diff --git a/src/quic/tlscontext.cc b/src/quic/tlscontext.cc
index b5106d27e127..de701eb61767 100644
--- a/src/quic/tlscontext.cc
+++ b/src/quic/tlscontext.cc
@@ -188,10 +188,10 @@ OSSLContext::~OSSLContext() {
 
 void OSSLContext::reset() {
   if (ctx_) {
-    // The SSL object inside the ngtcp2 ctx may not have been set if
-    // SSL creation failed. Guard against null before clearing app data.
-    if (SSL* ssl = *this; ssl != nullptr) {
-      SSL_set_app_data(ssl, nullptr);
+    if (ssl_) {
+      SSL_set_app_data(ssl_.get(), nullptr);
+      ngtcp2_crypto_ossl_ctx_set_ssl(ctx_, nullptr);
+      ssl_.reset();
     }
     // connection_ is set during Initialize(). If Initialize() was
     // never called (e.g. SSL creation failed), it's still nullptr.
@@ -205,19 +205,20 @@ void OSSLContext::reset() {
 }
 
 OSSLContext::operator SSL*() const {
-  return ngtcp2_crypto_ossl_ctx_get_ssl(ctx_);
+  return ssl_.get();
 }
 
 OSSLContext::operator ngtcp2_crypto_ossl_ctx*() const {
   return ctx_;
 }
 
-void OSSLContext::Initialize(SSL* ssl,
+void OSSLContext::Initialize(SSLPointer ssl,
                              ngtcp2_crypto_conn_ref* ref,
                              ngtcp2_conn* connection,
                              SSL_CTX* ssl_ctx) {
   CHECK(ssl);
-  ngtcp2_crypto_ossl_ctx_set_ssl(ctx_, ssl);
+  ssl_ = std::move(ssl);
+  ngtcp2_crypto_ossl_ctx_set_ssl(ctx_, ssl_.get());
   SSL_set_app_data(*this, ref);
   // TODO(@jasnell): Later when BoringSSL is also supported, the native
   // handle will be different. The ngtcp2_crypto_ossl.h impl requires
@@ -894,7 +895,7 @@ void TLSSession::Initialize(
     EnableTrace(session_->env(), &bio_trace_, ssl);
   }
 
-  ossl_context_.Initialize(ssl.release(), &ref_, session(), ctx);
+  ossl_context_.Initialize(std::move(ssl), &ref_, session(), ctx);
 
   switch (ctx.side()) {
     case Side::SERVER: {
diff --git a/src/quic/tlscontext.h b/src/quic/tlscontext.h
index 8209eda12dbc..52b0d6f1cde3 100644
--- a/src/quic/tlscontext.h
+++ b/src/quic/tlscontext.h
@@ -41,7 +41,7 @@ class OSSLContext final {
   operator SSL*() const;
   operator ngtcp2_crypto_ossl_ctx*() const;
 
-  void Initialize(SSL* ssl,
+  void Initialize(ncrypto::SSLPointer ssl,
                   ngtcp2_crypto_conn_ref* ref,
                   ngtcp2_conn* connection,
                   SSL_CTX* ssl_ctx);
@@ -73,6 +73,7 @@ class OSSLContext final {
  private:
   ngtcp2_crypto_ossl_ctx* ctx_;
   ngtcp2_conn* connection_ = nullptr;
+  ncrypto::SSLPointer ssl_;
 };
 
 // Every QUIC Session has exactly one TLSSession that maintains the state