diff --git a/Cargo.lock b/Cargo.lock
index b9256a9f43..b20da64484 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -943,8 +943,7 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "hyper"
 version = "0.14.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c08302e8fa335b151b788c775ff56e7a03ae64ff85c548ee820fecb70356e85"
+source = "git+https://github.com/hyperium/hyper.git?rev=a24f0c0a#a24f0c0af8e1f4c6b7cc3a47c83eb6e4af88aca6"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/Cargo.toml b/Cargo.toml
index 1990bda881..87ca708d5d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -97,6 +97,15 @@ debug = 1
 lto = true
 
 [workspace.dependencies]
+hyper = { version = "0.14", default-features = false }
 linkerd2-proxy-api = "0.15.0"
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "logging"] }
 # linkerd2-proxy-api = { git = "https://github.com/linkerd/linkerd2-proxy-api.git", branch = "main" }
+
+# NB: hyperium/hyper#3796 backports the server connection builder's
+# `max_pending_accept_reset_streams()` method. once released, we can depend on
+# 0.14.32 or later, but until then will point our hyper dependency to the
+# commit in the 0.14 branch.
+[patch.'crates-io'.hyper]
+git = "https://github.com/hyperium/hyper.git"
+rev = "a24f0c0a"
diff --git a/deny.toml b/deny.toml
index 7865a96bd3..8639794cfc 100644
--- a/deny.toml
+++ b/deny.toml
@@ -73,4 +73,5 @@ skip-tree = [
 [sources]
 unknown-registry = "deny"
 unknown-git = "deny"
+allow-git = ["https://github.com/hyperium/hyper.git"]
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]
diff --git a/hyper-balance/Cargo.toml b/hyper-balance/Cargo.toml
index 27193038f9..341181e373 100644
--- a/hyper-balance/Cargo.toml
+++ b/hyper-balance/Cargo.toml
@@ -9,7 +9,7 @@ publish = false
 [dependencies]
 futures = { version = "0.3", default-features = false }
 http = "0.2"
-hyper = { version = "0.14", features = ["deprecated"] }
+hyper = { workspace = true, features = ["deprecated"] }
 pin-project = "1"
 tower = { version = "0.4", default-features = false, features = ["load"] }
 tokio = { version = "1", features = ["macros"] }
diff --git a/linkerd/app/admin/Cargo.toml b/linkerd/app/admin/Cargo.toml
index 680657504c..c5636652a2 100644
--- a/linkerd/app/admin/Cargo.toml
+++ b/linkerd/app/admin/Cargo.toml
@@ -18,7 +18,7 @@ log-streaming = ["linkerd-tracing/stream"]
 deflate = { version = "1", optional = true, features = ["gzip"] }
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 futures = { version = "0.3", default-features = false }
 pprof = { version = "0.14", optional = true, features = ["prost-codec"] }
 serde = "1"
diff --git a/linkerd/app/core/Cargo.toml b/linkerd/app/core/Cargo.toml
index bf0ba916f9..66889802f9 100644
--- a/linkerd/app/core/Cargo.toml
+++ b/linkerd/app/core/Cargo.toml
@@ -17,7 +17,7 @@ bytes = "1"
 drain = { version = "0.1", features = ["retain"] }
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 futures = { version = "0.3", default-features = false }
 ipnet = "2.10"
 prometheus-client = "0.22"
diff --git a/linkerd/app/inbound/Cargo.toml b/linkerd/app/inbound/Cargo.toml
index 9e152aa587..936224a431 100644
--- a/linkerd/app/inbound/Cargo.toml
+++ b/linkerd/app/inbound/Cargo.toml
@@ -45,13 +45,13 @@ path = "../../proxy/server-policy"
 features = ["proto"]
 
 [target.'cfg(fuzzing)'.dependencies]
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 linkerd-app-test = { path = "../test" }
 arbitrary = { version = "1", features = ["derive"] }
 libfuzzer-sys = { version = "0.4", features = ["arbitrary-derive"] }
 
 [dev-dependencies]
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 linkerd-app-test = { path = "../test" }
 linkerd-http-metrics = { path = "../../http/metrics", features = ["test-util"] }
 linkerd-idle-cache = { path = "../../idle-cache", features = ["test-util"] }
diff --git a/linkerd/app/integration/Cargo.toml b/linkerd/app/integration/Cargo.toml
index e6077780c6..d8d40ef724 100644
--- a/linkerd/app/integration/Cargo.toml
+++ b/linkerd/app/integration/Cargo.toml
@@ -22,7 +22,7 @@ futures = { version = "0.3", default-features = false, features = ["executor"] }
 h2 = "0.3"
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14", features = [
+hyper = { workspace = true, features = [
     "backports",
     "deprecated",
     "http1",
diff --git a/linkerd/app/outbound/Cargo.toml b/linkerd/app/outbound/Cargo.toml
index c4cad0f536..a1c690ea80 100644
--- a/linkerd/app/outbound/Cargo.toml
+++ b/linkerd/app/outbound/Cargo.toml
@@ -54,7 +54,7 @@ linkerd-tonic-watch = { path = "../../tonic-watch" }
 [dev-dependencies]
 futures-util = "0.3"
 http-body = "0.4"
-hyper = { version = "0.14", features = ["backports", "deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["backports", "deprecated", "http1", "http2"] }
 tokio = { version = "1", features = ["macros", "sync", "time"] }
 tokio-rustls = { workspace = true }
 tokio-test = "0.4"
diff --git a/linkerd/app/test/Cargo.toml b/linkerd/app/test/Cargo.toml
index 5aaf994e6c..4a27959ded 100644
--- a/linkerd/app/test/Cargo.toml
+++ b/linkerd/app/test/Cargo.toml
@@ -17,7 +17,7 @@ futures = { version = "0.3", default-features = false }
 h2 = "0.3"
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 linkerd-app-core = { path = "../core" }
 linkerd-http-route = { path = "../../http/route", optional = true }
 linkerd-identity = { path = "../../identity" }
diff --git a/linkerd/http/executor/Cargo.toml b/linkerd/http/executor/Cargo.toml
index 186173d5ac..ef75f18f6a 100644
--- a/linkerd/http/executor/Cargo.toml
+++ b/linkerd/http/executor/Cargo.toml
@@ -10,6 +10,6 @@ HTTP runtime components for Linkerd.
 """
 
