diff --git a/src/broker/Manager.cc b/src/broker/Manager.cc
index a8bcd7e6f8..f3e330056b 100644
--- a/src/broker/Manager.cc
+++ b/src/broker/Manager.cc
@@ -582,6 +582,22 @@ void Manager::Peer(const string& addr, uint16_t port, double retry)
 		iosource_mgr->Register(this, false);
 	}
 
+void Manager::PeerNoRetry(const string& addr, uint16_t port)
+	{
+	if ( bstate->endpoint.is_shutdown() )
+		return;
+
+	DBG_LOG(DBG_BROKER, "Starting to peer with %s:%" PRIu16 " (no retry)", addr.c_str(), port);
+
+	bstate->endpoint.peer_nosync(addr, port, broker::timeout::seconds{0});
+
+	auto counts_as_iosource = get_option("Broker::peer_counts_as_iosource")->AsBool();
+
+	if ( counts_as_iosource )
+		// Register as a "does-count" source now.
+		iosource_mgr->Register(this, false);
+	}
+
 void Manager::Unpeer(const string& addr, uint16_t port)
 	{
 	if ( bstate->endpoint.is_shutdown() )
diff --git a/src/broker/Manager.h b/src/broker/Manager.h
index 71e199eda8..16746acb28 100644
--- a/src/broker/Manager.h
+++ b/src/broker/Manager.h
@@ -143,6 +143,13 @@ public:
 	 */
 	void Peer(const std::string& addr, uint16_t port, double retry = 10.0);
 
+	/**
+	 * Initiate a peering with a remote endpoint but tries only once.
+	 * @param addr an address to connect to, e.g. "localhost" or "127.0.0.1".
+	 * @param port the TCP port on which the remote side is listening.
+	 */
+	void PeerNoRetry(const std::string& addr, uint16_t port);
+
 	/**
 	 * Remove a remote peering.
 	 * @param addr the address used in bro_broker::Manager::Peer().
diff --git a/src/broker/comm.bif b/src/broker/comm.bif
index c48a00620b..9c8cf22150 100644
--- a/src/broker/comm.bif
+++ b/src/broker/comm.bif
@@ -104,6 +104,20 @@ function Broker::__peer%(a: string, p: port, retry: interval%): bool
 	return zeek::val_mgr->True();
 	%}
 
+function Broker::__peer_no_retry%(a: string, p: port%): bool
+	%{
+	zeek::Broker::Manager::ScriptScopeGuard ssg;
+
+	if ( ! p->IsTCP() )
+		{
+		zeek::emit_builtin_error("remote connection port must use tcp");
+		return zeek::val_mgr->False();
+		}
+
+	broker_mgr->PeerNoRetry(a->CheckString(), p->Port());
+	return zeek::val_mgr->True();
+	%}
+
 function Broker::__unpeer%(a: string, p: port%): bool
 	%{
 	zeek::Broker::Manager::ScriptScopeGuard ssg;
diff --git a/testing/btest/broker/ssl-mismatch.zeek b/testing/btest/broker/ssl-mismatch.zeek
index d013b2b978..8e4ffd80fd 100644
--- a/testing/btest/broker/ssl-mismatch.zeek
+++ b/testing/btest/broker/ssl-mismatch.zeek
@@ -3,12 +3,13 @@
 # @TEST-PORT: BROKER_PORT
 #
 # @TEST-EXEC: btest-bg-run listen "zeek -b %INPUT connect=F Broker::disable_ssl=T"
+# @TEST-EXEC: $SCRIPTS/wait-for-file listen/listen_ready 20 || (btest-bg-wait -k 1 && false)
 #
 # @TEST-EXEC: btest-bg-run good_connect "zeek -b %INPUT connect=T Broker::disable_ssl=T"
-# @TEST-EXEC: $SCRIPTS/wait-for-file good_connect/listen_ready 20 || (btest-bg-wait -k 1 && false)
+# @TEST-EXEC: $SCRIPTS/wait-for-file good_connect/connected 20 || (btest-bg-wait -k 1 && false)
 #
 # @TEST-EXEC: btest-bg-run bad_connect "zeek -b %INPUT connect=T Broker::disable_ssl=F"
-# @TEST-EXEC: $SCRIPTS/wait-for-file bad_connect/done 20 || (btest-bg-wait -k 1 && false)
+# @TEST-EXEC: $SCRIPTS/wait-for-file bad_connect/failed 20 || (btest-bg-wait -k 1 && false)
 #
 # @TEST-EXEC: btest-bg-run last_connect "zeek -b %INPUT connect=T Broker::disable_ssl=T"
 #
@@ -18,12 +19,13 @@
 # And again, now reversing the SSL mismatch between client/server...
 #
 # @TEST-EXEC: btest-bg-run listen_rev "zeek -b %INPUT connect=F Broker::disable_ssl=F"
+# @TEST-EXEC: $SCRIPTS/wait-for-file listen_rev/listen_ready 20 || (btest-bg-wait -k 1 && false)
 #
 # @TEST-EXEC: btest-bg-run good_connect_rev "zeek -b %INPUT connect=T Broker::disable_ssl=F"
-# @TEST-EXEC: $SCRIPTS/wait-for-file good_connect_rev/listen_ready 20 || (btest-bg-wait -k 1 && false)
+# @TEST-EXEC: $SCRIPTS/wait-for-file good_connect_rev/connected 20 || (btest-bg-wait -k 1 && false)
 #
 # @TEST-EXEC: btest-bg-run bad_connect_rev "zeek -b %INPUT connect=T Broker::disable_ssl=T"
-# @TEST-EXEC: $SCRIPTS/wait-for-file bad_connect_rev/done 20 || (btest-bg-wait -k 1 && false)
+# @TEST-EXEC: $SCRIPTS/wait-for-file bad_connect_rev/failed 20 || (btest-bg-wait -k 1 && false)
 #
 # @TEST-EXEC: btest-bg-run last_connect_rev "zeek -b %INPUT connect=T Broker::disable_ssl=F"
 #
@@ -35,10 +37,14 @@ global num_connections = 0;
 
 event zeek_init()
 	{
+	local p = to_port(getenv("BROKER_PORT"));
 	if ( connect )
-		Broker::peer("127.0.0.1", to_port(getenv("BROKER_PORT")));
+		Broker::__peer_no_retry("127.0.0.1", p);
 	else
-		Broker::listen("127.0.0.1", to_port(getenv("BROKER_PORT")));
+		{
+		local actual = Broker::listen("127.0.0.1", p);
+		system("touch listen_ready");
+		}
 	}
 
 event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string)
@@ -48,7 +54,7 @@ event Broker::peer_added(endpoint: Broker::EndpointInfo, msg: string)
 
 	if ( connect )
 		{
-		system("touch listen_ready");
+		system("touch connected");
 		terminate();
 		}
 	else if ( num_connections == 2 )
@@ -67,7 +73,7 @@ event Broker::error(code: Broker::ErrorCode, msg: string) &priority=-10
 		local f = open("broker.error");
 		print f, code;
 		close(f);
-		system("touch done");
+		system("touch failed");
 		terminate();
 		}
 	}