diff --git a/src/libs/connio/connio.c b/src/libs/connio/connio.c
index c47aa68..3cb295a 100644
--- a/src/libs/connio/connio.c
+++ b/src/libs/connio/connio.c
@@ -612,6 +612,15 @@ ConnCloseAll()
     c = ConnIO.allocated.head;
     while (c) {
         if (!c->bSelfManage) {
+            /*
+             * ConnCloseAll() is the forceful service-shutdown path.  Stop
+             * transport I/O before ConnTcpClose() tries to send a TLS
+             * close_notify; otherwise an idle peer that never answers the
+             * alert can hold the entire agent in gnutls_bye().
+             */
+            if (c->socket != -1) {
+                IPshutdown(c->socket, 2);
+            }
             ConnTcpClose(c);
         }