,
   C_QUOTE,
   C_RANDOM_FILE,
   C_RANGE,
@@ -246,6 +268,7 @@ typedef enum {
   C_SESSIONID,
   C_SHOW_ERROR,
   C_SHOW_HEADERS,
+  C_SIGNATURE_HASHES,
   C_SILENT,
   C_SIGNATURE_ALGORITHMS,
   C_SKIP_EXISTING,
@@ -259,6 +282,7 @@ typedef enum {
   C_SOCKS5_HOSTNAME,
   C_SPEED_LIMIT,
   C_SPEED_TIME,
+  C_SPLIT_COOKIES,
   C_SSL,
   C_SSL_ALLOW_BEAST,
   C_SSL_AUTO_CLIENT_CERT,
@@ -280,7 +304,16 @@ typedef enum {
   C_TFTP_NO_OPTIONS,
   C_TIME_COND,
   C_TLS_EARLYDATA,
+  C_TLS_DELEGATED_CREDENTIALS,
+  C_TLS_EXTENSION_ORDER,
+  C_TLS_GREASE,
+  C_TLS_KEY_SHARES_LIMIT,
   C_TLS_MAX,
+  C_TLS_PERMUTE_EXTENSIONS,
+  C_TLS_RECORD_SIZE_LIMIT,
+  C_TLS_SESSION_TICKET,
+  C_TLS_SIGNED_CERT_TIMESTAMPS,
+  C_TLS_USE_NEW_ALPS_CODEPOINT,
   C_TLS13_CIPHERS,
   C_TLSAUTHTYPE,
   C_TLSPASSWORD,
@@ -310,6 +343,10 @@ typedef enum {
   C_VERSION,
   C_VLAN_PRIORITY,
   C_WDEBUG,
+  C_WS_CERT_COMPRESSION,
+  C_WS_DISABLE_SESSION_TICKET,
+  C_WS_HTTPHEADER,
+  C_WS_HTTPHEADER_ORDER,
   C_WRITE_OUT,
   C_XATTR
 } cmdline_t;
diff --git a/src/tool_listhelp.c b/src/tool_listhelp.c
index c0b0af792f..48940e1b8b 100644
--- a/src/tool_listhelp.c
+++ b/src/tool_listhelp.c
@@ -67,6 +67,9 @@ const struct helptxt helptext[] = {
   { "    --cert-status",
     "Verify server cert status OCSP-staple",
     CURLHELP_TLS },
+  { "    --cert-compression <list>",
+    "TLS certificate compression algorithms",
+    CURLHELP_TLS },
   { "    --cert-type <type>",
     "Certificate type (DER/PEM/ENG/PROV/P12)",
     CURLHELP_TLS },
@@ -209,6 +212,9 @@ const struct helptxt helptext[] = {
     "Specify multipart MIME data",
     CURLHELP_HTTP | CURLHELP_UPLOAD | CURLHELP_POST | CURLHELP_IMAP |
     CURLHELP_SMTP },
+  { "    --form-boundary <style>",
+    "Set multipart form boundary style",
+    CURLHELP_HTTP | CURLHELP_UPLOAD | CURLHELP_POST },
   { "    --form-escape",
     "Escape form fields using backslash",
     CURLHELP_HTTP | CURLHELP_UPLOAD | CURLHELP_POST },
@@ -294,18 +300,51 @@ const struct helptxt helptext[] = {
   { "    --http2",
     "Use HTTP/2",
     CURLHELP_HTTP },
+  { "    --http2-pseudo-headers-order <list>",
+    "Set HTTP/2 pseudo-header order",
+    CURLHELP_HTTP },
   { "    --http2-prior-knowledge",
     "Use HTTP/2 without HTTP/1.1 Upgrade",
     CURLHELP_HTTP },
+  { "    --http2-settings <list>",
+    "Set HTTP/2 settings",
+    CURLHELP_HTTP },
+  { "    --http2-window-update <value>",
+    "Set initial HTTP/2 window update",
+    CURLHELP_HTTP },
   { "    --http3",
     "Use HTTP/3",
     CURLHELP_HTTP },
+  { "    --http3-curves <list>",
+    "HTTP/3 TLS key exchange algorithms",
+    CURLHELP_TLS },
+  { "    --http3-httpheader <header/@file>",
+    "Pass HTTP/3-specific header(s) to server",
+    CURLHELP_HTTP },
+  { "    --http3-httpheader-order <list>",
+    "Set HTTP/3 header order",
+    CURLHELP_HTTP },
   { "    --http3-only",
     "Use HTTP/3 only",
     CURLHELP_HTTP },
+  { "    --http3-pseudo-headers-order <list>",
+    "Set HTTP/3 pseudo-header order",
+    CURLHELP_HTTP },
+  { "    --http3-settings <list>",
+    "Set HTTP/3 settings",
+    CURLHELP_HTTP },
+  { "    --http3-sig-hash-algs <list>",
+    "Set HTTP/3 TLS signature algorithms",
+    CURLHELP_TLS },
+  { "    --http3-tls-extension-order <list>",
+    "Set HTTP/3 TLS extension order",
+    CURLHELP_TLS },
   { "    --ignore-content-length",
     "Ignore the size of the remote resource",
     CURLHELP_HTTP | CURLHELP_FTP },
+  { "    --impersonate <target>",
+    "Impersonate a browser or client",
+    CURLHELP_CURL },
   { "-k, --insecure",
