diff --git a/lib/connections/quic_listen.go b/lib/connections/quic_listen.go
index 61c43e31d..75bfb5bb0 100644
--- a/lib/connections/quic_listen.go
+++ b/lib/connections/quic_listen.go
@@ -88,8 +88,10 @@ func (t *quicListener) serve(ctx context.Context) error {
 		l.Infoln("Listen (BEP/quic):", err)
 		return err
 	}
+	defer packetConn.Close()
 
 	svc, conn := stun.New(t.cfg, t, packetConn)
+	defer conn.Close()
 	wrapped := &stunConnQUICWrapper{
 		PacketConn: conn,
 		underlying: packetConn.(*net.UDPConn),
@@ -98,29 +100,28 @@ func (t *quicListener) serve(ctx context.Context) error {
 	go svc.Serve(ctx)
 
 	registry.Register(t.uri.Scheme, wrapped)
+	defer registry.Unregister(t.uri.Scheme, wrapped)
 
 	listener, err := quic.Listen(wrapped, t.tlsCfg, quicConfig)
 	if err != nil {
 		l.Infoln("Listen (BEP/quic):", err)
 		return err
 	}
+	defer listener.Close()
+
 	t.notifyAddressesChanged(t)
+	defer t.clearAddresses(t)
 
 	l.Infof("QUIC listener (%v) starting", packetConn.LocalAddr())
+	defer l.Infof("QUIC listener (%v) shutting down", packetConn.LocalAddr())
+
 	t.mut.Lock()
 	t.laddr = packetConn.LocalAddr()
 	t.mut.Unlock()
-
 	defer func() {
-		l.Infof("QUIC listener (%v) shutting down", packetConn.LocalAddr())
 		t.mut.Lock()
 		t.laddr = nil
 		t.mut.Unlock()
-		registry.Unregister(t.uri.Scheme, wrapped)
-		t.clearAddresses(t)
-		_ = listener.Close()
-		_ = conn.Close()
-		_ = packetConn.Close()
 	}()
 
 	acceptFailures := 0
diff --git a/lib/connections/tcp_listen.go b/lib/connections/tcp_listen.go
index 6fc3235e9..54b833a77 100644
--- a/lib/connections/tcp_listen.go
+++ b/lib/connections/tcp_listen.go
@@ -61,34 +61,36 @@ func (t *tcpListener) serve(ctx context.Context) error {
 		l.Infoln("Listen (BEP/tcp):", err)
 		return err
 	}
+	defer listener.Close()
 
 	// We might bind to :0, so use the port we've been given.
 	tcaddr = listener.Addr().(*net.TCPAddr)
 
 	t.notifyAddressesChanged(t)
+	defer t.clearAddresses(t)
+
 	registry.Register(t.uri.Scheme, tcaddr)
+	defer registry.Unregister(t.uri.Scheme, tcaddr)
 
 	l.Infof("TCP listener (%v) starting", tcaddr)
+	defer l.Infof("TCP listener (%v) shutting down", tcaddr)
 
 	mapping := t.natService.NewMapping(nat.TCP, tcaddr.IP, tcaddr.Port)
 	mapping.OnChanged(func(_ *nat.Mapping, _, _ []nat.Address) {
 		t.notifyAddressesChanged(t)
 	})
+	// Should be called after t.mapping is nil'ed out.
+	defer t.natService.RemoveMapping(mapping)
 
 	t.mut.Lock()
 	t.mapping = mapping
 	t.laddr = tcaddr
 	t.mut.Unlock()
-
 	defer func() {
-		l.Infof("TCP listener (%v) shutting down", tcaddr)
-		t.natService.RemoveMapping(mapping)
 		t.mut.Lock()
+		t.mapping = nil
 		t.laddr = nil
 		t.mut.Unlock()
-		registry.Unregister(t.uri.Scheme, tcaddr)
-		t.clearAddresses(t)
-		_ = listener.Close()
 	}()
 
 	acceptFailures := 0
@@ -105,9 +107,6 @@ func (t *tcpListener) serve(ctx context.Context) error {
 			if err == nil {
 				conn.Close()
 			}
-			t.mut.Lock()
-			t.mapping = nil
-			t.mut.Unlock()
 			return nil
 		default:
 		}