diff --git a/ssl/internal.h b/ssl/internal.h
index 4151d2b..ae0e593 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -2297,6 +2297,9 @@
   // wpend_pending is true if we have a pending write outstanding.
   bool wpend_pending:1;
 
+  // early_data_accepted is true if early data was accepted by the server.
+  bool early_data_accepted:1;
+
   uint8_t send_alert[2] = {0};
 
   // hs_buf is the buffer of handshake data to process.
@@ -2643,9 +2646,6 @@
   // hash of the peer's certificate and then discard it to save memory and
   // session space. Only effective on the server side.
   bool retain_only_sha256_of_client_certs:1;
-
-  // early_data_accepted is true if early data was accepted by the server.
-  bool early_data_accepted:1;
 };
 
 // From draft-ietf-tls-tls13-18, used in determining PSK modes.
diff --git a/ssl/s3_lib.cc b/ssl/s3_lib.cc
index b925cd7..9a17573 100644
--- a/ssl/s3_lib.cc
+++ b/ssl/s3_lib.cc
@@ -175,7 +175,8 @@
       send_connection_binding(false),
       tlsext_channel_id_valid(false),
       key_update_pending(false),
-      wpend_pending(false) {}
+      wpend_pending(false),
+      early_data_accepted(false) {}
 
 SSL3_STATE::~SSL3_STATE() {}
 
diff --git a/ssl/ssl_lib.cc b/ssl/ssl_lib.cc
index 6da081e..af4ffc4 100644
--- a/ssl/ssl_lib.cc
+++ b/ssl/ssl_lib.cc
@@ -1187,7 +1187,7 @@
 }
 
 int SSL_early_data_accepted(const SSL *ssl) {
-  return ssl->early_data_accepted;
+  return ssl->s3->early_data_accepted;
 }
 
 void SSL_reset_early_data_reject(SSL *ssl) {
diff --git a/ssl/t1_lib.cc b/ssl/t1_lib.cc
index 34ad410..814cce1 100644
--- a/ssl/t1_lib.cc
+++ b/ssl/t1_lib.cc
@@ -2033,7 +2033,7 @@
     return false;
   }
 
-  ssl->early_data_accepted = true;
+  ssl->s3->early_data_accepted = true;
   return true;
 }
 
@@ -2055,7 +2055,7 @@
 }
 
 static bool ext_early_data_add_serverhello(SSL_HANDSHAKE *hs, CBB *out) {
-  if (!hs->ssl->early_data_accepted) {
+  if (!hs->ssl->s3->early_data_accepted) {
     return true;
   }
 
diff --git a/ssl/tls13_client.cc b/ssl/tls13_client.cc
index c230afa..8d46d9f 100644
--- a/ssl/tls13_client.cc
+++ b/ssl/tls13_client.cc
@@ -464,7 +464,7 @@
     hs->new_session->early_alpn_len = ssl->s3->alpn_selected.size();
   }
 
-  if (ssl->early_data_accepted) {
+  if (ssl->s3->early_data_accepted) {
     if (hs->early_session->cipher != hs->new_session->cipher ||
         MakeConstSpan(hs->early_session->early_alpn,
                       hs->early_session->early_alpn_len) !=
@@ -484,7 +484,7 @@
 
   ssl->method->next_message(ssl);
   hs->tls13_state = state_read_certificate_request;
-  if (hs->in_early_data && !ssl->early_data_accepted) {
+  if (hs->in_early_data && !ssl->s3->early_data_accepted) {
     return ssl_hs_early_data_rejected;
   }
   return ssl_hs_ok;
@@ -663,7 +663,7 @@
 static enum ssl_hs_wait_t do_send_end_of_early_data(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
 
-  if (ssl->early_data_accepted) {
+  if (ssl->s3->early_data_accepted) {
     hs->can_early_write = false;
     if (ssl_is_draft22(ssl->version)) {
       ScopedCBB cbb;
diff --git a/ssl/tls13_server.cc b/ssl/tls13_server.cc
index af9167c..4651459 100644
--- a/ssl/tls13_server.cc
+++ b/ssl/tls13_server.cc
@@ -398,7 +398,7 @@
           // The negotiated ALPN must match the one in the ticket.
           ssl->s3->alpn_selected ==
               MakeConstSpan(session->early_alpn, session->early_alpn_len)) {
-        ssl->early_data_accepted = true;
+        ssl->s3->early_data_accepted = true;
       }
 
       if (hs->new_session == NULL) {
@@ -457,7 +457,7 @@
     return ssl_hs_error;
   }
 
