diff --git a/internal/martian/proxy_conn.go b/internal/martian/proxy_conn.go
index a4a7808b..ffc15778 100644
--- a/internal/martian/proxy_conn.go
+++ b/internal/martian/proxy_conn.go
@@ -240,6 +240,8 @@ func (p *proxyConn) handleConnectRequest(req *http.Request) error {
 		return p.writeErrorResponse(req, cerr)
 	}
 
+	res.ContentLength = -1
+
 	if err := p.modifyResponse(res); err != nil {
 		log.Debugf(ctx, "error modifying CONNECT response: %v", err)
 		return p.writeErrorResponse(req, err)
@@ -250,8 +252,6 @@ func (p *proxyConn) handleConnectRequest(req *http.Request) error {
 		return p.writeResponse(res)
 	}
 
-	res.ContentLength = -1
-
 	if err := p.tunnel("CONNECT", res, crw); err != nil {
 		log.Errorf(ctx, "CONNECT tunnel: %v", err)
 	}
diff --git a/internal/martian/proxy_test.go b/internal/martian/proxy_test.go
index 49f36d62..91166859 100644
--- a/internal/martian/proxy_test.go
+++ b/internal/martian/proxy_test.go
@@ -822,6 +822,9 @@ func TestIntegrationConnect(t *testing.T) { //nolint:tparallel // Subtests share
 		if got, want := res.StatusCode, 200; got != want {
 			t.Fatalf("res.StatusCode: got %d, want %d", got, want)
 		}
+		if res.ContentLength != -1 {
+			t.Fatalf("res.ContentLength: got %d, want -1", res.ContentLength)
+		}
 
 		if !tm.RequestModified() {
 			t.Error("tm.RequestModified(): got false, want true")