diff --git a/internal/engine/netx/quicdialer/system.go b/internal/engine/netx/quicdialer/system.go
index 392378f..3507460 100644
--- a/internal/engine/netx/quicdialer/system.go
+++ b/internal/engine/netx/quicdialer/system.go
@@ -11,7 +11,7 @@ import (
 
 // QUICListener listens for QUIC connections.
 type QUICListener interface {
-	// Listen creates a new listening net.PacketConn.
+	// Listen creates a new listening PacketConn.
 	Listen(addr *net.UDPAddr) (net.PacketConn, error)
 }
 
diff --git a/internal/netxlite/quic.go b/internal/netxlite/quic.go
index 5ae1749..d02e5ef 100644
--- a/internal/netxlite/quic.go
+++ b/internal/netxlite/quic.go
@@ -30,7 +30,7 @@ type QUICDialer interface {
 
 // QUICListener listens for QUIC connections.
 type QUICListener interface {
-	// Listen creates a new listening net.PacketConn.
+	// Listen creates a new listening PacketConn.
 	Listen(addr *net.UDPAddr) (net.PacketConn, error)
 }
 
@@ -76,6 +76,27 @@ func (d *QUICDialerQUICGo) DialContext(ctx context.Context, network string,
 		return nil, err
 	}
 	udpAddr := &net.UDPAddr{IP: ip, Port: port, Zone: ""}
-	return quic.DialEarlyContext(
+	sess, err := quic.DialEarlyContext(
 		ctx, pconn, udpAddr, address, tlsConfig, quicConfig)
+	if err != nil {
+		return nil, err
+	}
+	return &quicSessionOwnsConn{EarlySession: sess, conn: pconn}, nil
+}
+
+// quicSessionOwnsConn ensures that we close the PacketConn.
+type quicSessionOwnsConn struct {
+	// EarlySession is the embedded early session
+	quic.EarlySession
+
+	// conn is the connection we own
+	conn net.PacketConn
+}
+
+// CloseWithError implements quic.EarlySession.CloseWithError.
+func (sess *quicSessionOwnsConn) CloseWithError(
+	code quic.ApplicationErrorCode, reason string) error {
+	err := sess.EarlySession.CloseWithError(code, reason)
+	sess.conn.Close()
+	return err
 }
diff --git a/internal/netxlite/quic_test.go b/internal/netxlite/quic_test.go
index 4d6e2b2..873a279 100644
--- a/internal/netxlite/quic_test.go
+++ b/internal/netxlite/quic_test.go
@@ -94,6 +94,26 @@ func TestQUICDialerQUICGoCannotListen(t *testing.T) {
 	}
 }
 
+func TestQUICDialerCannotPerformHandshake(t *testing.T) {
+	tlsConfig := &tls.Config{
+		NextProtos: []string{"h3"},
+		ServerName: "dns.google",
+	}
+	systemdialer := QUICDialerQUICGo{
+		QUICListener: &QUICListenerStdlib{},
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel() // fail immediately
+	sess, err := systemdialer.DialContext(
+		ctx, "udp", "8.8.8.8:443", tlsConfig, &quic.Config{})
+	if !errors.Is(err, context.Canceled) {
+		t.Fatal("not the error we expected", err)
+	}
+	if sess != nil {
+		log.Fatal("expected nil session here")
+	}
+}
+
 func TestQUICDialerWorksAsIntended(t *testing.T) {
 	tlsConfig := &tls.Config{
 		NextProtos: []string{"h3"},
@@ -108,6 +128,7 @@ func TestQUICDialerWorksAsIntended(t *testing.T) {
 	if err != nil {
 		t.Fatal("not the error we expected", err)
 	}
+	<-sess.HandshakeComplete().Done()
 	if err := sess.CloseWithError(0, ""); err != nil {
 		log.Fatal(err)
 	}