diff --git a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/connectivity/ConnectivityProbe.kt b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/connectivity/ConnectivityProbe.kt
index b76fc4787..2644d2640 100644
--- a/src/frontends/android/app/src/main/java/org/strongswan/android/logic/connectivity/ConnectivityProbe.kt
+++ b/src/frontends/android/app/src/main/java/org/strongswan/android/logic/connectivity/ConnectivityProbe.kt
@@ -94,8 +94,12 @@ object ConnectivityProbe
 				 * throw (e.g. EPERM when the caller is disallowed from that
 				 * network), so it must stay inside the try */
 				val socket = if (network != null) network.socketFactory.createSocket() else Socket()
-				socket.tcpNoDelay = true
-				socket.connect(InetSocketAddress(host, port), timeoutMs)
+				/* close right away: a leaked socket holds an fd until GC and
+				 * the peer's later FIN/RST wakes the radio a second time */
+				socket.use {
+					it.tcpNoDelay = true
+					it.connect(InetSocketAddress(host, port), timeoutMs)
+				}
 				ProbeResult(target = target, ok = true, rttMs = (System.nanoTime() - started) / 1_000_000)
 			}
 			catch (_: Exception)