diff --git a/src/browser_harness/admin.py b/src/browser_harness/admin.py
index ef7744db..c998f9fc 100644
--- a/src/browser_harness/admin.py
+++ b/src/browser_harness/admin.py
@@ -316,11 +316,16 @@ def ensure_daemon(wait=60.0, name=None, env=None):
         # CDP WS to Chrome is dead — probe with a real CDP call and require "result".
         # Must go through ipc.connect so this works on Windows (TCP loopback) too;
         # raw AF_UNIX here would fail on every warm call and churn the daemon.
+        s = None
         try:
             s, token = ipc.connect(name or NAME, timeout=3.0)
             resp = ipc.request(s, token, {"method": "Target.getTargets", "params": {}})
             if "result" in resp: return
         except Exception: pass
+        finally:
+            if s:
+                try: s.close()
+                except OSError: pass
         restart_daemon(name)
 
     import subprocess, sys
diff --git a/tests/unit/test_admin.py b/tests/unit/test_admin.py
index 65d7d7f3..77908646 100644
--- a/tests/unit/test_admin.py
+++ b/tests/unit/test_admin.py
@@ -138,6 +138,19 @@ def test_browser_connections_returns_attached_page(monkeypatch):
     ]
 
 
+def test_ensure_daemon_closes_probe_socket_when_daemon_is_healthy(monkeypatch):
+    sock = FakeSocket()
+
+    monkeypatch.setattr(admin, "daemon_alive", lambda name=None: True)
+    monkeypatch.setattr(admin.ipc, "connect", lambda name, timeout=3.0: (sock, None))
+    monkeypatch.setattr(admin.ipc, "request", lambda conn, token, req: {"result": {"targetInfos": []}})
+    monkeypatch.setattr(admin, "restart_daemon", lambda name=None: (_ for _ in ()).throw(AssertionError("unexpected restart")))
+
+    admin.ensure_daemon()
+
+    assert sock.closed
+
+
 def test_chrome_running_detects_helium_on_linux(monkeypatch):
     monkeypatch.setattr("platform.system", lambda: "Linux")
     monkeypatch.setattr(