A catch-all solution, that I've been using for many years, is to have a MITM proxy on the network do transparent TLS upgrading for everything that passes through it.

Then you'll inevitably run into other more nefarious forms of user-agent-discrimination via TLS fingerprinting[1], in which case https://news.ycombinator.com/item?id=43571099 will also be useful.

[1] Seeing a TLS 1.3 connection from a system identifying itself as Mac OS 7 will definitely trip a lot of "bot detection" software.