diff --git a/ChangeLog.d/default-curves.txt b/ChangeLog.d/default-curves.txt
index 1a80562..bfb0fd0 100644
--- a/ChangeLog.d/default-curves.txt
+++ b/ChangeLog.d/default-curves.txt
@@ -1,7 +1,8 @@
 Default behavior changes
    * Some default policies for X.509 certificate verification and TLS have
      changed: curves and hashes weaker than 255 bits are no longer accepted
-     by default.
+     by default. The default order in TLS now favors faster curves over larger
+     curves.
 
 Removals
    * Remove the compile-time option
diff --git a/docs/3.0-migration-guide.d/default-curves.md b/docs/3.0-migration-guide.d/default-curves.md
index 5db517e..5879d77 100644
--- a/docs/3.0-migration-guide.d/default-curves.md
+++ b/docs/3.0-migration-guide.d/default-curves.md
@@ -14,3 +14,10 @@
 ```
 
 If you still need to allow hashes and curves in TLS that have been removed from the default configuration, call `mbedtls_ssl_conf_sig_hashes()` and `mbedtls_ssl_conf_curves()` with the desired lists.
+
+TLS now favors faster curves over larger curves
+-----------------------------------------------
+
+The default preference order for curves in TLS now favors resource usage (performance and memory consumption) over size. The exact order is unspecified and may change, but generally you can expect 256-bit curves to be preferred.
+
+If you prefer a different order, call `mbedtls_ssl_conf_curves()` when configuring a TLS connection.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index df3974a..d885d21 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -2916,8 +2916,7 @@
  * \note           The default list is the same set of curves that
  *                 #mbedtls_x509_crt_profile_default allows, plus
  *                 ECDHE-only curves selected according to the same criteria.
- *                 Larger (generally more secure but slower) curves are
- *                 preferred over smaller curves.
+ *                 The order favors curves with the lowest resource usage.
  *
  * \param conf     SSL configuration
  * \param curves   Ordered list of allowed curves,
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index be389f0..07569b2 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -6120,27 +6120,12 @@
 #if defined(MBEDTLS_ECP_C)
 /* The selection should be the same as mbedtls_x509_crt_profile_default in
  * x509_crt.c, plus Montgomery curves for ECDHE. Here, the order matters:
- * larger curves first, like ecp_supported_curves in ecp.c.
+ * curves with a lower resource usage come first.
  * See the documentation of mbedtls_ssl_conf_curves() for what we promise
- * about this list. */
+ * about this list.
+ */
 static mbedtls_ecp_group_id ssl_preset_default_curves[] = {
-#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
-    MBEDTLS_ECP_DP_SECP521R1,
-#endif
-#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
-    MBEDTLS_ECP_DP_BP512R1,
-#endif
-#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
-    MBEDTLS_ECP_DP_CURVE448,
-#endif
-#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
-    MBEDTLS_ECP_DP_SECP384R1,
-#endif
-#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
-    MBEDTLS_ECP_DP_BP384R1,
-#endif
 #if defined(MBEDTLS_ECP_DP_CURVE25519_ENABLED)
-    // Positioned in the list as a fast 256-bit curve, not as a 255-bit curve
     MBEDTLS_ECP_DP_CURVE25519,
 #endif
 #if defined(MBEDTLS_ECP_DP_SECP256R1_ENABLED)
@@ -6149,9 +6134,24 @@
 #if defined(MBEDTLS_ECP_DP_SECP256K1_ENABLED)
     MBEDTLS_ECP_DP_SECP256K1,
 #endif
+#if defined(MBEDTLS_ECP_DP_SECP384R1_ENABLED)
+    MBEDTLS_ECP_DP_SECP384R1,
+#endif
+#if defined(MBEDTLS_ECP_DP_CURVE448_ENABLED)
+    MBEDTLS_ECP_DP_CURVE448,
+#endif
+#if defined(MBEDTLS_ECP_DP_SECP521R1_ENABLED)
+    MBEDTLS_ECP_DP_SECP521R1,
+#endif
 #if defined(MBEDTLS_ECP_DP_BP256R1_ENABLED)
     MBEDTLS_ECP_DP_BP256R1,
 #endif
+#if defined(MBEDTLS_ECP_DP_BP384R1_ENABLED)
+    MBEDTLS_ECP_DP_BP384R1,
+#endif
+#if defined(MBEDTLS_ECP_DP_BP512R1_ENABLED)
+    MBEDTLS_ECP_DP_BP512R1,
+#endif
     MBEDTLS_ECP_DP_NONE
 };
 #endif