diff --git a/go.mod b/go.mod
index 3556731605..ea400e5945 100644
--- a/go.mod
+++ b/go.mod
@@ -3,8 +3,8 @@ module golang.org/x/net
 go 1.18
 
 require (
-	golang.org/x/crypto v0.24.0
-	golang.org/x/sys v0.21.0
-	golang.org/x/term v0.21.0
+	golang.org/x/crypto v0.25.0
+	golang.org/x/sys v0.22.0
+	golang.org/x/term v0.22.0
 	golang.org/x/text v0.16.0
 )
diff --git a/go.sum b/go.sum
index f7e8785a81..c3977102eb 100644
--- a/go.sum
+++ b/go.sum
@@ -1,8 +1,8 @@
-golang.org/x/crypto v0.24.0 h1:mnl8DM0o513X8fdIkmyFE/5hTYxbwYOjDS/+rK6qpRI=
-golang.org/x/crypto v0.24.0/go.mod h1:Z1PMYSOR5nyMcyAVAIQSKCDwalqy85Aqn1x3Ws4L5DM=
-golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws=
-golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/term v0.21.0 h1:WVXCp+/EBEHOj53Rvu+7KiT/iElMrO8ACK16SMZ3jaA=
-golang.org/x/term v0.21.0/go.mod h1:ooXLefLobQVslOqselCNF4SxFAaoS6KujMbsGzSDmX0=
+golang.org/x/crypto v0.25.0 h1:ypSNr+bnYL2YhwoMt2zPxHFmbAN1KZs/njMG3hxUp30=
+golang.org/x/crypto v0.25.0/go.mod h1:T+wALwcMOSE0kXgUAnPAHqTLW+XHgcELELW8VaDgm/M=
+golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
+golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/term v0.22.0 h1:BbsgPEJULsl2fV/AT3v15Mjva5yXKQDyKf+TbDz7QJk=
+golang.org/x/term v0.22.0/go.mod h1:F3qCibpT5AMpCRfhfT53vVJwhLtIVHhB9XDjfFvnMI4=
 golang.org/x/text v0.16.0 h1:a94ExnEXNtEwYLGJSIUxnWoxoRz/ZcCsV63ROupILh4=
 golang.org/x/text v0.16.0/go.mod h1:GhwF1Be+LQoKShO3cGOHzqOgRrGaYc9AvblQOmPVHnI=
diff --git a/http2/transport.go b/http2/transport.go
index 98a49c6b6e..61f511f97a 100644
--- a/http2/transport.go
+++ b/http2/transport.go
@@ -827,10 +827,6 @@ func (t *Transport) newClientConn(c net.Conn, singleUse bool) (*ClientConn, erro
 	cc.henc.SetMaxDynamicTableSizeLimit(t.maxEncoderHeaderTableSize())
 	cc.peerMaxHeaderTableSize = initialHeaderTableSize
 
-	if t.AllowHTTP {
-		cc.nextStreamID = 3
-	}
-
 	if cs, ok := c.(connectionStater); ok {
 		state := cs.ConnectionState()
 		cc.tlsState = &state
diff --git a/http2/transport_test.go b/http2/transport_test.go
index ddeaf6137f..498e27932c 100644
--- a/http2/transport_test.go
+++ b/http2/transport_test.go
@@ -5401,3 +5401,23 @@ func TestIssue66763Race(t *testing.T) {
 
 	<-donec
 }
+
+// Issue 67671: Sending a Connection: close request on a Transport with AllowHTTP
+// set caused a the transport to wedge.
+func TestIssue67671(t *testing.T) {
+	ts := newTestServer(t, func(w http.ResponseWriter, r *http.Request) {})
+	tr := &Transport{
+		TLSClientConfig: tlsConfigInsecure,
+		AllowHTTP:       true,
+	}
+	defer tr.CloseIdleConnections()
+	req, _ := http.NewRequest("GET", ts.URL, nil)
+	req.Close = true
+	for i := 0; i < 2; i++ {
+		res, err := tr.RoundTrip(req)
+		if err != nil {
+			t.Fatal(err)
+		}
+		res.Body.Close()
+	}
+}
diff --git a/quic/endpoint_test.go b/quic/endpoint_test.go
index 3cba1423e3..dc1c510971 100644
--- a/quic/endpoint_test.go
+++ b/quic/endpoint_test.go
@@ -13,6 +13,7 @@ import (
 	"io"
 	"log/slog"
 	"net/netip"
+	"runtime"
 	"testing"
 	"time"
 
@@ -69,6 +70,10 @@ func TestStreamTransfer(t *testing.T) {
 }
 
 func newLocalConnPair(t testing.TB, conf1, conf2 *Config) (clientConn, serverConn *Conn) {
+	switch runtime.GOOS {
+	case "plan9":
+		t.Skipf("ReadMsgUDP not supported on %s", runtime.GOOS)
+	}
 	t.Helper()
 	ctx := context.Background()
 	e1 := newLocalEndpoint(t, serverSide, conf1)
diff --git a/quic/udp_test.go b/quic/udp_test.go
index d3732c140e..5c4ba10fcc 100644
--- a/quic/udp_test.go
+++ b/quic/udp_test.go
@@ -129,6 +129,8 @@ func runUDPTest(t *testing.T, f func(t *testing.T, u udpTest)) {
 				if test.srcNet == "udp6" && test.dstNet == "udp" {
 					t.Skipf("%v: no support for mapping IPv4 address to IPv6", runtime.GOOS)
 				}
+			case "plan9":
+				t.Skipf("ReadMsgUDP not supported on %s", runtime.GOOS)
 			}
 			if runtime.GOARCH == "wasm" && test.srcNet == "udp6" {
 				t.Skipf("%v: IPv6 tests fail when using wasm fake net", runtime.GOARCH)