diff --git a/.gitignore b/.gitignore
index 0e6e2daf7..1fb8b7e09 100644
--- a/.gitignore
+++ b/.gitignore
@@ -57,3 +57,8 @@ doc
 /bb/
 /openssl3/
 /bb-linkit/
+/bq/
+/cros/
+/q/
+/b1/
+/destdir/
diff --git a/lib/secure-streams/private-lib-secure-streams.h b/lib/secure-streams/private-lib-secure-streams.h
index b22211a31..3abae5f31 100644
--- a/lib/secure-streams/private-lib-secure-streams.h
+++ b/lib/secure-streams/private-lib-secure-streams.h
@@ -318,6 +318,12 @@ int
 lws_ss_exp_cb_metadata(void *priv, const char *name, char *out, size_t *pos,
 			size_t olen, size_t *exp_ofs);
 
+int
+_lws_ss_client_connect(lws_ss_handle_t *h, int is_retry);
+
+int
+lws_ss_sys_cpd(struct lws_context *cx);
+
 typedef int (* const secstream_protocol_connect_munge_t)(lws_ss_handle_t *h,
 		char *buf, size_t len, struct lws_client_connect_info *i,
 		union lws_ss_contemp *ct);
diff --git a/lib/secure-streams/secure-streams-serialize.c b/lib/secure-streams/secure-streams-serialize.c
index cd85f0ae2..a560fd99f 100644
--- a/lib/secure-streams/secure-streams-serialize.c
+++ b/lib/secure-streams/secure-streams-serialize.c
@@ -351,7 +351,7 @@ lws_ss_deserialize_parse(struct lws_ss_serialization_parser *par,
 					goto hangup;
 				par->ps = RPAR_TYPE;
 				if (*pss)
-					lws_ss_client_connect(*pss);
+					_lws_ss_client_connect(*pss, 0);
 				break;
 
 			case LWSSS_SER_TXPRE_STREAMTYPE:
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 76c5815e1..e8a0e2ca1 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -183,7 +183,7 @@ lws_ss_backoff(lws_ss_handle_t *h)
 }
 
 int
-lws_ss_client_connect(lws_ss_handle_t *h)
+_lws_ss_client_connect(lws_ss_handle_t *h, int is_retry)
 {
 	struct lws_client_connect_info i;
 	const struct ss_pcols *ssp;
@@ -205,6 +205,9 @@ lws_ss_client_connect(lws_ss_handle_t *h)
 	if (h->h_sink)
 		return 0;
 
+	if (!is_retry)
+		h->retry = 0;
+
 	memset(&i, 0, sizeof i); /* otherwise uninitialized garbage */
 	i.context = h->context;
 
@@ -289,6 +292,11 @@ lws_ss_client_connect(lws_ss_handle_t *h)
 	return 0;
 }
 
+int
+lws_ss_client_connect(lws_ss_handle_t *h)
+{
+	return _lws_ss_client_connect(h, 0);
+}
 
 /*
  * Public API
@@ -435,8 +443,9 @@ lws_ss_create(struct lws_context *context, int tsi, const lws_ss_info_t *ssi,
 
 	lws_ss_event_helper(h, LWSSSCS_CREATING);
 
-	if (!ssi->register_sink && (h->policy->flags & LWSSSPOLF_NAILED_UP))
-		if (lws_ss_client_connect(h))
+	if (!ssi->register_sink &&
+	    ((h->policy->flags & LWSSSPOLF_NAILED_UP)))
+		if (_lws_ss_client_connect(h, 0))
 			lws_ss_backoff(h);
 
 	return 0;
@@ -503,7 +512,11 @@ lws_ss_request_tx(lws_ss_handle_t *h)
 	h->seqstate = SSSEQ_TRY_CONNECT;
 	lws_ss_event_helper(h, LWSSSCS_POLL);
 
-	if (lws_ss_client_connect(h))
+	/*
+	 * Retries operate via lws_ss_request_tx(), explicitly ask for a
+	 * reconnection to clear the retry limit
+	 */
+	if (_lws_ss_client_connect(h, 1))
 		lws_ss_backoff(h);
 }