diff --git a/server/segment_rpc.go b/server/segment_rpc.go
index 9dee1d5921..162fb4607c 100644
--- a/server/segment_rpc.go
+++ b/server/segment_rpc.go
@@ -63,6 +63,9 @@ var httpClient = &http.Client{
 		// transparently support HTTP/2 while maintaining the flexibility to use HTTP/1 by running
 		// with GODEBUG=http2client=0
 		ForceAttemptHTTP2: true,
+
+		// Close the underlying connection if unused; otherwise they hang open for a long time
+		IdleConnTimeout: 1 * time.Minute,
 	},
 	// Don't set a timeout here; pass a context to the request
 }
diff --git a/trickle/trickle_publisher.go b/trickle/trickle_publisher.go
index e20aa8e6b8..364f0af8e3 100644
--- a/trickle/trickle_publisher.go
+++ b/trickle/trickle_publisher.go
@@ -8,6 +8,7 @@ import (
 	"log/slog"
 	"net/http"
 	"sync"
+	"time"
 )
 
 var StreamNotFoundErr = errors.New("stream not found")
@@ -291,6 +292,9 @@ func httpClient() *http.Client {
 		// DisableKeepAlives: true,
 		// ignore orch certs for now
 		TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+
+		// Prevent old TCP connections from accumulating
+		IdleConnTimeout: 1 * time.Minute,
 	}}
 }