diff --git a/src/internal.c b/src/internal.c
index 05d410f0b..5e07570e8 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -29218,6 +29218,9 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
             if (!ssl->options.downgrade ||
                     ssl->options.minDowngrade <= DTLSv1_3_MINOR)
                 return VERSION_ERROR;
+
+            /* Cannot be DTLS1.3 as HELLO_VERIFY_REQUEST */
+            ssl->options.tls1_3 = 0;
         }
 #endif /* defined(WOLFSSL_DTLS13) && defined(WOLFSSL_TLS13) */
 
diff --git a/src/tls.c b/src/tls.c
index ca5159d3f..cc845470f 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -14916,7 +14916,8 @@ int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, byte msgType,
     }
 
 #ifdef HAVE_EXTENDED_MASTER
-    if (IsAtLeastTLSv1_3(ssl->version) && msgType == hello_retry_request) {
+    if (IsAtLeastTLSv1_3(ssl->version) &&
+        (msgType == hello_retry_request || msgType == hello_verify_request)) {
         /* Don't change EMS status until server_hello received.
          * Second ClientHello must have same extensions.
          */
diff --git a/src/tls13.c b/src/tls13.c
index 81518edac..19e4ff501 100644
--- a/src/tls13.c
+++ b/src/tls13.c
@@ -5289,6 +5289,7 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
             }
 
             ssl->version.minor = args->pv.minor;
+            ssl->options.tls1_3 = 0;
 
 #ifdef WOLFSSL_DTLS13
             if (ssl->options.dtls) {
@@ -5390,7 +5391,10 @@ int DoTls13ServerHello(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
         }
 
         /* Force client hello version 1.2 to work for static RSA. */
-        ssl->chVersion.minor = TLSv1_2_MINOR;
+        if (ssl->options.dtls)
+            ssl->chVersion.minor = DTLSv1_2_MINOR;
+        else
+            ssl->chVersion.minor = TLSv1_2_MINOR;
         /* Complete TLS v1.2 processing of ServerHello. */
         ret = CompleteServerHello(ssl);
 #else
diff --git a/tests/test-dtls13-downgrade.conf b/tests/test-dtls13-downgrade.conf
index bda26666c..931cc6b8c 100644
--- a/tests/test-dtls13-downgrade.conf
+++ b/tests/test-dtls13-downgrade.conf
@@ -41,3 +41,16 @@
 -7 2
 -u
 -l TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
+
+# server DTLSv1.2 - PSK
+-v 3
+-u
+-s
+-l ECDHE-PSK-AES128-GCM-SHA256
+
+# client DTLS PSK multiversion, allow downgrade
+-vd
+-7 2
+-u
+-s
+-l ECDHE-PSK-AES128-GCM-SHA256
diff --git a/tests/test-tls13-down.conf b/tests/test-tls13-down.conf
index 02512f4d6..90f0c4bb4 100644
--- a/tests/test-tls13-down.conf
+++ b/tests/test-tls13-down.conf
@@ -108,3 +108,14 @@
 # client TLSv 1.2
 -v 3
 -H exitWithRet
+
+# server TLSv1.2 - PSK
+-v 3
+-s
+-l ECDHE-PSK-AES128-GCM-SHA256
+
+# client TLS PSK multiversion, allow downgrade
+-v d
+-7 3
+-s
+-l ECDHE-PSK-AES128-GCM-SHA256