A security engineer reviews the TLS configuration of a customer-facing web application. The scan reports that the server still negotiates TLS 1.0 and accepts cipher suites using CBC-mode with RC4 fallback. Penetration testers demonstrate a man-in-the-middle attack that forces the client and server to negotiate the weakest mutually supported protocol version. Which configuration change most directly mitigates this specific downgrade attack while preserving interoperability with modern clients?