diff --git a/core/crates/drivers/cassandra/src/relay.rs b/core/crates/drivers/cassandra/src/relay.rs
index 5c5b046328..8d5c9c91c2 100644
--- a/core/crates/drivers/cassandra/src/relay.rs
+++ b/core/crates/drivers/cassandra/src/relay.rs
@@ -147,9 +147,10 @@ mod tests {
 
         let mut client = TcpStream::connect(relay.address()).await.unwrap();
         let mut byte = [0_u8; 1];
-        let read = tokio::time::timeout(Duration::from_secs(5), client.read(&mut byte))
-            .await
-            .unwrap();
+        // Windows retries a refused connect for about two seconds, longer on a busy runner, so
+        // the wait is the transport's own connect timeout plus room to close the stream.
+        let within = LivenessPolicy::DESKTOP.connect_timeout + Duration::from_secs(5);
+        let read = tokio::time::timeout(within, client.read(&mut byte)).await.unwrap();
 
         assert!(
             matches!(read, Ok(0) | Err(_)),
diff --git a/linux/crates/app/src/ui/connect_dialog/mod.rs b/linux/crates/app/src/ui/connect_dialog/mod.rs
index a4b2100282..c8a1098636 100644
--- a/linux/crates/app/src/ui/connect_dialog/mod.rs
+++ b/linux/crates/app/src/ui/connect_dialog/mod.rs
@@ -483,12 +483,15 @@ impl ConnectDialog {
         let next = match socket {
             true => {
                 imp.network_tls.replace(Some(imp.tls_section.form_state()));
-                TlsFormState {
-                    mode: TlsMode::Disable,
-                    ..TlsFormState::new(tls)
-                }
+                TlsFormState::new(TlsMode::Disable)
             }
-            false => imp.network_tls.take().unwrap_or_else(|| TlsFormState::new(tls)),
+            false => imp.network_tls.take().unwrap_or_else(|| {
+                let form = self.form();
+                let mode = entry.as_ref().map_or(TlsMode::Disable, |entry| {
+                    entry.capabilities().new_connection_tls(form.port, &form.options)
+                });
+                TlsFormState::new(mode)
+            }),
         };
         imp.tls_section.apply(tls, TransportClass::DirectTcp, &next);
     }
@@ -721,13 +724,12 @@ impl ConnectDialog {
             };
             // The engine takes a network host, so the TLS it had over the network comes back too.
             if socket_after.is_none() {
-                let tls = entry.capabilities().tls.as_ref();
-                form.tls = imp.network_tls.take().unwrap_or_else(|| TlsFormState::new(tls));
-                if let Some(tls) = tls
-                    && !tls.modes.contains(&form.tls.mode)
-                {
-                    form.tls = TlsFormState::new(Some(tls));
-                }
+                let caps = entry.capabilities();
+                form.tls = imp
+                    .network_tls
+                    .take()
+                    .unwrap_or_else(|| TlsFormState::new(caps.new_connection_tls(form.port, &form.options)));
+                form.follow_tls_default(caps);
             }
         }
         self.show_driver(index, &form);
diff --git a/windows/src/TablePro.App.Model/ConnectionDraft.cs b/windows/src/TablePro.App.Model/ConnectionDraft.cs
index 17e606092b..12417cda20 100644
--- a/windows/src/TablePro.App.Model/ConnectionDraft.cs
+++ b/windows/src/TablePro.App.Model/ConnectionDraft.cs
@@ -198,11 +198,6 @@ public void FollowTlsDefault(DatabaseEngine engine)
             TlsMode = engine.NewConnectionTls(ParsePort(Port));
             TlsModeChosen = false;
         }
-
-        CaFile = url.CaFile ?? CaFile;
-        ClientCertificate = url.ClientCertificate ?? ClientCertificate;
-        ClientKey = url.ClientKey ?? ClientKey;
-        ServerName = url.ServerName ?? ServerName;
     }
 
     public IReadOnlyList<FieldError> Validate()