diff --git a/common/main/cpp/native_c4btsocketfactory.cc b/common/main/cpp/native_c4btsocketfactory.cc
index bd011fd47..74efcdce9 100644
--- a/common/main/cpp/native_c4btsocketfactory.cc
+++ b/common/main/cpp/native_c4btsocketfactory.cc
@@ -79,6 +79,7 @@ static void btOpen(C4Socket*       socket,
     jint envState = attachJVM(&env, "btOpen");
     if (envState != JNI_OK && envState != JNI_EDETACHED) return;
 
+    // Balanced by the c4socket_release in NativeC4Socket_closed.
     c4socket_retain(socket);
 
     // addr->hostname carries the CBL peer-ID / BT MAC address as a C4Slice.
@@ -178,6 +179,9 @@ static void btAttached(C4Socket* socket) {
 
     jstring jPeerID = env->NewStringUTF((const char *)ctx->peerID.buf);
 
+    // Balanced by the c4socket_release in NativeC4Socket_closed. Mirrors btOpen.
+    c4socket_retain(socket);
+
     env->CallStaticVoidMethod(
             cls_C4BTSocketFactory, m_attached,
             (jlong) socket,