How to force istio-ingressgateway to use tls 1.3 towards upstream

I want to use tls1.3 when sending requests through the istio-ingressgateway to an upstream host. However, it looks like istio only uses tls 1.2 here. How can we force the request to be tls 1.3 ?