diff --git a/cmd/cloudflared/tunnel/cmd.go b/cmd/cloudflared/tunnel/cmd.go
index 84aa82e1..f39a3a9b 100644
--- a/cmd/cloudflared/tunnel/cmd.go
+++ b/cmd/cloudflared/tunnel/cmd.go
@@ -181,6 +181,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	listeners := gracenet.Net{}
 	errC := make(chan error)
 	connectedSignal := make(chan struct{})
+	closeConnOnce := sync.Once{}
 	dnsReadySignal := make(chan struct{})
 
 	if c.String("config") == "" {
@@ -280,7 +281,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 
 	// Serve DNS proxy stand-alone if no hostname or tag or app is going to run
 	if dnsProxyStandAlone(c) {
-		close(connectedSignal)
+		closeConnOnce.Do(func() { close(connectedSignal) })
 		// no grace period, handle SIGINT/SIGTERM immediately
 		return waitToShutdown(&wg, errC, shutdownC, graceShutdownC, 0)
 	}
@@ -315,6 +316,7 @@ func StartServer(c *cli.Context, version string, shutdownC, graceShutdownC chan
 	}
 
 	tunnelConfig, err := prepareTunnelConfig(c, buildInfo, version, logger, transportLogger)
+	tunnelConfig.CloseConnOnce = &closeConnOnce
 	if err != nil {
 		return err
 	}
diff --git a/origin/tunnel.go b/origin/tunnel.go
index 22984b92..ea373e0d 100644
--- a/origin/tunnel.go
+++ b/origin/tunnel.go
@@ -11,10 +11,9 @@ import (
 	"net/url"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
-	"golang.org/x/sync/errgroup"
-
 	"github.com/cloudflare/cloudflared/h2mux"
 	"github.com/cloudflare/cloudflared/tunnelrpc"
 	tunnelpogs "github.com/cloudflare/cloudflared/tunnelrpc/pogs"
@@ -26,6 +25,7 @@ import (
 	"github.com/pkg/errors"
 	_ "github.com/prometheus/client_golang/prometheus"
 	log "github.com/sirupsen/logrus"
+	"golang.org/x/sync/errgroup"
 	rpc "zombiezen.com/go/capnproto2/rpc"
 )
 
@@ -64,6 +64,7 @@ type TunnelConfig struct {
 	WSGI               bool
 	CompressionQuality uint64
 	IncidentLookup     IncidentLookup
+	CloseConnOnce      *sync.Once // Used to close connectedSignal no more than once
 }
 
 type dialError struct {
@@ -161,11 +162,10 @@ func ServeTunnelLoop(ctx context.Context,
 	config.Metrics.incrementHaConnections()
 	defer config.Metrics.decrementHaConnections()
 	backoff := BackoffHandler{MaxRetries: config.Retries}
-	// Used to close connectedSignal no more than once
 	connectedFuse := h2mux.NewBooleanFuse()
 	go func() {
 		if connectedFuse.Await() {
-			close(connectedSignal)
+			config.CloseConnOnce.Do(func() { close(connectedSignal) })
 		}
 	}()
 	// Ensure the above goroutine will terminate if we return without connecting