diff --git a/cmd/crypto/kes.go b/cmd/crypto/kes.go
index 825f39971..bfc1df752 100644
--- a/cmd/crypto/kes.go
+++ b/cmd/crypto/kes.go
@@ -112,6 +112,7 @@ func NewKes(cfg KesConfig) (KMS, error) {
 		Certificates: []tls.Certificate{cert},
 		RootCAs:      certPool,
 	}
+	cfg.Transport.ForceAttemptHTTP2 = true
 	return &kesService{
 		client: &kesClient{
 			addr: cfg.Endpoint,