diff --git a/internal/experiment/webconnectivitylte/cleartextflow.go b/internal/experiment/webconnectivitylte/cleartextflow.go
index 57650736e..7c94d8f34 100644
--- a/internal/experiment/webconnectivitylte/cleartextflow.go
+++ b/internal/experiment/webconnectivitylte/cleartextflow.go
@@ -119,14 +119,12 @@ func (t *CleartextFlow) Run(parentCtx context.Context, index int64) error {
 	tcpDialer := trace.NewDialerWithoutResolver(t.Logger)
 	tcpConn, err := tcpDialer.DialContext(tcpCtx, "tcp", t.Address)
 	t.TestKeys.AppendTCPConnectResults(trace.TCPConnects()...)
+	defer t.TestKeys.AppendNetworkEvents(trace.NetworkEvents()...) // here to include connect events
 	if err != nil {
 		ol.Stop(err)
 		return err
 	}
-	defer func() {
-		t.TestKeys.AppendNetworkEvents(trace.NetworkEvents()...)
-		tcpConn.Close()
-	}()
+	defer tcpConn.Close()
 
 	alpn := "" // no ALPN because we're not using TLS
 
diff --git a/internal/experiment/webconnectivitylte/secureflow.go b/internal/experiment/webconnectivitylte/secureflow.go
index 2e634467d..ee7165408 100644
--- a/internal/experiment/webconnectivitylte/secureflow.go
+++ b/internal/experiment/webconnectivitylte/secureflow.go
@@ -126,14 +126,12 @@ func (t *SecureFlow) Run(parentCtx context.Context, index int64) error {
 	tcpDialer := trace.NewDialerWithoutResolver(t.Logger)
 	tcpConn, err := tcpDialer.DialContext(tcpCtx, "tcp", t.Address)
 	t.TestKeys.AppendTCPConnectResults(trace.TCPConnects()...)
+	defer t.TestKeys.AppendNetworkEvents(trace.NetworkEvents()...) // here to include "connect" events
 	if err != nil {
 		ol.Stop(err)
 		return err
 	}
-	defer func() {
-		t.TestKeys.AppendNetworkEvents(trace.NetworkEvents()...)
-		tcpConn.Close()
-	}()
+	defer tcpConn.Close()
 
 	// perform TLS handshake
 	tlsSNI, err := t.sni()