diff --git a/packages/grpc-js/src/server.ts b/packages/grpc-js/src/server.ts
index b187765b..adefec01 100644
--- a/packages/grpc-js/src/server.ts
+++ b/packages/grpc-js/src/server.ts
@@ -576,9 +576,11 @@ export class Server {
         enableTrace: this.options['grpc-node.tls_enable_trace'] === 1
       };
       let areCredentialsValid = credentialsSettings !== null;
+      this.trace('Initial credentials valid: ' + areCredentialsValid);
       http2Server = http2.createSecureServer(secureServerOptions);
-      http2Server.on('connection', (socket: Socket) => {
+      http2Server.prependListener('connection', (socket: Socket) => {
         if (!areCredentialsValid) {
+          this.trace('Dropped connection from ' + JSON.stringify(socket.address()) + ' due to unloaded credentials');
           socket.destroy();
         }
       });
@@ -596,6 +598,7 @@ export class Server {
           (http2Server as http2.Http2SecureServer).setSecureContext(options);
         }
         areCredentialsValid = options !== null;
+        this.trace('Post-update credentials valid: ' + areCredentialsValid);
       }
       credentials._addWatcher(credsWatcher);
       http2Server.on('close', () => {
diff --git a/packages/grpc-js/src/transport.ts b/packages/grpc-js/src/transport.ts
index 6e4fbd42..055fb9dd 100644
--- a/packages/grpc-js/src/transport.ts
+++ b/packages/grpc-js/src/transport.ts
@@ -738,7 +738,7 @@ export class Http2SubchannelConnector implements SubchannelConnector {
     }
     let tcpConnection: net.Socket | null = null;
     let secureConnectResult: SecureConnectResult | null  = null;
-    const addressString = this.trace(subchannelAddressToString(address));
+    const addressString = subchannelAddressToString(address);
     try {
       tcpConnection = await this.tcpConnect(address, options);
       this.trace(addressString + ' ' + 'Established TCP connection');