diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 0.3.3.1
+
+* Better exception safety via `bracketOnError`
+
 ## 0.3.3
 
 * Add `DigestAuthException` and generalize `applyDigestAuth`
diff --git a/Network/HTTP/Client/TLS.hs b/Network/HTTP/Client/TLS.hs
--- a/Network/HTTP/Client/TLS.hs
+++ b/Network/HTTP/Client/TLS.hs
@@ -114,9 +114,8 @@
     -> IO (S.ByteString -> (Connection -> IO ()) -> String -> Maybe HostAddress -> String -> Int -> IO Connection)
 getTlsProxyConnection mcontext tls sock = do
     context <- maybe NC.initConnectionContext return mcontext
-    return $ \connstr checkConn serverName _ha host port -> do
-        --error $ show (connstr, host, port)
-        conn <- NC.connectTo context NC.ConnectionParams
+    return $ \connstr checkConn serverName _ha host port -> bracketOnError
+        (NC.connectTo context NC.ConnectionParams
             { NC.connectionHostname = serverName
             , NC.connectionPort = fromIntegral port
             , NC.connectionUseSecure = Nothing
@@ -124,16 +123,17 @@
                 case sock of
                     Just _ -> error "Cannot use SOCKS and TLS proxying together"
                     Nothing -> Just $ NC.OtherProxy host $ fromIntegral port
-            }
-
-        NC.connectionPut conn connstr
-        conn' <- convertConnection conn
+            })
+        NC.connectionClose
+        $ \conn -> do
+            NC.connectionPut conn connstr
+            conn' <- convertConnection conn
 
-        checkConn conn'
+            checkConn conn'
 
-        NC.connectionSetSecure context conn tls
+            NC.connectionSetSecure context conn tls
 
-        return conn'
+            return conn'
 
 convertConnection :: NC.Connection -> IO Connection
 convertConnection conn = makeConnection
diff --git a/http-client-tls.cabal b/http-client-tls.cabal
--- a/http-client-tls.cabal
+++ b/http-client-tls.cabal
@@ -1,5 +1,5 @@
 name:                http-client-tls
-version:             0.3.3
+version:             0.3.3.1
 synopsis:            http-client backend using the connection package and tls library
 description:         Hackage documentation generation is not reliable. For up to date documentation, please see: <https://www.stackage.org/package/http-client-tls>.
 homepage:            https://github.com/snoyberg/http-client