diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,13 @@
 # ChangeLog
 
+## 3.4.9
+
+* Using `timeout` for `handshake` to prevent thread leaks.
+
+## 3.4.8
+
+* Substituted `data-default-class` for `data-default` [#1010](https://github.com/yesodweb/wai/pull/1010)
+
 ## 3.4.7
 
 * Expose `attachConn` to use post-handshake TLS connection.
diff --git a/Network/Wai/Handler/WarpTLS.hs b/Network/Wai/Handler/WarpTLS.hs
--- a/Network/Wai/Handler/WarpTLS.hs
+++ b/Network/Wai/Handler/WarpTLS.hs
@@ -59,7 +59,7 @@
 import Control.Monad (guard, void)
 import qualified Data.ByteString as S
 import qualified Data.ByteString.Lazy as L
-import Data.Default.Class (def)
+import Data.Default (def)
 import qualified Data.IORef as I
 import Data.Streaming.Network (bindPortTCP, safeRecv)
 import Data.Typeable (Typeable)
@@ -350,7 +350,7 @@
     -> S.ByteString
     -> params
     -> IO (Connection, Transport)
-httpOverTls TLSSettings{..} _set s bs0 params =
+httpOverTls TLSSettings{..} set s bs0 params =
     makeConn `onException` close s
   where
     makeConn = do
@@ -359,9 +359,14 @@
         let recvN = wrappedRecvN rawRecvN
         ctx <- TLS.contextNew (backend recvN) params
         TLS.contextHookSetLogging ctx tlsLogging
-        TLS.handshake ctx
-        mysa <- getSocketName s
-        attachConn mysa ctx
+        let tm = settingsTimeout set * 1000000
+        mconn <- timeout tm $ do
+            TLS.handshake ctx
+            mysa <- getSocketName s
+            attachConn mysa ctx
+        case mconn of
+          Nothing -> throwIO IncompleteHeaders
+          Just conn -> return conn
     wrappedRecvN recvN n = handleAny (const mempty) $ recvN n
     backend recvN =
         TLS.Backend
diff --git a/Network/Wai/Handler/WarpTLS/Internal.hs b/Network/Wai/Handler/WarpTLS/Internal.hs
--- a/Network/Wai/Handler/WarpTLS/Internal.hs
+++ b/Network/Wai/Handler/WarpTLS/Internal.hs
@@ -12,7 +12,7 @@
 
 import qualified Data.ByteString as S
 import qualified Data.ByteString.Lazy as L
-import Data.Default.Class (def)
+import Data.Default (def)
 import qualified Data.IORef as I
 import qualified Network.TLS as TLS
 import qualified Network.TLS.Extra as TLSExtra
diff --git a/warp-tls.cabal b/warp-tls.cabal
--- a/warp-tls.cabal
+++ b/warp-tls.cabal
@@ -1,5 +1,5 @@
 Name:                warp-tls
-Version:             3.4.7
+Version:             3.4.9
 Synopsis:            HTTP over TLS support for Warp via the TLS package
 License:             MIT
 License-file:        LICENSE
@@ -22,7 +22,7 @@
                    , bytestring                    >= 0.9
                    , wai                           >= 3.2      && < 3.3
                    , warp                          >= 3.3.29   && < 3.5
-                   , data-default-class            >= 0.0.1
+                   , data-default
                    , tls                           >= 1.7      && < 2.2
                    , network                       >= 2.2.1
                    , streaming-commons