diff --git a/doc/src/sgml/config.sgml b/doc/src/sgml/config.sgml
index 1f0e0fc1fb..12a9e28018 100644
--- a/doc/src/sgml/config.sgml
+++ b/doc/src/sgml/config.sgml
@@ -1433,7 +1433,10 @@ include_dir 'conf.d'
 
        <para>
         The default is <literal>TLSv1.2</literal>, which satisfies industry
-        best practices as of this writing.
+        best practices as of 
+        <ulink url="https://tools.ietf.org/html/rfc8996">RFC 8996</ulink>
+        which deprecates <literal>TLSv1</literal> and
+        <literal>TLSv1.1</literal>.
        </para>
       </listitem>
      </varlistentry>
diff --git a/doc/src/sgml/libpq.sgml b/doc/src/sgml/libpq.sgml
index be674fbaa9..d701421ca2 100644
--- a/doc/src/sgml/libpq.sgml
+++ b/doc/src/sgml/libpq.sgml
@@ -1811,7 +1811,10 @@ postgresql://%2Fvar%2Flib%2Fpostgresql/dbname
         version of <productname>OpenSSL</productname> used, older versions
         not supporting the most modern protocol versions. If not specified,
         the default is <literal>TLSv1.2</literal>, which satisfies industry
-        best practices as of this writing.
+        best practices as of 
+        <ulink url="https://tools.ietf.org/html/rfc8996">RFC 8996</ulink>
+        which deprecates <literal>TLSv1</literal> and
+        <literal>TLSv1.1</literal>.
        </para>
       </listitem>
      </varlistentry>