diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,3 +1,7 @@
+## 3.0.4.1
+
+* Fix for leaked FDs [#378](https://github.com/yesodweb/wai/issues/378)
+
 ## 3.0.4
 
 * Replace `acceptSafe` with `accept`, see [#361](https://github.com/yesodweb/wai/issues/361)
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -36,7 +36,7 @@
 import Network.Socket (Socket, sClose, withSocketsDo, SockAddr, accept)
 import qualified Data.ByteString as S
 import qualified Data.ByteString.Lazy as L
-import Control.Exception (bracket, finally, handle, fromException, try, IOException)
+import Control.Exception (bracket, finally, handle, fromException, try, IOException, onException)
 import qualified Network.TLS.Extra as TLSExtra
 import qualified Data.ByteString as B
 import Data.Streaming.Network (bindPortTCP, safeRecv)
@@ -257,10 +257,10 @@
 mkConn tlsset s params = do
     firstBS <- safeRecv s 4096
     cachedRef <- I.newIORef firstBS
-    if not (B.null firstBS) && B.head firstBS == 0x16 then
+    (if not (B.null firstBS) && B.head firstBS == 0x16 then
         httpOverTls tlsset s cachedRef params
       else
-        plainHTTP tlsset s cachedRef
+        plainHTTP tlsset s cachedRef) `onException` sClose s
 
 ----------------------------------------------------------------
 
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.0.4
+Version:             3.0.4.1
 Synopsis:            HTTP over SSL/TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE