diff --git a/pkg/nest/client.go b/pkg/nest/client.go
index 6a570913a..6ed765a44 100644
--- a/pkg/nest/client.go
+++ b/pkg/nest/client.go
@@ -129,12 +129,17 @@ func rtcConn(nestAPI *API, rawURL, projectID, deviceID string) (*WebRTCClient, e
 		// 3. Create offer with candidates
 		offer, err := conn.CreateCompleteOffer(medias)
 		if err != nil {
+			_ = pc.Close()
 			return nil, err
 		}
 
 		// 4. Exchange SDP via Hass
 		answer, err := nestAPI.ExchangeSDP(projectID, deviceID, offer)
 		if err != nil {
+			// close the failed PeerConnection: it never reaches ICE connectivity
+			// (no answer is set), so pion's connection-state auto-close never fires
+			// and its ICE agent's mDNS sockets (:5353) would leak on every retry.
+			_ = pc.Close()
 			lastErr = err
 			if attempt < maxRetries-1 {
 				time.Sleep(retryDelay)
@@ -146,6 +151,7 @@ func rtcConn(nestAPI *API, rawURL, projectID, deviceID string) (*WebRTCClient, e
 
 		// 5. Set answer with remote medias
 		if err = conn.SetAnswer(answer); err != nil {
+			_ = pc.Close()
 			return nil, err
 		}
 
@@ -166,6 +172,7 @@ func rtspConn(nestAPI *API, rawURL, projectID, deviceID string) (*RTSPClient, er
 		return nil, err
 	}
 	if err := rtspClient.Describe(); err != nil {
+		_ = rtspClient.Close()
 		return nil, err
 	}