diff --git a/quinn-proto/src/config.rs b/quinn-proto/src/config.rs
index 233f3e201..b4e58c33b 100644
--- a/quinn-proto/src/config.rs
+++ b/quinn-proto/src/config.rs
@@ -427,7 +427,7 @@ where
     /// TLS configuration used for incoming connections.
     ///
     /// Must be set to use TLS 1.3 only.
-    pub crypto: S::ServerConfig,
+    pub crypto: Arc<S::ServerConfig>,
 
     /// Used to generate one-time AEAD keys to protect handshake tokens
     pub(crate) token_key: Arc<dyn HandshakeTokenKey>,
@@ -454,7 +454,7 @@ where
     S: crypto::Session,
 {
     /// Create a default config with a particular handshake token key
-    pub fn new(crypto: S::ServerConfig, token_key: Arc<dyn HandshakeTokenKey>) -> Self {
+    pub fn new(crypto: Arc<S::ServerConfig>, token_key: Arc<dyn HandshakeTokenKey>) -> Self {
         Self {
             transport: Arc::new(TransportConfig::default()),
             crypto,
@@ -557,7 +557,6 @@ where
 impl<S> Clone for ServerConfig<S>
 where
     S: crypto::Session,
-    S::ServerConfig: Clone,
 {
     fn clone(&self) -> Self {
         Self {
@@ -583,7 +582,7 @@ where
     pub transport: Arc<TransportConfig>,
 
     /// Cryptographic configuration to use
-    pub crypto: S::ClientConfig,
+    pub crypto: Arc<S::ClientConfig>,
 }
 
 #[cfg(feature = "rustls")]
@@ -631,7 +630,6 @@ impl ClientConfig<crypto::rustls::TlsSession> {
 impl<S> Clone for ClientConfig<S>
 where
     S: crypto::Session,
-    S::ClientConfig: Clone,
 {
     fn clone(&self) -> Self {
         Self {
diff --git a/quinn-proto/src/crypto.rs b/quinn-proto/src/crypto.rs
index 8e1993116..6b7eb2904 100644
--- a/quinn-proto/src/crypto.rs
+++ b/quinn-proto/src/crypto.rs
@@ -8,7 +8,7 @@
 //! Note that usage of any protocol (version) other than TLS 1.3 does not conform to any
 //! published versions of the specification, and will not be supported in QUIC v1.
 
-use std::{any::Any, str};
+use std::{any::Any, str, sync::Arc};
 
 use bytes::BytesMut;
 
@@ -120,25 +120,25 @@ pub struct Keys {
 }
 
 /// Client-side configuration for the crypto protocol
-pub trait ClientConfig<S>: Clone
+pub trait ClientConfig<S>
 where
     S: Session,
 {
     /// Start a client session with this configuration
     fn start_session(
-        &self,
+        self: Arc<Self>,
         server_name: &str,
         params: &TransportParameters,
     ) -> Result<S, ConnectError>;
 }
 
 /// Server-side configuration for the crypto protocol
-pub trait ServerConfig<S>: Clone + Send + Sync
+pub trait ServerConfig<S>: Send + Sync
 where
     S: Session,
 {
     /// Start a server session with this configuration
-    fn start_session(&self, params: &TransportParameters) -> S;
+    fn start_session(self: Arc<Self>, params: &TransportParameters) -> S;
 }
 
 /// Keys used to protect packet payloads
diff --git a/quinn-proto/src/crypto/rustls.rs b/quinn-proto/src/crypto/rustls.rs
index 5a54b1e0f..30aae8478 100644
--- a/quinn-proto/src/crypto/rustls.rs
+++ b/quinn-proto/src/crypto/rustls.rs
@@ -37,8 +37,8 @@ impl TlsSession {
 }
 
 impl crypto::Session for TlsSession {
-    type ClientConfig = Arc<rustls::ClientConfig>;
-    type ServerConfig = Arc<rustls::ServerConfig>;
+    type ClientConfig = rustls::ClientConfig;
+    type ServerConfig = rustls::ServerConfig;
 
     fn initial_keys(dst_cid: &ConnectionId, side: Side) -> Keys {
         let keys = rustls::quic::Keys::initial(Version::V1Draft, dst_cid, side.is_client());
@@ -268,9 +268,9 @@ pub struct HandshakeData {
     pub server_name: Option<String>,
 }
 
-impl crypto::ClientConfig<TlsSession> for Arc<rustls::ClientConfig> {
+impl crypto::ClientConfig<TlsSession> for rustls::ClientConfig {
     fn start_session(
-        &self,
+        self: Arc<Self>,
         server_name: &str,
         params: &TransportParameters,
     ) -> Result<TlsSession, ConnectError> {
@@ -280,7 +280,7 @@ impl crypto::ClientConfig<TlsSession> for Arc<rustls::ClientConfig> {
             next_secrets: None,
             inner: Connection::Client(
                 rustls::ClientConnection::new_quic(
-                    self.clone(),
+                    self,
                     Version::V1Draft,
                     server_name
                         .try_into()
@@ -293,15 +293,14 @@ impl crypto::ClientConfig<TlsSession> for Arc<rustls::ClientConfig> {
     }
 }
 
-impl crypto::ServerConfig<TlsSession> for Arc<rustls::ServerConfig> {
-    fn start_session(&self, params: &TransportParameters) -> TlsSession {
+impl crypto::ServerConfig<TlsSession> for rustls::ServerConfig {
+    fn start_session(self: Arc<Self>, params: &TransportParameters) -> TlsSession {
         TlsSession {
             using_alpn: !self.alpn_protocols.is_empty(),
             got_handshake_data: false,
             next_secrets: None,
             inner: Connection::Server(
-                rustls::ServerConnection::new_quic(self.clone(), Version::V1Draft, to_vec(params))
-                    .unwrap(),
+                rustls::ServerConnection::new_quic(self, Version::V1Draft, to_vec(params)).unwrap(),
             ),
         }
     }
diff --git a/quinn-proto/src/endpoint.rs b/quinn-proto/src/endpoint.rs
index c34477032..fba285c0a 100644
--- a/quinn-proto/src/endpoint.rs
+++ b/quinn-proto/src/endpoint.rs
@@ -463,7 +463,7 @@ where
                 };
                 (
                     Some(config.clone()),
-                    config.crypto.start_session(&server_params),
+                    config.crypto.clone().start_session(&server_params),
                     config.transport.clone(),
                 )
             }