-  if (ssl->early_data_accepted) {
+  if (ssl->s3->early_data_accepted) {
     if (!tls13_derive_early_secrets(hs)) {
       return ssl_hs_error;
     }
@@ -469,7 +469,7 @@
   bool need_retry;
   if (!resolve_ecdhe_secret(hs, &need_retry, &client_hello)) {
     if (need_retry) {
-      ssl->early_data_accepted = false;
+      ssl->s3->early_data_accepted = false;
       ssl->s3->skip_early_data = true;
       ssl->method->next_message(ssl);
       if (ssl_is_draft22(ssl->version) &&
@@ -724,7 +724,7 @@
     return ssl_hs_error;
   }
 
-  if (ssl->early_data_accepted) {
+  if (ssl->s3->early_data_accepted) {
     // If accepting 0-RTT, we send tickets half-RTT. This gets the tickets on
     // the wire sooner and also avoids triggering a write on |SSL_read| when
     // processing the client Finished. This requires computing the client
@@ -772,7 +772,7 @@
 
 static enum ssl_hs_wait_t do_read_second_client_flight(SSL_HANDSHAKE *hs) {
   SSL *const ssl = hs->ssl;
-  if (ssl->early_data_accepted) {
+  if (ssl->s3->early_data_accepted) {
     if (!tls13_set_traffic_key(ssl, evp_aead_open, hs->early_traffic_secret,
                                hs->hash_len)) {
       return ssl_hs_error;
@@ -782,7 +782,8 @@
     hs->in_early_data = true;
   }
   hs->tls13_state = state_process_end_of_early_data;
-  return ssl->early_data_accepted ? ssl_hs_read_end_of_early_data : ssl_hs_ok;
+  return ssl->s3->early_data_accepted ? ssl_hs_read_end_of_early_data
+                                      : ssl_hs_ok;
 }
 
 static enum ssl_hs_wait_t do_process_end_of_early_data(SSL_HANDSHAKE *hs) {
@@ -790,7 +791,7 @@
   if (hs->early_data_offered) {
     // If early data was not accepted, the EndOfEarlyData and ChangeCipherSpec
     // message will be in the discarded early data.
-    if (hs->ssl->early_data_accepted) {
+    if (hs->ssl->s3->early_data_accepted) {
       if (ssl_is_draft22(ssl->version)) {
         SSLMessage msg;
         if (!ssl->method->get_message(ssl, &msg)) {
@@ -813,8 +814,9 @@
                              hs->hash_len)) {
     return ssl_hs_error;
   }
-  hs->tls13_state = ssl->early_data_accepted ? state_read_client_finished
-                                             : state_read_client_certificate;
+  hs->tls13_state = ssl->s3->early_data_accepted
+                        ? state_read_client_finished
+                        : state_read_client_certificate;
   return ssl_hs_ok;
 }
 
@@ -913,14 +915,14 @@
   if (!ssl_check_message_type(ssl, msg, SSL3_MT_FINISHED) ||
       // If early data was accepted, we've already computed the client Finished
       // and derived the resumption secret.
-      !tls13_process_finished(hs, msg, ssl->early_data_accepted) ||
+      !tls13_process_finished(hs, msg, ssl->s3->early_data_accepted) ||
       // evp_aead_seal keys have already been switched.
       !tls13_set_traffic_key(ssl, evp_aead_open, hs->client_traffic_secret_0,
                              hs->hash_len)) {
     return ssl_hs_error;
   }
 
-  if (!ssl->early_data_accepted) {
+  if (!ssl->s3->early_data_accepted) {
     if (!ssl_hash_message(hs, msg) ||
         !tls13_derive_resumption_secret(hs)) {
       return ssl_hs_error;