diff --git a/client/auth.go b/client/auth.go
index 952accec5..2035e5c21 100644
--- a/client/auth.go
+++ b/client/auth.go
@@ -222,6 +222,8 @@ func (c *Conn) writeAuthHandshake() error {
 		c.ccaps&mysql.CLIENT_COMPRESS | c.ccaps&mysql.CLIENT_ZSTD_COMPRESSION_ALGORITHM |
 		c.ccaps&mysql.CLIENT_LOCAL_FILES
 
+	capability &^= c.clientExplicitOffCaps
+
 	// To enable TLS / SSL
 	if c.tlsConfig != nil {
 		capability |= mysql.CLIENT_SSL
diff --git a/client/conn.go b/client/conn.go
index cf56399ad..572fe2b09 100644
--- a/client/conn.go
+++ b/client/conn.go
@@ -45,6 +45,9 @@ type Conn struct {
 	capability uint32
 	// client-set capabilities only
 	ccaps uint32
+	// Capability flags explicitly disabled by the client via UnsetCapability()
+	// These flags are removed from the final advertised capability set during handshake.
+	clientExplicitOffCaps uint32
 
 	attributes map[string]string
 
@@ -234,14 +237,17 @@ func (c *Conn) Ping() error {
 	return nil
 }
 
-// SetCapability enables the use of a specific capability
+// SetCapability marks the specified flag as explicitly enabled by the client.
 func (c *Conn) SetCapability(cap uint32) {
 	c.ccaps |= cap
+	c.clientExplicitOffCaps &^= cap
 }
 
-// UnsetCapability disables the use of a specific capability
+// UnsetCapability marks the specified flag as explicitly disabled by the client.
+// This disables the flag even if the server supports it.
 func (c *Conn) UnsetCapability(cap uint32) {
-	c.ccaps &= ^cap
+	c.ccaps &^= cap
+	c.clientExplicitOffCaps |= cap
 }
 
 // HasCapability returns true if the connection has the specific capability