     "Allow insecure server connections",
     CURLHELP_TLS | CURLHELP_SFTP | CURLHELP_SCP | CURLHELP_SSH },
@@ -418,6 +457,9 @@ const struct helptxt helptext[] = {
   { "    --no-alpn",
     "Disable the ALPN TLS extension",
     CURLHELP_TLS | CURLHELP_HTTP },
+  { "    --alps",
+    "Enable the ALPS TLS extension",
+    CURLHELP_TLS | CURLHELP_HTTP },
   { "-N, --no-buffer",
     "Disable buffering of the output stream",
     CURLHELP_OUTPUT },
@@ -436,6 +478,12 @@ const struct helptxt helptext[] = {
   { "    --no-sessionid",
     "Disable SSL session-ID reusing",
     CURLHELP_TLS },
+  { "    --no-split-cookies",
+    "Merge cookies into one Cookie header",
+    CURLHELP_HTTP },
+  { "    --no-tls-session-ticket",
+    "Disable the TLS session ticket extension",
+    CURLHELP_TLS },
   { "    --noproxy <no-proxy-list>",
     "List of hosts which do not use proxy",
     CURLHELP_PROXY },
@@ -530,6 +578,9 @@ const struct helptxt helptext[] = {
   { "    --proxy-ciphers <list>",
     "TLS 1.2 (1.1, 1.0) ciphers to use for proxy",
     CURLHELP_PROXY | CURLHELP_TLS },
+  { "    --proxy-credential-no-reuse",
+    "Do not reuse connections across proxy credentials",
+    CURLHELP_PROXY | CURLHELP_TLS },
   { "    --proxy-crlfile <file>",
     "Set a CRL list for proxy",
     CURLHELP_PROXY | CURLHELP_TLS },
@@ -660,6 +711,9 @@ const struct helptxt helptext[] = {
   { "    --retry-max-time <seconds>",
     "Retry only within this period",
     CURLHELP_CURL | CURLHELP_TIMEOUT },
+  { "    --quic-transport-params <list>",
+    "Set QUIC transport parameters",
+    CURLHELP_HTTP },
   { "    --sasl-authzid <identity>",
     "Identity for SASL PLAIN authentication",
     CURLHELP_AUTH },
@@ -678,12 +732,18 @@ const struct helptxt helptext[] = {
   { "    --sigalgs <list>",
     "TLS signature algorithms to use",
     CURLHELP_TLS },
+  { "    --signature-hashes <list>",
+    "TLS signature algorithms to use",
+    CURLHELP_TLS },
   { "-s, --silent",
     "Silent mode",
     CURLHELP_IMPORTANT | CURLHELP_VERBOSE },
   { "    --skip-existing",
     "Skip download if local file already exists",
     CURLHELP_CURL | CURLHELP_OUTPUT },
+  { "    --split-cookies",
+    "Send separate Cookie header lines",
+    CURLHELP_HTTP },
   { "    --socks4 <host[:port]>",
     "SOCKS4 proxy on given host + port",
     CURLHELP_PROXY },
@@ -776,6 +836,9 @@ const struct helptxt helptext[] = {
   { "    --tls-max <VERSION>",
     "Maximum allowed TLS version",
     CURLHELP_TLS },
+  { "    --tls-permute-extensions",
+    "Permute TLS extensions in ClientHello",
+    CURLHELP_TLS },
   { "    --tls13-ciphers <list>",
     "TLS 1.3 cipher suites to use",
     CURLHELP_TLS },
@@ -860,6 +923,18 @@ const struct helptxt helptext[] = {
   { "-w, --write-out <format>",
     "Output FORMAT after completion",
     CURLHELP_VERBOSE },
+  { "    --ws-cert-compression <list>",
+    "WebSocket TLS certificate compression",
+    CURLHELP_TLS },
+  { "    --ws-disable-session-ticket",
+    "Disable WebSocket TLS session tickets",
+    CURLHELP_TLS },
+  { "    --ws-httpheader <header/@file>",
+    "Pass WebSocket-specific header(s) to server",
+    CURLHELP_HTTP },
+  { "    --ws-httpheader-order <list>",
+    "Set WebSocket header order",
+    CURLHELP_HTTP },
   { "    --xattr",
     "Store metadata in extended file attributes",
     CURLHELP_OUTPUT },
diff --git a/src/tool_paramhlp.c b/src/tool_paramhlp.c
index 18e2d1a625..66d719a066 100644
--- a/src/tool_paramhlp.c
+++ b/src/tool_paramhlp.c
@@ -649,6 +649,12 @@ long delegation(const char *str)
   return CURLGSSAPI_DELEGATION_NONE;
 }
 
