diff --git a/acceptance-tests/acceptance_tests_suite_test.go b/acceptance-tests/acceptance_tests_suite_test.go
index 04aa2bfb..93e2ca2b 100644
--- a/acceptance-tests/acceptance_tests_suite_test.go
+++ b/acceptance-tests/acceptance_tests_suite_test.go
@@ -200,6 +200,11 @@ func expect400(resp *http.Response, err error) {
 	Expect(resp.StatusCode).To(Equal(http.StatusBadRequest))
 }
 
+func expect431(resp *http.Response, err error) {
+	Expect(err).NotTo(HaveOccurred())
+	Expect(resp.StatusCode).To(Equal(http.StatusRequestHeaderFieldsTooLarge))
+}
+
 func expect421(resp *http.Response, err error) {
 	Expect(err).NotTo(HaveOccurred())
 	Expect(resp.StatusCode).To(Equal(http.StatusMisdirectedRequest))
diff --git a/acceptance-tests/buffer_size_test.go b/acceptance-tests/buffer_size_test.go
index 385afce3..1397c7ec 100644
--- a/acceptance-tests/buffer_size_test.go
+++ b/acceptance-tests/buffer_size_test.go
@@ -53,7 +53,7 @@ var _ = Describe("max_rewrite and buffer_size_bytes", func() {
 		// ensure total header size (key+value) is 72k
 		req.Header.Set("X-Custom", string(randBytes(72*1024-len("X-Custom: "))))
 
-		expect400(http.DefaultClient.Do(req))
+		expect431(http.DefaultClient.Do(req))
 	})
 })
 
diff --git a/config/blobs.yml b/config/blobs.yml
index 0eb3676c..4fa05af3 100644
--- a/config/blobs.yml
+++ b/config/blobs.yml
@@ -1,7 +1,7 @@
-haproxy/haproxy-2.8.16.tar.gz:
-  size: 4429238
-  object_id: b5d1e4e1-03b6-40c8-5ba5-ba05cecee194
-  sha: sha256:6eb4d3cc298af89613fc6cb175530436e1e463d368e43401a60357a7a12d15ab
+haproxy/haproxy-3.2.8.tar.gz:
+  size: 5119011
+  object_id: 4c878001-6931-4187-6129-6aa4eb51eb7c
+  sha: sha256:46703fb94720f92cce2b08049a40d9176962037ba676885c55a56bd9d625e7c2
 haproxy/hatop-0.8.2:
   size: 74157
   object_id: 00125e3f-bdaa-4da3-583f-b680b0b30df4
diff --git a/packages/haproxy/packaging b/packages/haproxy/packaging
index 4212b4d2..1cdf4964 100644
--- a/packages/haproxy/packaging
+++ b/packages/haproxy/packaging
@@ -8,7 +8,7 @@ PCRE_VERSION=10.46  # https://github.com/PCRE2Project/pcre2/releases/download/pc
 
 SOCAT_VERSION=1.8.0.3  # http://www.dest-unreach.org/socat/download/socat-1.8.0.3.tar.gz
 
-HAPROXY_VERSION=2.8.16  # https://www.haproxy.org/download/2.8/src/haproxy-2.8.16.tar.gz
+HAPROXY_VERSION=3.2.8  # https://www.haproxy.org/download/3.2/src/haproxy-3.2.8.tar.gz
 
 HATOP_VERSION=0.8.2  # https://github.com/jhunt/hatop/releases/download/v0.8.2/hatop