diff --git a/Makefile b/Makefile
index c50319a..fd00888 100644
--- a/Makefile
+++ b/Makefile
@@ -21,6 +21,9 @@ build1:
 install: build0 frontend
 	CGO_ENABLED=0 go install
 
+race: build0
+	go build -race
+
 test:
 	CGO_ENABLED=0 go test -shuffle=on -coverprofile cover.out ./...
 	go tool cover -html=cover.out -o cover.html
diff --git a/http/web.go b/http/web.go
index d60d6d9..e2722cf 100644
--- a/http/web.go
+++ b/http/web.go
@@ -772,8 +772,9 @@ func listen1(ip string, port int, tlsConfig *tls.Config, name string, kinds []st
 	}
 
 	server := &http.Server{
-		Handler:           handler,
-		TLSConfig:         tlsConfig,
+		Handler: handler,
+		// Clone because our multiple Server.Serve calls modify config concurrently leading to data race.
+		TLSConfig:         tlsConfig.Clone(),
 		ReadHeaderTimeout: 30 * time.Second,
 		IdleTimeout:       65 * time.Second, // Chrome closes connections after 60 seconds, firefox after 115 seconds.
 		ErrorLog:          golog.New(mlog.LogWriter(pkglog.With(slog.String("pkg", "net/http")), slog.LevelInfo, protocol+" error"), "", 0),