diff --git a/erldistpy/tls.py b/erldistpy/tls.py
index 36e7569..52f9596 100644
--- a/erldistpy/tls.py
+++ b/erldistpy/tls.py
@@ -36,6 +36,7 @@ def make_dist_tls_context(
     ca: str,
     check_hostname: bool = False,
     minimum_version: ssl.TLSVersion = ssl.TLSVersion.TLSv1_2,
+    maximum_version: ssl.TLSVersion = ssl.TLSVersion.MAXIMUM_SUPPORTED,
 ) -> ssl.SSLContext:
     """Build an SSLContext for a TLS-dist client.
 
@@ -43,11 +44,16 @@ def make_dist_tls_context(
     and requires one). ``check_hostname=False`` because dist nodes are
     identified by their cookie + cert chain, not by SNI hostname; flip
     on if your CA pins per-node CNs.
+
+    ``maximum_version`` defaults to the highest version Python's ssl
+    supports (TLS 1.3 in practice). Pin to TLS 1.2 explicitly only if
+    you hit interop issues against an older Erlang peer.
     """
     ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     ctx.check_hostname = check_hostname
     ctx.verify_mode = ssl.CERT_REQUIRED
     ctx.minimum_version = minimum_version
+    ctx.maximum_version = maximum_version
     ctx.load_cert_chain(certfile=cert, keyfile=key)
     ctx.load_verify_locations(cafile=ca)
     return ctx