diff --git a/cmd/syncthing/crash_reporting.go b/cmd/syncthing/crash_reporting.go
index e261c83e0..21152dc0a 100644
--- a/cmd/syncthing/crash_reporting.go
+++ b/cmd/syncthing/crash_reporting.go
@@ -21,6 +21,8 @@ import (
 
 	"github.com/syncthing/syncthing/internal/slogutil"
 	"github.com/syncthing/syncthing/lib/build"
+	"github.com/syncthing/syncthing/lib/dialer"
+	"github.com/syncthing/syncthing/lib/tlsutil"
 )
 
 const (
@@ -28,6 +30,17 @@ const (
 	putRequestTimeout  = time.Minute
 )
 
+// The client used for uploading crash reports. Crash reports are rare, so
+// the connection is not kept open after an upload.
+var crashReportClient = &http.Client{
+	Transport: &http.Transport{
+		DialContext:       dialer.DialContext,
+		Proxy:             http.ProxyFromEnvironment,
+		DisableKeepAlives: true,
+		TLSClientConfig:   tlsutil.SecureDefaultWithTLS12(),
+	},
+}
+
 // uploadPanicLogs attempts to upload all the panic logs in the named
 // directory to the crash reporting server as urlBase. Uploads are attempted
 // with the newest log first.
@@ -89,7 +102,7 @@ func uploadPanicLog(ctx context.Context, urlBase, file string) error {
 	defer headCancel()
 	headReq = headReq.WithContext(headCtx)
 
-	resp, err := http.DefaultClient.Do(headReq)
+	resp, err := crashReportClient.Do(headReq)
 	if err != nil {
 		return err
 	}
@@ -110,7 +123,7 @@ func uploadPanicLog(ctx context.Context, urlBase, file string) error {
 	defer putCancel()
 	putReq = putReq.WithContext(putCtx)
 
-	resp, err = http.DefaultClient.Do(putReq)
+	resp, err = crashReportClient.Do(putReq)
 	if err != nil {
 		return err
 	}
diff --git a/lib/relay/client/dynamic.go b/lib/relay/client/dynamic.go
index ae39bd3e1..f1911822a 100644
--- a/lib/relay/client/dynamic.go
+++ b/lib/relay/client/dynamic.go
@@ -15,9 +15,11 @@ import (
 	"time"
 
 	"github.com/syncthing/syncthing/lib/build"
+	"github.com/syncthing/syncthing/lib/dialer"
 	"github.com/syncthing/syncthing/lib/osutil"
 	"github.com/syncthing/syncthing/lib/rand"
 	"github.com/syncthing/syncthing/lib/relay/protocol"
+	"github.com/syncthing/syncthing/lib/tlsutil"
 )
 
 type dynamicClient struct {
@@ -31,6 +33,17 @@ type dynamicClient struct {
 	client *staticClient
 }
 
+// The client used for looking up available relays. Lookups are infrequent,
+// so the connection is not kept open afterwards.
+var relayPoolClient = &http.Client{
+	Transport: &http.Transport{
+		DialContext:       dialer.DialContext,
+		Proxy:             http.ProxyFromEnvironment,
+		DisableKeepAlives: true,
+		TLSClientConfig:   tlsutil.SecureDefaultWithTLS12(),
+	},
+}
+
 func newDynamicClient(uri *url.URL, certs []tls.Certificate, invitations chan protocol.SessionInvitation, timeout time.Duration) *dynamicClient {
 	c := &dynamicClient{
 		pooladdr: uri,
@@ -55,7 +68,7 @@ func (c *dynamicClient) serve(ctx context.Context) error {
 		return err
 	}
 	req.Header.Set("User-Agent", build.UserAgent())
-	data, err := http.DefaultClient.Do(req)
+	data, err := relayPoolClient.Do(req)
 	if err != nil {
 		l.Debugln(c, "failed to lookup dynamic relays", err)
 		return err
diff --git a/lib/upgrade/upgrade_supported.go b/lib/upgrade/upgrade_supported.go
index a41749150..97b04ee88 100644
--- a/lib/upgrade/upgrade_supported.go
+++ b/lib/upgrade/upgrade_supported.go
@@ -64,9 +64,10 @@ const (
 var upgradeClient = &http.Client{
 	Timeout: readTimeout,
 	Transport: &http.Transport{
-		DialContext:     dialer.DialContext,
-		Proxy:           http.ProxyFromEnvironment,
-		TLSClientConfig: tlsutil.SecureDefaultWithTLS12(),
+		DialContext:       dialer.DialContext,
+		Proxy:             http.ProxyFromEnvironment,
+		DisableKeepAlives: true, // upgrade checks are hours apart, so don't keep the connection open
+		TLSClientConfig:   tlsutil.SecureDefaultWithTLS12(),
 	},
 }
 
diff --git a/lib/ur/failurereporting.go b/lib/ur/failurereporting.go
index f9be60d71..85a9c9152 100644
--- a/lib/ur/failurereporting.go
+++ b/lib/ur/failurereporting.go
@@ -200,9 +200,10 @@ func sendFailureReports(ctx context.Context, reports []contract.FailureReport, u
 
 	client := &http.Client{
 		Transport: &http.Transport{
-			DialContext:     dialer.DialContext,
-			Proxy:           http.ProxyFromEnvironment,
-			TLSClientConfig: tlsutil.SecureDefaultWithTLS12(),
+			DialContext:       dialer.DialContext,
+			Proxy:             http.ProxyFromEnvironment,
+			DisableKeepAlives: true, // a new client is used for each send, so don't keep the connection open
+			TLSClientConfig:   tlsutil.SecureDefaultWithTLS12(),
 		},
 	}
 
diff --git a/lib/ur/usage_report.go b/lib/ur/usage_report.go
index 65424bace..44a4b24c9 100644
--- a/lib/ur/usage_report.go
+++ b/lib/ur/usage_report.go
@@ -359,8 +359,9 @@ func (s *Service) sendUsageReport(ctx context.Context) error {
 
 	client := &http.Client{
 		Transport: &http.Transport{
-			DialContext: dialer.DialContext,
-			Proxy:       http.ProxyFromEnvironment,
+			DialContext:       dialer.DialContext,
+			Proxy:             http.ProxyFromEnvironment,
+			DisableKeepAlives: true, // reports are sent once a day, so don't keep the connection open
 			TLSClientConfig: &tls.Config{
 				InsecureSkipVerify: s.cfg.Options().URPostInsecurely,
 				MinVersion:         tls.VersionTLS12,