@@ -503,8 +503,6 @@ class ConnectPlan internal constructor(
     sslSocket: SSLSocket,
     sslException: SSLException,
   ): ConnectPlan? {
-    if (!retryOnConnectionFailure) return null
-
     // If this was an ECH retry, don't retry again.
     if (echRetryPlan != null) return null
 
@@ -533,6 +531,9 @@ class ConnectPlan internal constructor(
       )
     }
 
+    // If recovery is configured off, don't retry.
+    if (!retryOnConnectionFailure) return null
+
     // If the exception is not recoverable, don't retry.
     if (!attemptAnotherConnectionSpec(sslException)) return null
 
 
@@ -303,15 +303,25 @@ class EchOnFakeNetworkTest {
       .isEqualTo("handshake hostname=private.ech.example.com echConfigList=null")
   }
 
+  /**
+   * This runs with [OkHttpClient.retryOnConnectionFailure] enabled and disabled. (We always want
+   * ECH retries, regardless of what this setting is.)
+   */
   @Test
-  fun `server updates ech config for retry`() {
+  fun `server updates ech config for retry`(retryOnConnectionFailure: Boolean) {
     val updatedEchConfigList = "new key to encrypt 'private.ech.example.com'".encodeUtf8()
     platform.handshaker =
       handshakerWithUpdatedEchConfigList(
         updatedEchConfigList = updatedEchConfigList,
         attemptLimit = 2,
       )
 
+    client =
+      client
+        .newBuilder()
+        .retryOnConnectionFailure(retryOnConnectionFailure)
+        .build()
+
     executeHttpExchange()
 
     assertThat(events.take())