diff --git a/proxywatchd.py b/proxywatchd.py
index 5854f0d..1981752 100644
--- a/proxywatchd.py
+++ b/proxywatchd.py
@@ -1463,6 +1463,11 @@ class TargetTestJob():
                     return None, proto, duration, torhost, srvname, 0, use_ssl, 'ssl_mitm'
                 elif et == rocksock.RS_ET_SSL and not ssl_only_check:
                     # SSL failed but proxy protocol worked - fallback to HTTP
+                    # sock already disconnected above, but ensure cleanup
+                    try:
+                        sock.disconnect()
+                    except Exception:
+                        pass
                     if config.watchd.debug:
                         _log('SSL failed, fallback to HTTP: %s://%s:%d' % (proto, ps.ip, ps.port), 'debug')
                     try: