diff --git a/Cargo.lock b/Cargo.lock
index db3f3ff366..d339f7ec8d 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -943,8 +943,7 @@ checksum = "9a3a5bfb195931eeb336b2a7b4d761daec841b97f947d34394601737a7bba5e4"
 [[package]]
 name = "hyper"
 version = "0.14.31"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8c08302e8fa335b151b788c775ff56e7a03ae64ff85c548ee820fecb70356e85"
+source = "git+https://github.com/hyperium/hyper.git?rev=a24f0c0a#a24f0c0af8e1f4c6b7cc3a47c83eb6e4af88aca6"
 dependencies = [
  "bytes",
  "futures-channel",
diff --git a/Cargo.toml b/Cargo.toml
index d249e8a0c3..87ca708d5d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -101,3 +101,11 @@ hyper = { version = "0.14", default-features = false }
 linkerd2-proxy-api = "0.15.0"
 tokio-rustls = { version = "0.26", default-features = false, features = ["ring", "logging"] }
 # linkerd2-proxy-api = { git = "https://github.com/linkerd/linkerd2-proxy-api.git", branch = "main" }
+
+# NB: hyperium/hyper#3796 backports the server connection builder's
+# `max_pending_accept_reset_streams()` method. once released, we can depend on
+# 0.14.32 or later, but until then will point our hyper dependency to the
+# commit in the 0.14 branch.
+[patch.'crates-io'.hyper]
+git = "https://github.com/hyperium/hyper.git"
+rev = "a24f0c0a"
diff --git a/deny.toml b/deny.toml
index 5c1f1e5920..bb3c6b03dc 100644
--- a/deny.toml
+++ b/deny.toml
@@ -71,4 +71,5 @@ skip-tree = [
 [sources]
 unknown-registry = "deny"
 unknown-git = "deny"
+allow-git = ["https://github.com/hyperium/hyper.git"]
 allow-registry = ["https://github.com/rust-lang/crates.io-index"]