diff --git a/sslscan.c b/sslscan.c
index febf977..1acb750 100644
--- a/sslscan.c
+++ b/sslscan.c
@@ -5755,9 +5755,42 @@ int testSupportedGroups(struct sslCheckOptions *options) {
     if (tls_version == TLSv1_3)
       ciphersuite_list = makeCiphersuiteListAll(tls_version);
     else {
-      /* For some reason, with TLSv1.2 (and maybe below), passing all ciphersuites causes false negatives.  So we use a string of bytes sniffed from an OpenSSL client connection. */
+      /* Restrict to ephemeral (ECDHE/DHE) suites only: only ephemeral key exchange causes the
+         server to negotiate a named group, which is what this scan is trying to discover.
+         Static-KX suites (RSA, DH, ECDH) never produce a group in the server response. */
       bs_new(&ciphersuite_list);
-      bs_append_bytes(ciphersuite_list, (unsigned char []) { 0xc0, 0x30, 0xc0, 0x2c, 0xc0, 0x28, 0xc0, 0x24, 0xc0, 0x14, 0xc0, 0x0a, 0x00, 0xa5, 0x00, 0xa3, 0x00, 0xa1, 0x00, 0x9f, 0x00, 0x6b, 0x00, 0x6a, 0x00, 0x69, 0x00, 0x68, 0x00, 0x39, 0x00, 0x38, 0x00, 0x37, 0x00, 0x36, 0x00, 0x88, 0x00, 0x87, 0x00, 0x86, 0x00, 0x85, 0xc0, 0x32, 0xc0, 0x2e, 0xc0, 0x2a, 0xc0, 0x26, 0xc0, 0x0f, 0xc0, 0x05, 0x00, 0x9d, 0x00, 0x3d, 0x00, 0x35, 0x00, 0x84, 0xc0, 0x2f, 0xc0, 0x2b, 0xc0, 0x27, 0xc0, 0x23, 0xc0, 0x13, 0xc0, 0x09, 0x00, 0xa4, 0x00, 0xa2, 0x00, 0xa0, 0x00, 0x9e, 0x00, 0x67, 0x00, 0x40, 0x00, 0x3f, 0x00, 0x3e, 0x00, 0x33, 0x00, 0x32, 0x00, 0x31, 0x00, 0x30, 0x00, 0x9a, 0x00, 0x99, 0x00, 0x98, 0x00, 0x97, 0x00, 0x45, 0x00, 0x44, 0x00, 0x43, 0x00, 0x42, 0xc0, 0x31, 0xc0, 0x2d, 0xc0, 0x29, 0xc0, 0x25, 0xc0, 0x0e, 0xc0, 0x04, 0x00, 0x9c, 0x00, 0x3c, 0x00, 0x2f, 0x00, 0x96, 0x00, 0x41, 0xc0, 0x11, 0xc0, 0x07, 0xc0, 0x0c, 0xc0, 0x02, 0x00, 0x05, 0x00, 0x04, 0xc0, 0x12, 0xc0, 0x08, 0x00, 0x16, 0x00, 0x13, 0x00, 0x10, 0x00, 0x0d, 0xc0, 0x0d, 0xc0, 0x03, 0x00, 0x0a, 0x00, 0xff }, 170);
+      bs_append_bytes(ciphersuite_list, (unsigned char []) {
+        /* ECDHE AES-256 */
+        0xC0, 0x30,  /* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384   */
+        0xC0, 0x2C,  /* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 */
+        0xC0, 0x28,  /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384   */
+        0xC0, 0x24,  /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 */
+        0xC0, 0x14,  /* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA      */
+        0xC0, 0x0A,  /* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA    */
+        /* ECDHE AES-128 */
+        0xC0, 0x2F,  /* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256   */
+        0xC0, 0x2B,  /* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 */
+        0xC0, 0x27,  /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256   */
+        0xC0, 0x23,  /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 */
+        0xC0, 0x13,  /* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA      */
+        0xC0, 0x09,  /* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA    */
+        /* DHE AES-256 */
+        0x00, 0x9F,  /* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384     */
+        0x00, 0xA3,  /* TLS_DHE_DSS_WITH_AES_256_GCM_SHA384     */
+        0x00, 0x6B,  /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256     */
+        0x00, 0x6A,  /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA256     */
+        0x00, 0x39,  /* TLS_DHE_RSA_WITH_AES_256_CBC_SHA        */
+        0x00, 0x38,  /* TLS_DHE_DSS_WITH_AES_256_CBC_SHA        */
+        /* DHE AES-128 */
+        0x00, 0x9E,  /* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256     */
+        0x00, 0xA2,  /* TLS_DHE_DSS_WITH_AES_128_GCM_SHA256     */
+        0x00, 0x67,  /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256     */
+        0x00, 0x40,  /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA256     */
+        0x00, 0x33,  /* TLS_DHE_RSA_WITH_AES_128_CBC_SHA        */
+        0x00, 0x32,  /* TLS_DHE_DSS_WITH_AES_128_CBC_SHA        */
+        /* SCSV */
+        0x00, 0xFF   /* TLS_EMPTY_RENEGOTIATION_INFO_SCSV       */
+      }, 50);
     }
 
     /* For each key exchange group... */