diff --git a/lib/tunnelbroker/tunnelbroker-context.js b/lib/tunnelbroker/tunnelbroker-context.js
--- a/lib/tunnelbroker/tunnelbroker-context.js
+++ b/lib/tunnelbroker/tunnelbroker-context.js
@@ -55,6 +55,8 @@
 
 type Props = {
   +children: React.Node,
+  +shouldBeClosed?: boolean,
+  +onClose?: () => mixed,
   +initMessage: ?ConnectionInitializationMessage,
 };
 
@@ -69,7 +71,12 @@
 }
 
 function TunnelbrokerProvider(props: Props): React.Node {
-  const { children, initMessage: initMessageProp } = props;
+  const {
+    children,
+    shouldBeClosed,
+    onClose,
+    initMessage: initMessageProp,
+  } = props;
   const [connected, setConnected] = React.useState(false);
   const listeners = React.useRef<Set<TunnelbrokerSocketListener>>(new Set());
   const socket = React.useRef<?WebSocket>(null);
@@ -84,11 +91,14 @@
   const { identityClient } = identityContext;
 
   const initMessage = React.useMemo(() => {
+    if (shouldBeClosed) {
+      return null;
+    }
     if (!unauthorizedDeviceID) {
       return initMessageProp;
     }
     return createAnonymousInitMessage(unauthorizedDeviceID);
-  }, [unauthorizedDeviceID, initMessageProp]);
+  }, [shouldBeClosed, unauthorizedDeviceID, initMessageProp]);
 
   const previousInitMessage =
     React.useRef<?TunnelbrokerInitializationMessage>(initMessage);
@@ -145,6 +155,7 @@
     tunnelbrokerSocket.onclose = () => {
       // this triggers the effect hook again and reconnect
       setConnected(false);
+      onClose?.();
       console.log('Connection to Tunnelbroker closed');
     };
     tunnelbrokerSocket.onerror = e => {
@@ -255,6 +266,7 @@
     resetHeartbeatTimeout,
     stopHeartbeatTimeout,
     identityClient,
+    onClose,
   ]);
 
   const sendMessage: (message: ClientMessageToDevice) => Promise<void> =
diff --git a/web/app.react.js b/web/app.react.js
--- a/web/app.react.js
+++ b/web/app.react.js
@@ -80,6 +80,7 @@
 import css from './style.css';
 import { TooltipProvider } from './tooltips/tooltip-provider.js';
 import { canonicalURLFromReduxState, navInfoFromURL } from './url-utils.js';
+import { useWebLock, TUNNELBROKER_LOCK_NAME } from './web-lock.js';
 
 void initOpaque();
 
@@ -406,9 +407,17 @@
 
     const tunnelbrokerInitMessage = useSelector(createTunnelbrokerInitMessage);
 
+    const { lockStatus, releaseLockOrAbortRequest } = useWebLock(
+      TUNNELBROKER_LOCK_NAME,
+    );
+
     return (
       <AppThemeWrapper>
-        <TunnelbrokerProvider initMessage={tunnelbrokerInitMessage}>
+        <TunnelbrokerProvider
+          initMessage={tunnelbrokerInitMessage}
+          shouldBeClosed={lockStatus !== 'acquired'}
+          onClose={releaseLockOrAbortRequest}
+        >
           <IdentitySearchProvider>
             <App
               {...props}
diff --git a/web/web-lock.js b/web/web-lock.js
--- a/web/web-lock.js
+++ b/web/web-lock.js
@@ -143,4 +143,6 @@
   +removeDisposeHandler: ((data: mixed) => void) => void,
 };
 
-export { useWebLock };
+const TUNNELBROKER_LOCK_NAME = 'tunnelbroker-lock';
+
+export { useWebLock, TUNNELBROKER_LOCK_NAME };