diff --git a/src/linuxkm.c b/src/linuxkm.c
index 502af76..2ecac6a 100644
--- a/src/linuxkm.c
+++ b/src/linuxkm.c
@@ -10,7 +10,6 @@ EXPORT_SYMBOL(br_ssl_client_reset);
 EXPORT_SYMBOL(br_ssl_engine_recvapp_buf);
 EXPORT_SYMBOL(br_ssl_engine_recvapp_ack);
 EXPORT_SYMBOL(br_sslio_init);
-EXPORT_SYMBOL(br_sslio_run_until);
 EXPORT_SYMBOL(br_sslio_read);
 EXPORT_SYMBOL(br_sslio_write_all);
 EXPORT_SYMBOL(br_sslio_flush);
diff --git a/src/ssl/ssl_io.c b/src/ssl/ssl_io.c
index 5bad81b..35d9a3f 100644
--- a/src/ssl/ssl_io.c
+++ b/src/ssl/ssl_io.c
@@ -143,10 +143,6 @@ run_until(br_sslio_context *ctx, unsigned target)
 	}
 }
 
-/* expose run_until, we need it for MSG_PEEK */
-int
-(*br_sslio_run_until)(br_sslio_context *ctx, unsigned target) = run_until;
-
 /* see bearssl_ssl.h */
 int
 br_sslio_read(br_sslio_context *ctx, void *dst, size_t len)
@@ -157,8 +153,13 @@ br_sslio_read(br_sslio_context *ctx, void *dst, size_t len)
 	if (len == 0) {
 		return 0;
 	}
-	if (run_until(ctx, BR_SSL_RECVAPP) < 0) {
-		return -1;
+	int ret = run_until(ctx, BR_SSL_RECVAPP);
+	if (ret < 0) {
+		unsigned state = br_ssl_engine_current_state(ctx->engine);
+		if (state & BR_SSL_CLOSED) {
+			return 0;
+		}
+		return ret;
 	}
 	buf = br_ssl_engine_recvapp_buf(ctx->engine, &alen);
 	if (alen > len) {