diff --git a/internal/apiserver/http_server_test.go b/internal/apiserver/http_server_test.go
index 8db6d2ed27..881fc64c83 100644
--- a/internal/apiserver/http_server_test.go
+++ b/internal/apiserver/http_server_test.go
@@ -145,6 +145,7 @@ func TestTLSServerSelfSignedWithClientAuth(t *testing.T) {
 	pem.Encode(publicKeyFile, &pem.Block{Type: "CERTIFICATE", Bytes: derBytes})
 
 	// Start up a listener configured for TLS Mutual auth
+	config.Reset() // ensure APIShutdownTimeout cleared from earlier tests
 	cp := config.NewPluginConfig("ut")
 	initHTTPConfPrefx(cp, 0)
 	cp.Set(HTTPConfAddress, "127.0.0.1")
diff --git a/pkg/wsclient/wsclient.go b/pkg/wsclient/wsclient.go
index bc4778ca38..a8c23afafd 100644
--- a/pkg/wsclient/wsclient.go
+++ b/pkg/wsclient/wsclient.go
@@ -324,13 +324,13 @@ func (w *wsClient) receiveReconnectLoop() {
 			// Synchronously invoke the reader, as it's important we react immediately to any error there.
 			w.readLoop()
 			close(receiverDone)
+			<-w.sendDone
 
-			// Ensure the connection is closed after the receiver exits
+			// Ensure the connection is closed after the sender and receivers exit
 			err = w.wsconn.Close()
 			if err != nil {
 				l.Debugf("WS %s close failed: %s", w.url, err)
 			}
-			<-w.sendDone
 			w.sendDone = nil
 			w.wsconn = nil
 		}