diff --git a/ssl/tls13_client.cc b/ssl/tls13_client.cc
index 95ef653..5e2b03e 100644
--- a/ssl/tls13_client.cc
+++ b/ssl/tls13_client.cc
@@ -155,7 +155,10 @@
 
 static enum ssl_hs_wait_t do_send_second_client_hello(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (!ssl->method->set_write_state(ssl, NULL) ||
+  /* Restore the null cipher. We may have switched due to 0-RTT. */
+  bssl::UniquePtr<SSLAEADContext> null_ctx = SSLAEADContext::CreateNullCipher();
+  if (!null_ctx ||
+      !ssl->method->set_write_state(ssl, std::move(null_ctx)) ||
       !ssl_write_client_hello(hs)) {
     return ssl_hs_error;
   }