diff --git a/pkg/crypto/crypto.go b/pkg/crypto/crypto.go
index be0337b900..bb32061c25 100644
--- a/pkg/crypto/crypto.go
+++ b/pkg/crypto/crypto.go
@@ -309,16 +309,21 @@ func DefaultCiphers() []uint16 {
 }
 
 // SecureTLSConfig enforces the default minimum security settings for the cluster.
+// Deprecated: use EnforcesSecuritySettings instead.
 func SecureTLSConfig(config *tls.Config) *tls.Config {
+	EnforcesSecuritySettings(config)
+	return config
+}
+
+// EnforcesSecuritySettings enforces the default minimum security settings for the cluster on the given TLS config.
+func EnforcesSecuritySettings(config *tls.Config) {
 	if config.MinVersion == 0 {
 		config.MinVersion = DefaultTLSVersion()
 	}
 
-	config.PreferServerCipherSuites = true
 	if len(config.CipherSuites) == 0 {
 		config.CipherSuites = DefaultCiphers()
 	}
-	return config
 }
 
 // OpenSSLToIANACipherSuites maps input OpenSSL Cipher Suite names to their