diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 1.2.2
+
+* Make runTLS{Client,Server}StartTLS general [#264](https://github.com/snoyberg/conduit/pull/264)
+
 ## 1.2.1
 
 * Expose ApplicationStartTLS [#262](https://github.com/snoyberg/conduit/pull/262)
diff --git a/Data/Conduit/Network/TLS.hs b/Data/Conduit/Network/TLS.hs
--- a/Data/Conduit/Network/TLS.hs
+++ b/Data/Conduit/Network/TLS.hs
@@ -7,6 +7,7 @@
 module Data.Conduit.Network.TLS
     ( -- * Common
       ApplicationStartTLS
+    , GeneralApplicationStartTLS
       -- * Server
     , TLSConfig
     , tlsConfigBS
@@ -50,6 +51,7 @@
 import Control.Exception (bracket)
 import Control.Monad.Trans.Class (lift)
 import Control.Monad.IO.Class (liftIO, MonadIO)
+import Control.Monad.Base (liftBase)
 import qualified Network.TLS.Extra as TLSExtra
 import Network.Socket (Socket)
 import qualified Data.ByteString as S
@@ -163,8 +165,13 @@
             app (tlsAppData ctx addr mlocal)
             TLS.bye ctx
 
-type ApplicationStartTLS = (AppData, (AppData -> IO ()) -> IO ()) -> IO ()
+-- |
+--
+-- @since 1.2.2
+type GeneralApplicationStartTLS m a = (AppData, (AppData -> m ()) -> m ()) -> m a
 
+type ApplicationStartTLS = GeneralApplicationStartTLS IO ()
+
 -- | Like 'runTCPServerTLS', but monad can be any instance of 'MonadBaseControl' 'IO'.
 --
 -- Note that any changes to the monadic state performed by individual
@@ -187,17 +194,17 @@
 --    unless (abortTLS) $ startTls $ appDataTls -> do
 --      doSomethingSSL appDataTls
 --  @
-runTCPServerStartTLS :: TLSConfig -> ApplicationStartTLS -> IO ()
+runTCPServerStartTLS :: MonadBaseControl IO m => TLSConfig -> GeneralApplicationStartTLS m () -> m ()
 runTCPServerStartTLS TLSConfig{..} app = do
-    creds <- readCreds tlsCertData
+    creds <- liftBase $ readCreds tlsCertData
 
-    runTCPServerWithHandle settings (wrapApp creds)
+    liftBaseWith $ \run -> runTCPServerWithHandle settings (wrapApp creds run)
 
     where
       -- convert tls settings to regular conduit network ones
       settings = serverSettings tlsPort tlsHost  -- (const $ return () ) tlsNeedLocalAddr
 
-      wrapApp creds = clearapp
+      wrapApp creds run = clearapp
         where clearapp socket addr mlocal = let
                 -- setup app data for the clear part of the connection
                 clearData = AppData
@@ -214,11 +221,11 @@
                   }
                 -- wrap up the current connection with TLS
                 startTls = \app' -> do
-                  ctx <- serverHandshake socket creds
+                  ctx <- liftBase $ serverHandshake socket creds
                   app' (tlsAppData ctx addr mlocal)
-                  TLS.bye ctx
+                  liftBase $ TLS.bye ctx
                 in
-                 app (clearData, startTls)
+                 void $ run $ app (clearData, startTls)
 
 -- | Create an @AppData@ from an existing tls @Context@ value. This is a lower level function, allowing you to create a connection in any way you want.
 --
@@ -331,12 +338,12 @@
 -- | Run an application with the given configuration.
 --
 -- Since 1.0.2
-runTLSClient :: (MonadIO m, MonadBaseControl IO m)
+runTLSClient :: (MonadBaseControl IO m)
              => TLSClientConfig
              -> (AppData -> m a)
              -> m a
 runTLSClient TLSClientConfig {..} app = do
-    context <- maybe (liftIO NC.initConnectionContext) return tlsClientConnectionContext
+    context <- maybe (liftBase NC.initConnectionContext) return tlsClientConnectionContext
     let params = NC.ConnectionParams
             { NC.connectionHostname = S8.unpack tlsClientHost
             , NC.connectionPort = fromIntegral tlsClientPort
@@ -367,21 +374,20 @@
 --   but provide also a call back to trigger a StartTLS handshake on the connection
 --
 -- Since 1.0.2
-runTLSClientStartTLS :: TLSClientConfig
-                     -> ApplicationStartTLS
-                     -> IO ()
+runTLSClientStartTLS :: (MonadBaseControl IO m)
+                     => TLSClientConfig
+                     -> GeneralApplicationStartTLS m a
+                     -> m a
 runTLSClientStartTLS TLSClientConfig {..} app = do
-    context <- maybe (liftIO NC.initConnectionContext) return tlsClientConnectionContext
+    context <- maybe (liftBase NC.initConnectionContext) return tlsClientConnectionContext
     let params = NC.ConnectionParams
             { NC.connectionHostname = S8.unpack tlsClientHost
             , NC.connectionPort = fromIntegral tlsClientPort
             , NC.connectionUseSecure = Nothing
             , NC.connectionUseSocks = tlsClientSockSettings
             }
-    control $ \run -> bracket
-        (NC.connectTo context params)
-        NC.connectionClose
-        (\conn -> run $ app (
+    liftBaseOp (bracket (NC.connectTo context params) NC.connectionClose)
+        (\conn -> app (
             AppData
             { appRead' = NC.connectionGetChunk conn
             , appWrite' = NC.connectionPut conn
@@ -395,7 +401,7 @@
 #endif
             }
             , \app' -> do
-                 NC.connectionSetSecure context conn tlsClientTLSSettings
+                 liftBase $ NC.connectionSetSecure context conn tlsClientTLSSettings
                  app' AppData
                    { appRead' = NC.connectionGetChunk conn
                    , appWrite' = NC.connectionPut conn
diff --git a/network-conduit-tls.cabal b/network-conduit-tls.cabal
--- a/network-conduit-tls.cabal
+++ b/network-conduit-tls.cabal
@@ -1,5 +1,5 @@
 name:                network-conduit-tls
-version:             1.2.1.1
+version:             1.2.2
 synopsis:            Create TLS-aware network code with conduits
 description:         Uses the tls package for a pure-Haskell implementation.
 homepage:            https://github.com/snoyberg/conduit
@@ -22,6 +22,7 @@
                     , conduit         >= 1.1
                     , network
                     , transformers
+                    , transformers-base
                     , cprng-aes
                     , connection
                     , monad-control