+/* Return an allocated string with the default user agent. */
+static char *my_useragent(void)
+{
+  return curlx_strdup(CURL_NAME "/" CURL_VERSION);
+}
+
 #define isheadersep(x) ((((x) == ':') || ((x) == ';')))
 
 /*
@@ -674,6 +680,7 @@ CURLcode get_args(struct OperationConfig *config, const size_t i)
 {
   CURLcode result = CURLE_OK;
   bool last = (config->next ? FALSE : TRUE);
+  char *env_target = NULL;
 
   if(config->jsoned) {
     ParameterError err = PARAM_OK;
@@ -695,6 +702,17 @@ CURLcode get_args(struct OperationConfig *config, const size_t i)
   if(!result && config->proxyuserpwd)
     result = checkpasswd("proxy", i, last, &config->proxyuserpwd);
 
+  env_target = curl_getenv("CURL_IMPERSONATE");
+
+  /* Check if we have a user agent, do not override impersonate value */
+  if(!result && !config->useragent && !config->impersonate && !env_target) {
+    config->useragent = my_useragent();
+    if(!config->useragent) {
+      errorf("out of memory");
+      result = CURLE_OUT_OF_MEMORY;
+    }
+  }
+  curl_free(env_target);
   return result;
 }
 
diff --git a/src/tool_setopt.c b/src/tool_setopt.c
index 2174571ad4..8a22423dfd 100644
--- a/src/tool_setopt.c
+++ b/src/tool_setopt.c
@@ -156,6 +156,7 @@ const struct NameValue setopt_nv_CURLOPT_FOLLOWLOCATION[] = {
   NV(CURLFOLLOW_ALL),
   NV(CURLFOLLOW_OBEYCODE),
   NV(CURLFOLLOW_FIRSTONLY),
+  NV(CURLFOLLOW_SAFE),
   NVEND,
 };
 
@@ -165,6 +166,9 @@ static const struct NameValue setopt_nv_CURLNONZERODEFAULTS[] = {
   NV1(CURLOPT_SSL_VERIFYHOST, 1),
   NV1(CURLOPT_SSL_ENABLE_NPN, 1),
   NV1(CURLOPT_SSL_ENABLE_ALPN, 1),
+  NV1(CURLOPT_SSL_ENABLE_TICKET, 1),
+  NV1(CURLOPT_SSL_PERMUTE_EXTENSIONS, 1),
+  NV1(CURLOPT_TLS_STATUS_REQUEST, 1),
   NV1(CURLOPT_TCP_NODELAY, 1),
   NV1(CURLOPT_PROXY_SSL_VERIFYPEER, 1),
   NV1(CURLOPT_PROXY_SSL_VERIFYHOST, 1),