diff --git a/quic/core/crypto/crypto_protocol.h b/quic/core/crypto/crypto_protocol.h
index d594f48..e45d73a 100644
--- a/quic/core/crypto/crypto_protocol.h
+++ b/quic/core/crypto/crypto_protocol.h
@@ -28,7 +28,8 @@
 
 // The following tags have been deprecated and should not be reused:
 // "1CON", "BBQ4", "NCON", "RCID", "SREJ", "TBKP", "TB10", "SCLS", "SMHL",
-// "QNZR", "B2HI", "H2PR", "FIFO", "LIFO", "RRWS", "QNSP", "B2CL"
+// "QNZR", "B2HI", "H2PR", "FIFO", "LIFO", "RRWS", "QNSP", "B2CL", "CHSP",
+// "BPTE"
 
 // clang-format off
 const QuicTag kCHLO = TAG('C', 'H', 'L', 'O');   // Client hello
@@ -340,8 +341,8 @@
 
 const QuicTag kNSLC = TAG('N', 'S', 'L', 'C');  // Always send connection close
                                                 // for idle timeout.
-const QuicTag kCHSP = TAG('C', 'H', 'S', 'P');  // Chaos protection.
-const QuicTag kBPTE = TAG('B', 'P', 'T', 'E');  // BoringSSL Permutes
+const QuicTag kNCHP = TAG('N', 'C', 'H', 'P');  // No chaos protection.
+const QuicTag kNBPE = TAG('N', 'B', 'P', 'E');  // No BoringSSL Permutes
                                                 // TLS Extensions.
 
 // Proof types (i.e. certificate types)
diff --git a/quic/core/http/end_to_end_test.cc b/quic/core/http/end_to_end_test.cc
index 0969bdf..c6c6780 100644
--- a/quic/core/http/end_to_end_test.cc
+++ b/quic/core/http/end_to_end_test.cc
@@ -5644,7 +5644,7 @@
   std::vector<std::unique_ptr<QuicEncryptedPacket>> packets_;
 };
 
-TEST_P(EndToEndTest, ChaosProtection) {
+TEST_P(EndToEndTest, ChaosProtectionDisabled) {
   if (!version_.UsesCryptoFrames()) {
     ASSERT_TRUE(Initialize());
     return;
@@ -5653,8 +5653,8 @@
   auto copying_writer = new CopyingPacketWriter(1);
   delete client_writer_;
   client_writer_ = copying_writer;
-  // Enable chaos protection and perform an HTTP request.
-  client_config_.SetClientConnectionOptions(QuicTagVector{kCHSP});
+  // Disable chaos protection and perform an HTTP request.
+  client_config_.SetClientConnectionOptions(QuicTagVector{kNCHP});
   ASSERT_TRUE(Initialize());
   SendSynchronousFooRequestAndCheckResponse();
   // Parse the saved packet to make sure it's valid.
@@ -5667,31 +5667,15 @@
   // can inspect the contents of this packet.
 }
 
-TEST_P(EndToEndTest, ChaosProtectionWithMultiPacketChlo) {
-  if (!version_.UsesCryptoFrames()) {
-    ASSERT_TRUE(Initialize());
-    return;
-  }
-  // Enable chaos protection.
-  client_config_.SetClientConnectionOptions(QuicTagVector{kCHSP});
-  // Add a transport parameter to make the client hello span multiple packets.
-  constexpr auto kCustomParameter =
-      static_cast<TransportParameters::TransportParameterId>(0xff34);
-  client_config_.custom_transport_parameters_to_send()[kCustomParameter] =
-      std::string(2000, '?');
-  ASSERT_TRUE(Initialize());
-  SendSynchronousFooRequestAndCheckResponse();
-}
-
-TEST_P(EndToEndTest, PermuteTlsExtensions) {
+TEST_P(EndToEndTest, DisablePermuteTlsExtensions) {
   if (!version_.UsesTls()) {
     ASSERT_TRUE(Initialize());
     return;
   }
-  // Enable TLS extension permutation and perform an HTTP request.
-  client_config_.SetClientConnectionOptions(QuicTagVector{kBPTE});
+  // Disable TLS extension permutation and perform an HTTP request.
+  client_config_.SetClientConnectionOptions(QuicTagVector{kNBPE});
   ASSERT_TRUE(Initialize());
-  EXPECT_TRUE(GetClientSession()->permutes_tls_extensions());
+  EXPECT_FALSE(GetClientSession()->permutes_tls_extensions());
   SendSynchronousFooRequestAndCheckResponse();
 }
 
