@@ -237,6 +237,7 @@ impl From<InvalidMessage> for AlertDescription {
 pub enum PeerMisbehaved {
     AttemptedDowngradeToTls12WhenTls13IsSupported,
     BadCertChainExtensions,
+    CipherSuiteDifferedOnRetry,
     DisallowedEncryptedExtension,
     DuplicateClientHelloExtensions,
     DuplicateEncryptedExtensions,
 
@@ -315,6 +315,7 @@ pub(super) struct ExpectClientHello {
     pub(super) using_ems: bool,
     pub(super) done_retry: bool,
     pub(super) offered_psk_before_retry: bool,
+    pub(super) suite_before_retry: Option<CipherSuite>,
     pub(super) send_tickets: usize,
 }
 
@@ -339,6 +340,7 @@ impl ExpectClientHello {
             using_ems: false,
             done_retry: false,
             offered_psk_before_retry: false,
+            suite_before_retry: None,
             send_tickets: 0,
         }
     }
@@ -472,6 +474,17 @@ impl ExpectClientHello {
                     .send_fatal_alert(AlertDescription::HandshakeFailure, incompat)
             })?;
 
+        // RFC 9846 section 4.2.4: the server must negotiate the same cipher suite it
+        // named in its HelloRetryRequest
+        if let Some(before_retry) = self.suite_before_retry {
+            if before_retry != suite.suite() {
+                return Err(cx.common.send_fatal_alert(
+                    AlertDescription::IllegalParameter,
+                    PeerMisbehaved::CipherSuiteDifferedOnRetry,
+                ));
+            }
+        }
+
         debug!("decided upon suite {suite:?}");
         cx.common.suite = Some(suite);
         cx.common.kx_state = KxState::Start(skxg);
 
@@ -78,7 +78,9 @@ mod tests {
     use crate::server::{AlwaysResolvesServerRawPublicKeys, ServerConfig, ServerConnection};
     use crate::sign::CertifiedKey;
     use crate::sync::Arc;
-    use crate::{CipherSuiteCommon, SupportedCipherSuite, Tls12CipherSuite, version};
+    use crate::{
+        CipherSuiteCommon, SupportedCipherSuite, Tls12CipherSuite, Tls13CipherSuite, version,
+    };
 
     #[cfg(feature = "tls12")]
     #[test]
@@ -295,6 +297,74 @@ mod tests {
         );
     }
 
+    #[test]
+    fn second_client_hello_cannot_change_cipher_suite() {
+        // RFC 9846 section 4.2.4 requires the server to negotiate the same cipher suite it
+        // named in its HelloRetryRequest, and section 4.2.2 does not let the client vary its
+        // offer, so a second hello that withdraws the retried suite cannot be honoured.
+        let provider = CryptoProvider {
+            cipher_suites: vec![
+                super::provider::cipher_suite::TLS13_AES_128_GCM_SHA256,
+                TLS13_AES_128_GCM_SHA256_ALT,
+            ],
+            ..super::provider::default_provider()
+        };
+        let config = ServerConfig::builder_with_provider(provider.into())
+            .with_protocol_versions(&[&version::TLS13])
+            .unwrap()
+            .with_no_client_auth()
+            .with_single_cert(server_cert(), server_key())
+            .unwrap();
+        let mut conn = ServerConnection::new(config.into()).unwrap();
+
+        let encode = |hello| {
+            Message {
+                version: ProtocolVersion::TLSv1_3,
+                payload: MessagePayload::handshake(HandshakeMessagePayload(
+                    HandshakePayload::ClientHello(hello),
+                )),
+            }
+            .into_wire_bytes()
+        };
+
+        // this hello has no key share for a group we support, so it draws a
+        // HelloRetryRequest naming `TLS13_AES_128_GCM_SHA256`.
+        let mut first = minimal_client_hello();
+        first.cipher_suites = vec![CipherSuite::TLS13_AES_128_GCM_SHA256];
+        first.extensions.key_shares = Some(vec![]);
+        conn.read_tls(&mut encode(first).as_slice())
+            .unwrap();
+        conn.process_new_packets().unwrap();
+
+        // the second hello follows the retry, but offers only a different suite. It shares
+        // the retried suite's hash, so the transcript stays valid and nothing else objects.
+        let mut second = minimal_client_hello();
+        second.cipher_suites = vec![TLS13_AES_128_GCM_SHA256_ALT.suite()];
+        conn.read_tls(&mut encode(second).as_slice())
+            .unwrap();
+
+        assert_eq!(
+            conn.process_new_packets().unwrap_err(),
+            PeerMisbehaved::CipherSuiteDifferedOnRetry.into(),
+        );
+    }
+
+    static TLS13_AES_128_GCM_SHA256_ALT: SupportedCipherSuite =
+        SupportedCipherSuite::Tls13(&TLS13_AES_128_GCM_SHA256_ALT_INNER);
+
+    /// Differs from `TLS13_AES_128_GCM_SHA256` only in its code point: same hash, same everything else.
+    static TLS13_AES_128_GCM_SHA256_ALT_INNER: Tls13CipherSuite =
+        match &super::provider::cipher_suite::TLS13_AES_128_GCM_SHA256 {
+            SupportedCipherSuite::Tls13(provider) => Tls13CipherSuite {
+                common: CipherSuiteCommon {
+                    suite: CipherSuite::Unknown(0xff14),
+                    ..provider.common
+                },
+                ..**provider
+            },
+            _ => unreachable!(),
+        };
+
     fn server_config_for_rpk() -> ServerConfig {
         let x25519_provider = CryptoProvider {
             kx_groups: vec![super::provider::kx_group::X25519],
 
@@ -255,6 +255,7 @@ mod client_hello {
                     offered_psk_before_retry: client_hello
                         .preshared_key_offer
                         .is_some(),
+                    suite_before_retry: Some(self.suite.common.suite),
                     send_tickets: self.send_tickets,
                     extra_exts: self.extra_exts,
                 });