diff --git a/src/lxc/lxc_controller.c b/src/lxc/lxc_controller.c
index 50b2987d9a..797547b05c 100644
--- a/src/lxc/lxc_controller.c
+++ b/src/lxc/lxc_controller.c
@@ -353,7 +353,6 @@ static int virLXCControllerDaemonHandshake(virLXCController *ctrl)
                              _("error sending continue signal to daemon"));
         return -1;
     }
-    VIR_FORCE_CLOSE(ctrl->handshakeFd);
     return 0;
 }
 
@@ -2403,6 +2402,9 @@ virLXCControllerRun(virLXCController *ctrl)
     if (virLXCControllerDaemonHandshake(ctrl) < 0)
         goto cleanup;
 
+    /* and preemptively close handshakeFd */
+    VIR_FORCE_CLOSE(ctrl->handshakeFd);
+
     /* We must not hold open a dbus connection for life
      * of LXC instance, since dbus-daemon is limited to
      * only a few 100 connections by default