diff --git a/lib/core-net/wsi-timeout.c b/lib/core-net/wsi-timeout.c
index 2d74df347..f5a37a882 100644
--- a/lib/core-net/wsi-timeout.c
+++ b/lib/core-net/wsi-timeout.c
@@ -351,6 +351,7 @@ lws_validity_confirmed(struct lws *wsi)
 	 * to the role to figure out who actually needs to understand their
 	 * validity was confirmed.
 	 */
-	if (wsi->role_ops && wsi->role_ops->issue_keepalive)
+	if (!wsi->h2_stream_carries_ws && /* only if not encapsulated */
+	    wsi->role_ops && wsi->role_ops->issue_keepalive)
 		wsi->role_ops->issue_keepalive(wsi, 1);
 }
diff --git a/lib/roles/ws/server-ws.c b/lib/roles/ws/server-ws.c
index db1a0159b..2006c3f76 100644
--- a/lib/roles/ws/server-ws.c
+++ b/lib/roles/ws/server-ws.c
@@ -351,6 +351,15 @@ lws_process_ws_upgrade2(struct lws *wsi)
 			lws_role_transition(wsi,
 					    LWSIFR_SERVER | LWSIFR_P_ENCAP_H2,
 					    LRS_ESTABLISHED, &role_ops_ws);
+
+			/*
+			 * There should be no validity checking since we
+			 * are encapsulated in something else with its own
+			 * validity checking
+			 */
+
+			__lws_sul_insert(&pt->pt_sul_owner, &wsi->sul_validity,
+					 LWS_SET_TIMER_USEC_CANCEL);
 		} else
 #endif
 		{