diff --git a/CHANGELOG.md b/CHANGELOG.md
index cc7d3154d..38adffc31 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,18 @@ Canonical reference for changes, improvements, and bugfixes for Boundary.
 
 ## Next
 
+### Bug Fixes
+
+* cli: Update proxy listener to not close when the number of connections left 
+  for the session is zero. The listener will refuse new connections when the 
+  number of connections left is zero but existing connections will be active. 
+  This fixes a CLI client issue where sessions with max connection count 
+  configured were closed when the number of connections left hit 0.
+  ([Issue](https://github.com/hashicorp/boundary/issues/4364),
+  ([PR](https://github.com/hashicorp/boundary/pull/4389)))
+* Fix issue where the websocket connection was throwing closing errors during
+  the session teardown.
+  ([PR](https://github.com/hashicorp/boundary/pull/4389))
 
 ## 0.15.0 (2024/01/30)
 
diff --git a/api/proxy/proxy.go b/api/proxy/proxy.go
index a565d12b8..5375fa3c7 100644
--- a/api/proxy/proxy.go
+++ b/api/proxy/proxy.go
@@ -190,7 +190,6 @@ func (p *ClientProxy) Start() (retErr error) {
 	listenerCloseFunc := func() {
 		p.listenerCloseOnce.Do(func() {
 			// Forces the for loop to exit instead of spinning on errors
-			p.cancel()
 			p.connectionsLeft.Store(0)
 			if err := p.listener.Load().(net.Listener).Close(); err != nil && err != net.ErrClosed {
 				retErr = errors.Join(retErr, fmt.Errorf("error closing proxy listener: %w", err))
@@ -228,6 +227,7 @@ func (p *ClientProxy) Start() (retErr error) {
 					// connection that comes our way, so cancel the proxy
 					fin <- fmt.Errorf("error from accept: %w", err)
 					listenerCloseFunc()
+					p.cancel()
 					return
 				}
 			}
@@ -241,6 +241,7 @@ func (p *ClientProxy) Start() (retErr error) {
 					// No reason to think we can successfully handle the next
 					// connection that comes our way, so cancel the proxy
 					listenerCloseFunc()
+					p.cancel()
 					return
 				}
 				if err := p.runTcpProxyV1(wsConn, listeningConn); err != nil {
@@ -248,6 +249,7 @@ func (p *ClientProxy) Start() (retErr error) {
 					// No reason to think we can successfully handle the next
 					// connection that comes our way, so cancel the proxy
 					listenerCloseFunc()
+					p.cancel()
 					return
 				}
 			}()
@@ -290,6 +292,7 @@ func (p *ClientProxy) Start() (retErr error) {
 	}()
 
 	p.connWg.Wait()
+	defer p.cancel()
 
 	{
 		// the go funcs are done, so we can safely close the chan and range over any errors
diff --git a/api/proxy/websocket.go b/api/proxy/websocket.go
index 0774b5147..018e13e43 100644
--- a/api/proxy/websocket.go
+++ b/api/proxy/websocket.go
@@ -66,6 +66,7 @@ func (p *ClientProxy) sendSessionTeardown(ctx context.Context) error {
 	if err := wspb.Write(ctx, wsConn, &handshake); err != nil {
 		return fmt.Errorf("error sending teardown handshake to worker: %w", err)
 	}
+	wsConn.Close(websocket.StatusNormalClosure, "session teardown finished")
 
 	return nil
 }