diff --git a/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/connection/ConnectPlan.kt b/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/connection/ConnectPlan.kt
index 6beed10a4a34..a1d85de5c73e 100644
--- a/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/connection/ConnectPlan.kt
+++ b/okhttp/src/commonJvmAndroid/kotlin/okhttp3/internal/connection/ConnectPlan.kt
@@ -503,8 +503,6 @@ class ConnectPlan internal constructor(
     sslSocket: SSLSocket,
     sslException: SSLException,
   ): ConnectPlan? {
-    if (!retryOnConnectionFailure) return null
-
     // If this was an ECH retry, don't retry again.
     if (echRetryPlan != null) return null
 
@@ -533,6 +531,9 @@ class ConnectPlan internal constructor(
       )
     }
 
+    // If recovery is configured off, don't retry.
+    if (!retryOnConnectionFailure) return null
+
     // If the exception is not recoverable, don't retry.
     if (!attemptAnotherConnectionSpec(sslException)) return null
 
diff --git a/okhttp/src/jvmTest/kotlin/okhttp3/EchOnFakeNetworkTest.kt b/okhttp/src/jvmTest/kotlin/okhttp3/EchOnFakeNetworkTest.kt
index 4d86039d7f72..95e737998648 100644
--- a/okhttp/src/jvmTest/kotlin/okhttp3/EchOnFakeNetworkTest.kt
+++ b/okhttp/src/jvmTest/kotlin/okhttp3/EchOnFakeNetworkTest.kt
@@ -303,8 +303,12 @@ class EchOnFakeNetworkTest {
       .isEqualTo("handshake hostname=private.ech.example.com echConfigList=null")
   }
 
+  /**
+   * This runs with [OkHttpClient.retryOnConnectionFailure] enabled and disabled. (We always want
+   * ECH retries, regardless of what this setting is.)
+   */
   @Test
-  fun `server updates ech config for retry`() {
+  fun `server updates ech config for retry`(retryOnConnectionFailure: Boolean) {
     val updatedEchConfigList = "new key to encrypt 'private.ech.example.com'".encodeUtf8()
     platform.handshaker =
       handshakerWithUpdatedEchConfigList(
@@ -312,6 +316,12 @@ class EchOnFakeNetworkTest {
         attemptLimit = 2,
       )
 
+    client =
+      client
+        .newBuilder()
+        .retryOnConnectionFailure(retryOnConnectionFailure)
+        .build()
+
     executeHttpExchange()
 
     assertThat(events.take())