diff --git a/.dev-config.yml b/.dev-config.yml
index 39b3d1a..2ddd0e2 100644
--- a/.dev-config.yml
+++ b/.dev-config.yml
@@ -23,7 +23,7 @@ service:
             value: ""
   gemini:
     proxied_domains:
-      localhost:
+      mediocregopher.com:
         url: gemini://127.0.0.1:1965
   passphrase: foobar
   dns_records:
diff --git a/Cargo.lock b/Cargo.lock
index 4507cfa..e4d1894 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2964,8 +2964,7 @@ dependencies = [
 [[package]]
 name = "tokio-rustls"
 version = "0.24.1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c28327cf380ac148141087fbfb9de9d7bd4e84ab5d2c28fbc911d753de8a7081"
+source = "git+https://code.betamike.com/micropelago/tokio-rustls.git?branch=transparent-acceptor#18fd688b335430e17e054e15ff7d6ce073db2419"
 dependencies = [
  "rustls",
  "tokio",
diff --git a/Cargo.toml b/Cargo.toml
index ecc3faf..1b48bda 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -45,3 +45,6 @@ serde_yaml = "0.9.22"
 rand = "0.8.5"
 reqwest = "0.11.18"
 hyper-reverse-proxy = "0.5.1"
+
+[patch.crates-io]
+tokio-rustls = { git = "https://code.betamike.com/micropelago/tokio-rustls.git", branch = "transparent-acceptor" }
diff --git a/flake.nix b/flake.nix
index b5d32cf..c500ab0 100644
--- a/flake.nix
+++ b/flake.nix
@@ -45,7 +45,7 @@
             pkgs.openssl
             toolchain
 
-            pkgs.gmni
+            pkgs.nmap # ncat
           ];
           shellHook = ''
             source $(pwd)/.env.dev
diff --git a/src/service/gemini.rs b/src/service/gemini.rs
index 7ddcc00..f5f2c26 100644
--- a/src/service/gemini.rs
+++ b/src/service/gemini.rs
@@ -36,11 +36,14 @@ impl Service {
         service
     }
 
-    async fn proxy_conn(
+    async fn proxy_conn<IO>(
         &self,
         proxied_domain: &ConfigProxiedDomain,
-        mut conn: tokio::net::TcpStream,
-    ) -> unexpected::Result<()> {
+        mut conn: IO,
+    ) -> unexpected::Result<()>
+    where
+        IO: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin,
+    {
         let mut proxy_conn = tokio::net::TcpStream::connect(&proxied_domain.url.addr)
             .await
             .map_unexpected_while(|| {
@@ -55,10 +58,10 @@ impl Service {
     async fn handle_conn(
         &self,
         conn: tokio::net::TcpStream,
-        tls_conn: rustls::ServerConnection,
+        _tls_config: sync::Arc<rustls::ServerConfig>,
     ) -> Result<(), HandleConnError> {
         let acceptor =
-            tokio_rustls::LazyConfigAcceptor::new(rustls::server::Acceptor::default(), conn);
+            tokio_rustls::TransparentConfigAcceptor::new(rustls::server::Acceptor::default(), conn);
         futures::pin_mut!(acceptor);
 
         match acceptor.as_mut().await {
@@ -77,10 +80,7 @@ impl Service {
 
                 // If the domain should be proxied, then proxy it
                 if let Some(proxied_domain) = self.config.gemini.proxied_domains.get(&domain) {
-                    let conn = acceptor
-                        .take_io()
-                        .expect("failed to take back underlying TCP connection");
-
+                    let conn = start.into_original_stream();
                     self.proxy_conn(proxied_domain, conn).await?;
                     return Ok(());
                 }
@@ -130,10 +130,7 @@ async fn listen(
         let tls_config = tls_config.clone();
 
         tokio::spawn(async move {
-            let tls_conn = rustls::ServerConnection::new(tls_config)
-                .expect("failed to initialize TLS connection state");
-
-            match service.handle_conn(conn, tls_conn).await {
+            match service.handle_conn(conn, tls_config).await {
                 Ok(_) => (),
                 Err(HandleConnError::ClientError(e)) => {
                     log::warn!("Bad request from connection {addr}: {e}")