 [dependencies]
-hyper = { version = "0.14", features = ["deprecated"] }
+hyper = { workspace = true, features = ["deprecated"] }
 tokio = { version = "1", features = ["rt"] }
 tracing = "0.1"
diff --git a/linkerd/http/metrics/Cargo.toml b/linkerd/http/metrics/Cargo.toml
index ac8537fb1c..d6f83c5ec4 100644
--- a/linkerd/http/metrics/Cargo.toml
+++ b/linkerd/http/metrics/Cargo.toml
@@ -14,7 +14,7 @@ bytes = "1"
 futures = { version = "0.3", default-features = false }
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 parking_lot = "0.12"
 pin-project = "1"
 tokio = { version = "1", features = ["time"] }
diff --git a/linkerd/http/retry/Cargo.toml b/linkerd/http/retry/Cargo.toml
index 51be316b9f..a228327bcd 100644
--- a/linkerd/http/retry/Cargo.toml
+++ b/linkerd/http/retry/Cargo.toml
@@ -24,6 +24,6 @@ linkerd-metrics = { path = "../../metrics" }
 linkerd-stack = { path = "../../stack" }
 
 [dev-dependencies]
-hyper = { version = "0.14", features = ["deprecated"] }
+hyper = { workspace = true, features = ["deprecated"] }
 linkerd-tracing = { path = "../../tracing", features = ["ansi"] }
 tokio = { version = "1", features = ["macros", "rt"] }
diff --git a/linkerd/http/upgrade/Cargo.toml b/linkerd/http/upgrade/Cargo.toml
index 5ed08e7072..60c77c30f3 100644
--- a/linkerd/http/upgrade/Cargo.toml
+++ b/linkerd/http/upgrade/Cargo.toml
@@ -15,7 +15,7 @@ drain = "0.1"
 futures = { version = "0.3", default-features = false }
 http = "0.2"
 http-body = "0.4"
-hyper = { version = "0.14", default-features = false, features = ["deprecated", "client"] }
+hyper = { workspace = true, default-features = false, features = ["deprecated", "client"] }
 pin-project = "1"
 tokio = { version = "1", default-features = false }
 tower = { version = "0.4", default-features = false }
diff --git a/linkerd/metrics/Cargo.toml b/linkerd/metrics/Cargo.toml
index 5452283197..16aaedb6b6 100644
--- a/linkerd/metrics/Cargo.toml
+++ b/linkerd/metrics/Cargo.toml
@@ -15,7 +15,7 @@ test_util = []
 [dependencies]
 deflate = { version = "1", features = ["gzip"] }
 http = "0.2"
-hyper = { version = "0.14", features = ["deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["deprecated", "http1", "http2"] }
 linkerd-stack = { path = "../stack", optional = true }
 linkerd-system = { path = "../system", optional = true }
 parking_lot = "0.12"
diff --git a/linkerd/proxy/http/Cargo.toml b/linkerd/proxy/http/Cargo.toml
index 1c3332fbe1..4af7d4cb38 100644
--- a/linkerd/proxy/http/Cargo.toml
+++ b/linkerd/proxy/http/Cargo.toml
@@ -20,7 +20,7 @@ h2 = "0.3"
 http = "0.2"
 http-body = "0.4"
 httparse = "1"
-hyper = { version = "0.14", features = [
+hyper = { workspace = true, features = [
     "backports",
     "client",
     "deprecated",
diff --git a/linkerd/proxy/tap/Cargo.toml b/linkerd/proxy/tap/Cargo.toml
index b10528fd79..b953c58f29 100644
--- a/linkerd/proxy/tap/Cargo.toml
+++ b/linkerd/proxy/tap/Cargo.toml
@@ -8,7 +8,7 @@ publish = false
 
 [dependencies]
 http = "0.2"
-hyper = { version = "0.14", features = ["backports", "deprecated", "http1", "http2"] }
+hyper = { workspace = true, features = ["backports", "deprecated", "http1", "http2"] }
 futures = { version = "0.3", default-features = false }
 ipnet = "2.10"
 linkerd2-proxy-api = { workspace = true, features = ["tap"] }