diff --git a/application/palemoon/installer/package-manifest.in b/application/palemoon/installer/package-manifest.in
index e26158a5ed..702bfba2eb 100644
--- a/application/palemoon/installer/package-manifest.in
+++ b/application/palemoon/installer/package-manifest.in
@@ -90,13 +90,7 @@
 @RESPATH@/@ICU_DATA_FILE@
 #endif
 #ifdef MOZ_SHARED_ICU
-#ifdef XP_WIN
-@BINPATH@/icu@MOZ_ICU_VERSION@.dll
-#elif defined(XP_MACOSX)
-@BINPATH@/icu@MOZ_ICU_VERSION@.dylib
-#elif defined(XP_UNIX)
-@BINPATH@/libicu@MOZ_ICU_VERSION@.so
-#endif
+@BINPATH@/@DLL_PREFIX@icu@MOZ_ICU_VERSION@@DLL_SUFFIX@
 #endif
 #ifdef MOZ_GTK3
 @BINPATH@/@DLL_PREFIX@mozgtk@DLL_SUFFIX@
diff --git a/netwerk/base/security-prefs.js b/netwerk/base/security-prefs.js
index e938e9c5ff..b3a92749b4 100644
--- a/netwerk/base/security-prefs.js
+++ b/netwerk/base/security-prefs.js
@@ -112,6 +112,21 @@ pref("security.webauth.u2f_enable_usbtoken", false);
 // OCSP must-staple
 pref("security.ssl.enable_ocsp_must_staple", true);
 
+// Enable TLS 1.3 compatmode version for bad middleware boxes?
+// This is a holdover from the later draft specs and SHOULD NOT be enabled by
+// default. ONLY use this when you explicitly need it. You have been warned!
+// Restart required.
+pref("security.ssl.enable_tls13_compat_mode", false);
+
+// Enable TLS 1.3 hello downgrade sentinel?
+// One of the key protections offered by TLS 1.3 is preventing protocol downgrades
+// as part of the initial handshake.
+// Some domains, middleware and transparent routers may try to downgrade connections
+// this way (which is a bad thing!). To allow users to connect anyway this
+// check can be disabled here. Default is for the sentinel to be enabled, preventing
+// bad downgrades of the protocol version.
+pref("security.tls.hello_downgrade_check", true);
+
 // If a request is mixed-content, send an HSTS priming request to attempt to
 // see if it is available over HTTPS.
 pref("security.mixed_content.send_hsts_priming", true);
diff --git a/security/manager/ssl/nsNSSComponent.cpp b/security/manager/ssl/nsNSSComponent.cpp
index d58abde06a..bc660f8a55 100644
--- a/security/manager/ssl/nsNSSComponent.cpp
+++ b/security/manager/ssl/nsNSSComponent.cpp
@@ -1443,6 +1443,8 @@ static const bool FALSE_START_ENABLED_DEFAULT = true;
 static const bool NPN_ENABLED_DEFAULT = true;
 static const bool ALPN_ENABLED_DEFAULT = false;
 static const bool ENABLED_0RTT_DATA_DEFAULT = false;
+static const bool TLS13_COMPAT_MODE_DEFAULT = false;
+static const bool HELLO_DOWNGRADE_CHECK_DEFAULT = true;
 
 static void
 ConfigureTLSSessionIdentifiers()
@@ -1857,6 +1859,12 @@ nsNSSComponent::InitializeNSS()
 
   SSL_OptionSetDefault(SSL_ENABLE_EXTENDED_MASTER_SECRET, true);
 
+  // Set TLS 1.3 hello downgrade sentinel?
+  bool enableDowngradeCheck =
+    Preferences::GetBool("security.tls.hello_downgrade_check",
+                         HELLO_DOWNGRADE_CHECK_DEFAULT);
+  SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck);
+
   SSL_OptionSetDefault(SSL_ENABLE_FALSE_START,
                        Preferences::GetBool("security.ssl.enable_false_start",
                                             FALSE_START_ENABLED_DEFAULT));
@@ -1876,6 +1884,12 @@ nsNSSComponent::InitializeNSS()
                        Preferences::GetBool("security.tls.enable_0rtt_data",
                                             ENABLED_0RTT_DATA_DEFAULT));
 
+  // Set TLS 1.3 compatibility mode for bad middleware boxes?
+  SSL_OptionSetDefault(SSL_ENABLE_TLS13_COMPAT_MODE,
+                       Preferences::GetBool("security.ssl.enable_tls13_compat_mode",
+                                            TLS13_COMPAT_MODE_DEFAULT));  
+
+  
   if (NS_FAILED(InitializeCipherSuite())) {
 
     MOZ_LOG(gPIPNSSLog, LogLevel::Error, ("Unable to initialize cipher suite settings\n"));
@@ -2038,6 +2052,11 @@ nsNSSComponent::Observe(nsISupports* aSubject, const char* aTopic,
     if (prefName.EqualsLiteral("security.tls.version.min") ||
         prefName.EqualsLiteral("security.tls.version.max")) {
       (void) setEnabledTLSVersions();
+    } else if (prefName.EqualsLiteral("security.tls.hello_downgrade_check")) {
+      bool enableDowngradeCheck =
+        Preferences::GetBool("security.tls.hello_downgrade_check",
+                             HELLO_DOWNGRADE_CHECK_DEFAULT);
+      SSL_OptionSetDefault(SSL_ENABLE_HELLO_DOWNGRADE_CHECK, enableDowngradeCheck);
     } else if (prefName.EqualsLiteral("security.ssl.require_safe_negotiation")) {
       bool requireSafeNegotiation =
         Preferences::GetBool("security.ssl.require_safe_negotiation",