diff --git a/quic/core/quic_connection.cc b/quic/core/quic_connection.cc
index 57d16ec..4617e8c 100644
--- a/quic/core/quic_connection.cc
+++ b/quic/core/quic_connection.cc
@@ -523,8 +523,8 @@
   } else {
     SetNetworkTimeouts(config.max_time_before_crypto_handshake(),
                        config.max_idle_time_before_crypto_handshake());
-    if (config.HasClientRequestedIndependentOption(kCHSP, perspective_)) {
-      packet_creator_.set_chaos_protection_enabled(true);
+    if (config.HasClientRequestedIndependentOption(kNCHP, perspective_)) {
+      packet_creator_.set_chaos_protection_enabled(false);
     }
   }
 
diff --git a/quic/core/quic_packet_creator.cc b/quic/core/quic_packet_creator.cc
index 94cf48a..a9f16e0 100644
--- a/quic/core/quic_packet_creator.cc
+++ b/quic/core/quic_packet_creator.cc
@@ -109,8 +109,7 @@
                         delegate) {}
 
 QuicPacketCreator::QuicPacketCreator(QuicConnectionId server_connection_id,
-                                     QuicFramer* framer,
-                                     QuicRandom* random,
+                                     QuicFramer* framer, QuicRandom* random,
                                      DelegateInterface* delegate)
     : delegate_(delegate),
       debug_delegate_(nullptr),
@@ -123,11 +122,7 @@
       packet_size_(0),
       server_connection_id_(server_connection_id),
       client_connection_id_(EmptyQuicConnectionId()),
-      packet_(QuicPacketNumber(),
-              PACKET_1BYTE_PACKET_NUMBER,
-              nullptr,
-              0,
-              false,
+      packet_(QuicPacketNumber(), PACKET_1BYTE_PACKET_NUMBER, nullptr, 0, false,
               false),
       pending_padding_bytes_(0),
       needs_full_padding_(false),
@@ -136,7 +131,8 @@
       fully_pad_crypto_handshake_packets_(true),
       latched_hard_max_packet_length_(0),
       max_datagram_frame_size_(0),
-      chaos_protection_enabled_(false) {
+      chaos_protection_enabled_(framer->perspective() ==
+                                Perspective::IS_CLIENT) {
   SetMaxPacketLength(kDefaultMaxPacketSize);
   if (!framer_->version().UsesTls()) {
     // QUIC+TLS negotiates the maximum datagram frame size via the
diff --git a/quic/core/quic_session.cc b/quic/core/quic_session.cc
index 1e07162..2912b3d 100644
--- a/quic/core/quic_session.cc
+++ b/quic/core/quic_session.cc
@@ -147,8 +147,8 @@
       connection_->set_can_receive_ack_frequency_frame();
       config_.SetMinAckDelayMs(kDefaultMinAckDelayTimeMs);
     }
-    if (config_.HasClientRequestedIndependentOption(kBPTE, perspective_)) {
-      permutes_tls_extensions_ = true;
+    if (config_.HasClientRequestedIndependentOption(kNBPE, perspective_)) {
+      permutes_tls_extensions_ = false;
     }
   }
 
diff --git a/quic/core/quic_session.h b/quic/core/quic_session.h
index 76e4805..7fc0a80 100644
--- a/quic/core/quic_session.h
+++ b/quic/core/quic_session.h
@@ -958,7 +958,7 @@
   bool liveness_testing_in_progress_;
 
   // Whether BoringSSL randomizes the order of TLS extensions.
-  bool permutes_tls_extensions_ = false;
+  bool permutes_tls_extensions_ = true;
 
   const bool quic_tls_disable_resumption_refactor_ =
       GetQuicReloadableFlag(quic_tls_disable_resumption_refactor);
diff --git a/quic/core/tls_client_handshaker.cc b/quic/core/tls_client_handshaker.cc
index 737f449..4010590 100644
--- a/quic/core/tls_client_handshaker.cc
+++ b/quic/core/tls_client_handshaker.cc
@@ -74,13 +74,14 @@
 
   // TODO(b/193650832) Add SetFromConfig to QUIC handshakers and remove reliance
   // on session pointer.
-  if (session()->permutes_tls_extensions()) {
-    // Ask BoringSSL to randomize the order of TLS extensions.
-#if BORINGSSL_API_VERSION >= 16
-    QUIC_DLOG(INFO) << "Enabling TLS extension permutation";
-    SSL_set_permute_extensions(ssl(), true);
-#endif  // BORINGSSL_API_VERSION
+  const bool permutes_tls_extensions = session()->permutes_tls_extensions();
+  if (!permutes_tls_extensions) {
+    QUIC_DLOG(INFO) << "Disabling TLS extension permutation";
   }
+#if BORINGSSL_API_VERSION >= 16
+  // Ask BoringSSL to randomize the order of TLS extensions.
+  SSL_set_permute_extensions(ssl(), permutes_tls_extensions);
+#endif  // BORINGSSL_API_VERSION
 
   // Set the SNI to send, if any.
   SSL_set_connect_state(ssl());