diff --git a/nostr-sdk/src/local_relay/local/inner.rs b/nostr-sdk/src/local_relay/local/inner.rs
index a49036972..51b0d5102 100644
--- a/nostr-sdk/src/local_relay/local/inner.rs
+++ b/nostr-sdk/src/local_relay/local/inner.rs
@@ -303,7 +303,7 @@ impl InnerLocalRelay {
         self,
         raw_stream: S,
         addr: SocketAddr,
-        permit: OwnedSemaphorePermit,
+        handshake_permit: OwnedSemaphorePermit,
     ) -> Result<(), Error>
     where
         S: AsyncRead + AsyncWrite + Unpin,
@@ -312,6 +312,10 @@ impl InnerLocalRelay {
             tokio::time::sleep(unresponsive_connection).await;
         }
 
+        // Take the connection permit before doing the handshake
+        let conn_permit: OwnedSemaphorePermit =
+            self.connections_limit.clone().try_acquire_owned()?;
+
         // Bound clients that open TCP but never complete the WebSocket handshake.
         let ws_stream = tokio::time::timeout(
             self.websocket_handshake_timeout,
@@ -324,12 +328,9 @@ impl InnerLocalRelay {
         .map_err(Error::transport)?;
 
         // The pre-handshake socket is no longer consuming admission resources.
-        drop(permit);
-
-        // An established connection only consumes a permit when explicitly configured.
-        let permit = self.connections_limit.clone().try_acquire_owned()?;
+        drop(handshake_permit);
 
-        self.handle_websocket(ws_stream, addr, permit).await?;
+        self.handle_websocket(ws_stream, addr, conn_permit).await?;
 
         Ok(())
     }