diff --git a/x/upgrade/CHANGELOG.md b/x/upgrade/CHANGELOG.md
index 21feebc10bc4..6bc73a065700 100644
--- a/x/upgrade/CHANGELOG.md
+++ b/x/upgrade/CHANGELOG.md
@@ -25,6 +25,17 @@ Ref: https://keepachangelog.com/en/1.0.0/
 
 ## [Unreleased]
 
+<<<<<<< HEAD
+=======
+### Improvements
+
+* [#18470](https://github.com/cosmos/cosmos-sdk/pull/18470) Improve go-getter settings.
+
+### State Machine Breaking
+
+* (x/upgrade) [#16244](https://github.com/cosmos/cosmos-sdk/pull/16244) Upgrade module no longer stores the app version but gets and sets the app version stored in the `ParamStore` of baseapp.
+
+>>>>>>> e64f3bc6d (refactor(x/upgrade): configure go-getter (#18470))
 ## [v0.1.0](https://github.com/cosmos/cosmos-sdk/releases/tag/x/upgrade/v0.1.0) - 2023-11-07
 
 ### Features
diff --git a/x/upgrade/go.mod b/x/upgrade/go.mod
index 85c55d14350c..1cc37b838e56 100644
--- a/x/upgrade/go.mod
+++ b/x/upgrade/go.mod
@@ -16,8 +16,14 @@ require (
 	github.com/cosmos/gogoproto v1.4.11
 	github.com/golang/protobuf v1.5.3
 	github.com/grpc-ecosystem/grpc-gateway v1.16.0
+<<<<<<< HEAD
 	github.com/hashicorp/go-getter v1.7.1
 	github.com/hashicorp/go-metrics v0.5.1
+=======
+	github.com/hashicorp/go-cleanhttp v0.5.2
+	github.com/hashicorp/go-getter v1.7.3
+	github.com/hashicorp/go-metrics v0.5.2
+>>>>>>> e64f3bc6d (refactor(x/upgrade): configure go-getter (#18470))
 	github.com/spf13/cast v1.5.1
 	github.com/spf13/cobra v1.7.0
 	github.com/spf13/pflag v1.0.5
@@ -97,7 +103,6 @@ require (
 	github.com/gorilla/websocket v1.5.0 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware v1.4.0 // indirect
 	github.com/gsterjov/go-libsecret v0.0.0-20161001094733-a6f4afe4910c // indirect
-	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-hclog v1.5.0 // indirect
 	github.com/hashicorp/go-immutable-radix v1.3.1 // indirect
 	github.com/hashicorp/go-plugin v1.5.2 // indirect
diff --git a/x/upgrade/plan/downloader.go b/x/upgrade/plan/downloader.go
index 1af03d7a2db2..7bcb153bd56e 100644
--- a/x/upgrade/plan/downloader.go
+++ b/x/upgrade/plan/downloader.go
@@ -1,6 +1,7 @@
 package plan
 
 import (
+	"context"
 	"errors"
 	"fmt"
 	neturl "net/url"
@@ -8,6 +9,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"github.com/hashicorp/go-cleanhttp"
 	"github.com/hashicorp/go-getter"
 )
 
@@ -24,8 +26,9 @@ import (
 // NOTE: This functions does not check the provided url for validity.
 func DownloadUpgrade(dstRoot, url, daemonName string) error {
 	target := filepath.Join(dstRoot, "bin", daemonName)
+
 	// First try to download it as a single file. If there's no error, it's okay and we're done.
-	if err := getter.GetFile(target, url); err != nil {
+	if err := getFile(url, target); err != nil {
 		// If it was a checksum error, no need to try as directory.
 		if _, ok := err.(*getter.ChecksumError); ok {
 			return err
@@ -109,7 +112,8 @@ func DownloadURL(url string) (string, error) {
 	}
 	defer os.RemoveAll(tempDir)
 	tempFile := filepath.Join(tempDir, "content")
-	if err = getter.GetFile(tempFile, url); err != nil {
+
+	if err := getFile(url, tempFile); err != nil {
 		return "", fmt.Errorf("could not download url \"%s\": %w", url, err)
 	}
 	tempFileBz, rerr := os.ReadFile(tempFile)
@@ -136,3 +140,27 @@ func ValidateURL(urlStr string, mustChecksum bool) error {
 
 	return nil
 }
+
+// getFile downloads the given url into the provided directory.
+func getFile(url, dst string) error {
+	httpGetter := &getter.HttpGetter{
+		Client:                cleanhttp.DefaultClient(),
+		XTerraformGetDisabled: true,
+	}
+
+	goGetterGetters := getter.Getters
+	goGetterGetters["http"] = httpGetter
+	goGetterGetters["https"] = httpGetter
+
+	// https://github.com/hashicorp/go-getter#security-options
+	getterClient := &getter.Client{
+		Ctx:             context.Background(),
+		DisableSymlinks: true,
+		Src:             url,
+		Dst:             dst,
+		Pwd:             dst,
+		Getters:         goGetterGetters,
+	}
+
+	return getterClient.Get()
+}