diff --git a/agent/node.go b/agent/node.go
index 6de6e57d26..232fc190fd 100644
--- a/agent/node.go
+++ b/agent/node.go
@@ -339,6 +339,7 @@ func (n *Node) Stop(ctx context.Context) error {
 			return ctx.Err()
 		default:
 			close(n.stopped)
+			n.setControlSocket(nil)
 			// recurse and wait for closure
 			return n.Stop(ctx)
 		}
@@ -377,6 +378,7 @@ func (n *Node) runAgent(ctx context.Context, db *bolt.DB, creds credentials.Tran
 	if err != nil {
 		return err
 	}
+	defer conn.Close()
 
 	agent, err := New(&Config{
 		Hostname:         n.config.Hostname,
@@ -430,7 +432,9 @@ func (n *Node) CertificateRequested() <-chan struct{} {
 func (n *Node) setControlSocket(conn *grpc.ClientConn) {
 	n.Lock()
 	if n.conn != nil {
-		n.conn.Close()
+		if err := n.conn.Close(); err != nil {
+			log.L.WithError(err).Error("closing grpc connection failed")
+		}
 	}
 	n.conn = conn
 	n.connCond.Broadcast()