diff --git a/src/protopassthrough.c b/src/protopassthrough.c
index 7f62277..27a7831 100644
--- a/src/protopassthrough.c
+++ b/src/protopassthrough.c
@@ -258,8 +258,13 @@ protopassthrough_bev_eventcb_connected_srvdst(struct bufferevent *bev, pxy_conn_
 	bufferevent_enable(bev, EV_READ|EV_WRITE);
 
 	// Do not re-enable src if it is already enabled, e.g. in autossl
-	if (!ctx->src.bev && protopassthrough_enable_src(ctx) == -1) {
-		return;
+	if (!ctx->src.bev) {
+		if (protopassthrough_enable_src(ctx) == -1) {
+			return;
+		}
+	} else if (evbuffer_get_length(bufferevent_get_input(ctx->src.bev)) > 0) {
+		log_finer("src inbuf len > 0, calling bev_readcb for src");
+		ctx->protoctx->bev_readcb(ctx->src.bev, ctx);
 	}
 }
 
diff --git a/src/protossl.c b/src/protossl.c
index 9dca177..b1aeb0d 100644
--- a/src/protossl.c
+++ b/src/protossl.c
@@ -1604,6 +1604,12 @@ protossl_setup_src_ssl_from_dst(pxy_conn_ctx_t *ctx)
 	else if (ctx->term) {
 		return -1;
 	}
+	else if (!ctx->enomem && (ctx->pass || ctx->conn_opts->passthrough)) {
+		log_err_level_printf(LOG_WARNING, "Falling back to passthrough\n");
+		protopassthrough_engage(ctx);
+		// report protocol change by returning 1
+		return 1;
+	}
 	pxy_conn_term(ctx, 1);
 	return -1;
 }
@@ -1619,6 +1625,12 @@ protossl_setup_src_ssl_from_child_dst(pxy_conn_child_ctx_t *ctx)
 	else if (ctx->conn->term) {
 		return -1;
 	}
+	else if (!ctx->conn->enomem && (ctx->conn->pass || ctx->conn->conn_opts->passthrough)) {
+		log_err_level_printf(LOG_WARNING, "Falling back to passthrough\n");
+		protopassthrough_engage(ctx->conn);
+		// report protocol change by returning 1
+		return 1;
+	}
 	pxy_conn_term(ctx->conn, 1);
 	return -1;
 }