@@ -16,6 +16,8 @@
 from collections import OrderedDict
 from typing import TYPE_CHECKING, Any, Callable, Dict, Optional, Tuple
 
+from urllib3.util.ssl_ import ALPN_PROTOCOLS
+
 if TYPE_CHECKING:
     from databricks.sql.types import SSLOptions
 
@@ -26,6 +28,41 @@
 _contexts: "OrderedDict[tuple, Tuple[ssl.SSLContext, float]]" = OrderedDict()
 _build_locks: Dict[tuple, Any] = {}
 
+_BASE_CONTEXT_CLASS = ssl.SSLContext
+
+
+class _SharedSSLContext(_BASE_CONTEXT_CLASS):  # type: ignore[valid-type,misc]
+    """A cached context that ignores same-value writes.
+
+    urllib3 re-applies ALPN and verify_mode to its context on every connection.
+    SSL_new() copies the context's ALPN buffer without the GIL, so replacing
+    that buffer while another thread connects can corrupt the ClientHello.
+    """
+
+    def set_alpn_protocols(self, alpn_protocols):
+        protocols = list(alpn_protocols)
+        if protocols != getattr(self, "_shared_alpn_protocols", None):
+            super().set_alpn_protocols(protocols)
+            self._shared_alpn_protocols = protocols
+
+    @property
+    def verify_mode(self):
+        return super().verify_mode
+
+    @verify_mode.setter
+    def verify_mode(self, value):
+        if super().verify_mode != value:
+            _BASE_CONTEXT_CLASS.verify_mode.__set__(self, value)
+
+
+def _make_shareable(context: ssl.SSLContext) -> bool:
+    # Only plain stdlib contexts are shared; others (e.g. pyOpenSSL) stay per caller.
+    if type(context) is not _BASE_CONTEXT_CLASS:
+        return False
+    context.__class__ = _SharedSSLContext
+    context.set_alpn_protocols(ALPN_PROTOCOLS)
+    return True
+
 
 def _file_signature(path) -> Optional[Tuple]:
     # Rewriting or replacing a CA file yields a new key, so rotation is picked up.
@@ -74,9 +111,11 @@ def get_ssl_context(
 
     ``kind`` separates builders that configure contexts differently. urllib3
     writes a pool's ``cert_reqs`` and ALPN protocols back onto its context on
-    every connection, so every pool sharing a context must use TLS pool kwargs
-    derived only from ``ssl_options`` (and no ``assert_hostname``). Do not
-    otherwise modify the returned context.
+    every connection; the shared context skips those writes only when nothing
+    changes, so every pool sharing a context must use TLS pool kwargs derived
+    only from ``ssl_options`` (and no ``assert_hostname``). Do not otherwise
+    modify the returned context. Contexts other than plain ``ssl.SSLContext``
+    are returned without caching.
     """
     if not is_cacheable(ssl_options):
         return build()
@@ -96,9 +135,13 @@ def get_ssl_context(
             return context
         try:
             context = build()
+            shareable = _make_shareable(context)
         except BaseException:
             _forget_build_lock(key, key_lock)
             raise
+        if not shareable:
+            _forget_build_lock(key, key_lock)
+            return context
         with _lock:
             _contexts[key] = (context, time.monotonic())
             _contexts.move_to_end(key)
 
@@ -18,11 +18,16 @@
 from databricks.sql.types import SSLOptions
 
 
+def bare_context():
+    # Real but cheap: no CA bundle is loaded.
+    return ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+
+
 def counting_builder():
     built = []
 
     def build():
-        context = Mock(spec=ssl.SSLContext)
+        context = bare_context()
         built.append(context)
         return context
 
@@ -144,7 +149,7 @@ def test_concurrent_first_use_builds_once(self):
 
         def slow_build():
             time.sleep(0.05)
-            context = Mock(spec=ssl.SSLContext)
+            context = bare_context()
             built.append(context)
             return context
 
@@ -175,7 +180,7 @@ def test_slow_build_does_not_block_other_keys(self):
 
         def stuck_build():
             release.wait(10)
-            return Mock(spec=ssl.SSLContext)
+            return bare_context()
 
         stuck = threading.Thread(
             target=ssl_context_cache.get_ssl_context,
@@ -233,6 +238,70 @@ def test_cache_is_bounded(self, monkeypatch):
             built[0]
         )
 
+    def test_non_stdlib_contexts_are_not_cached(self):
+        build = Mock(side_effect=lambda: Mock(spec=ssl.SSLContext))
+
+        first = ssl_context_cache.get_ssl_context("k", SSLOptions(), build)
+        second = ssl_context_cache.get_ssl_context("k", SSLOptions(), build)
+
+        assert first is not second
+        assert not ssl_context_cache._contexts
+
+    def test_shared_context_skips_same_value_writes(self):
+        context = ssl_context_cache.get_ssl_context("k", SSLOptions(), bare_context)
+        assert isinstance(context, ssl.SSLContext)
+
+        with patch.object(ssl.SSLContext, "_set_alpn_protocols") as set_alpn:
+            context.set_alpn_protocols(["http/1.1"])  # what urllib3 sends
+            set_alpn.assert_not_called()
+            context.set_alpn_protocols(["h2"])
+            set_alpn.assert_called_once()
+
+        real = ssl.SSLContext.verify_mode
+        writes = []
+
+        def spy_set(self, value):
+            writes.append(value)
+            real.fset(self, value)
+
+        context.check_hostname = False
+        with patch.object(ssl.SSLContext, "verify_mode", property(real.fget, spy_set)):
+            context.verify_mode = ssl.CERT_REQUIRED
+            assert writes == []
+            context.verify_mode = ssl.CERT_NONE
+            assert writes == [ssl.CERT_NONE]
+        assert context.verify_mode == ssl.CERT_NONE
+
+    def test_reset_after_fork_releases_locks(self):
+        held = threading.Event()
+        release = threading.Event()
+
+        def hold_locks():
+            with ssl_context_cache._lock:
+                held.set()
+                release.wait(10)
+
+        holder = threading.Thread(target=hold_locks)
+        holder.start()
+        held.wait(5)
+        stuck_build_lock = threading.Lock()
+        stuck_build_lock.acquire()
+        key = ssl_context_cache._cache_key("k", SSLOptions())
+        ssl_context_cache._build_locks[key] = stuck_build_lock
+        try:
+            ssl_context_cache._reset_after_fork()  # as in a forked child
+
+            done = threading.Thread(
+                target=ssl_context_cache.get_ssl_context,
+                args=("k", SSLOptions(), bare_context),
+            )
+            done.start()
+            done.join(timeout=2)
+            assert not done.is_alive()
+        finally:
+            release.set()
+            holder.join()
+
 
 class TestThriftTransportContext:
     @staticmethod