diff --git a/Annex/Proxy.hs b/Annex/Proxy.hs
index d34c5ef600..f53851bd13 100644
--- a/Annex/Proxy.hs
+++ b/Annex/Proxy.hs
@@ -90,6 +90,7 @@ proxySpecialRemoteSide clientmaxversion r = mkRemoteSide r $ do
 		, connCheckAuth = const False
 		, connIhdl = P2PHandleTMVar ihdl (Just iwaitv) iclosedv
 		, connOhdl = P2PHandleTMVar ohdl (Just owaitv) oclosedv
+		, connProcess = Nothing
 		, connIdent = ConnIdent (Just (Remote.name r))
 		}
 	let closeremoteconn = do
diff --git a/Command/EnableTor.hs b/Command/EnableTor.hs
index b36136553a..c4b323d825 100644
--- a/Command/EnableTor.hs
+++ b/Command/EnableTor.hs
@@ -138,6 +138,7 @@ checkHiddenService = bracket setup cleanup go
 			, connCheckAuth = const False
 			, connIhdl = P2PHandle h
 			, connOhdl = P2PHandle h
+			, connProcess = Nothing
 			, connIdent = ConnIdent Nothing
 			}
 		runst <- mkRunState Client
diff --git a/P2P/Http/State.hs b/P2P/Http/State.hs
index 1c6d8bb151..0a77ea9772 100644
--- a/P2P/Http/State.hs
+++ b/P2P/Http/State.hs
@@ -406,10 +406,10 @@ mkP2PConnectionPair connparams (n1, n2) = do
 		(if connectionWaitVar connparams then Just wait2 else Nothing)
 		closed2
 	let clientconn = P2PConnection Nothing
-		(const True) h2 h1
+		(const True) h2 h1 Nothing
 		(ConnIdent (Just n1))
 	let serverconn = P2PConnection Nothing
-		(const True) h1 h2
+		(const True) h1 h2 Nothing
 		(ConnIdent (Just n2))
 	return (clientconn, serverconn)
 
diff --git a/P2P/IO.hs b/P2P/IO.hs
index 31401bffe9..d712be7d03 100644
--- a/P2P/IO.hs
+++ b/P2P/IO.hs
@@ -97,6 +97,7 @@ data P2PConnection = P2PConnection
 	, connCheckAuth :: (AuthToken -> Bool)
 	, connIhdl :: P2PHandle
 	, connOhdl :: P2PHandle
+	, connProcess :: Maybe ProcessHandle
 	, connIdent :: ConnIdent
 	}
 
@@ -115,6 +116,7 @@ stdioP2PConnection g = P2PConnection
 	, connCheckAuth = const False
 	, connIhdl = P2PHandle stdin
 	, connOhdl = P2PHandle stdout
+	, connProcess = Nothing
 	, connIdent = ConnIdent Nothing
 	}
 
@@ -129,6 +131,7 @@ stdioP2PConnectionDupped g = do
 		, connCheckAuth = const False
 		, connIhdl = P2PHandle readh
 		, connOhdl = P2PHandle writeh
+		, connProcess = Nothing
 		, connIdent = ConnIdent Nothing
 		}
 
@@ -141,6 +144,7 @@ connectPeer g (TorAnnex onionaddress onionport) = do
 		, connCheckAuth = const False
 		, connIhdl = P2PHandle h
 		, connOhdl = P2PHandle h
+		, connProcess = Nothing
 		, connIdent = ConnIdent Nothing
 		}
 
@@ -148,6 +152,9 @@ closeConnection :: P2PConnection -> IO ()
 closeConnection conn = do
 	closehandle (connIhdl conn)
 	closehandle (connOhdl conn)
+	case connProcess conn of
+		Nothing -> noop
+		Just ph -> void $ waitForProcess ph
   where
 	closehandle (P2PHandle h) = hClose h
 	closehandle (P2PHandleTMVar _ _ closedv) = 
diff --git a/Remote/Helper/Ssh.hs b/Remote/Helper/Ssh.hs
index d279476488..1d37ba15fb 100644
--- a/Remote/Helper/Ssh.hs
+++ b/Remote/Helper/Ssh.hs
@@ -270,6 +270,7 @@ openP2PShellConnection' r maxprotoversion bypass = do
 			, P2P.connCheckAuth = const False
 			, P2P.connIhdl = P2P.P2PHandle to
 			, P2P.connOhdl = P2P.P2PHandle from
+			, P2P.connProcess = Nothing
 			, P2P.connIdent = P2P.ConnIdent $
 				Just $ "git-annex-shell connection " ++ show pidnum
 			}
diff --git a/RemoteDaemon/Transport/Tor.hs b/RemoteDaemon/Transport/Tor.hs
index 3970acbd2e..d927387fb1 100644
--- a/RemoteDaemon/Transport/Tor.hs
+++ b/RemoteDaemon/Transport/Tor.hs
@@ -115,6 +115,7 @@ serveClient th@(TransportHandle _ _ rd) u r q = bracket setup cleanup start
 				, connCheckAuth = (`isAllowedAuthToken` allowed)
 				, connIhdl = P2PHandle h
 				, connOhdl = P2PHandle h
+				, connProcess = Nothing
 				, connIdent = ConnIdent $ Just "tor remotedaemon"
 				}
 			-- not really Client, but we don't know their uuid yet