diff --git a/cmd/lima-guestagent/daemon_linux.go b/cmd/lima-guestagent/daemon_linux.go
index 8ac0a304f0e..8c80d96d566 100644
--- a/cmd/lima-guestagent/daemon_linux.go
+++ b/cmd/lima-guestagent/daemon_linux.go
@@ -70,6 +70,8 @@ func daemonAction(cmd *cobra.Command, _ []string) error {
 	if err != nil {
 		return err
 	}
+	defer agent.Close()
+
 	err = os.RemoveAll(socket)
 	if err != nil {
 		return err
diff --git a/pkg/guestagent/guestagent.go b/pkg/guestagent/guestagent.go
index eebacd39a88..6b2b21b049d 100644
--- a/pkg/guestagent/guestagent.go
+++ b/pkg/guestagent/guestagent.go
@@ -5,6 +5,7 @@ package guestagent
 
 import (
 	"context"
+	"io"
 
 	"github.com/lima-vm/lima/v2/pkg/guestagent/api"
 )
@@ -14,4 +15,5 @@ type Agent interface {
 	Events(ctx context.Context, ch chan *api.Event)
 	LocalPorts(ctx context.Context) ([]*api.IPPort, error)
 	HandleInotify(event *api.Inotify)
+	io.Closer
 }
diff --git a/pkg/guestagent/guestagent_linux.go b/pkg/guestagent/guestagent_linux.go
index 1ad20152967..362e7b9b83e 100644
--- a/pkg/guestagent/guestagent_linux.go
+++ b/pkg/guestagent/guestagent_linux.go
@@ -20,8 +20,13 @@ import (
 )
 
 func New(ctx context.Context, ticker ticker.Ticker) (Agent, error) {
+	socketsLister, err := sockets.NewLister()
+	if err != nil {
+		return nil, err
+	}
 	a := &agent{
 		ticker:                   ticker,
+		socketLister:             socketsLister,
 		kubernetesServiceWatcher: kubernetesservice.NewServiceWatcher(),
 	}
 
@@ -35,8 +40,8 @@ type agent struct {
 	// Ticker is like time.Ticker.
 	// We can't use inotify for /proc/net/tcp, so we need this ticker to
 	// reload /proc/net/tcp.
-	ticker ticker.Ticker
-
+	ticker                   ticker.Ticker
+	socketLister             *sockets.Lister
 	kubernetesServiceWatcher *kubernetesservice.ServiceWatcher
 }
 
@@ -119,7 +124,7 @@ func (a *agent) Events(ctx context.Context, ch chan *api.Event) {
 
 func (a *agent) LocalPorts(_ context.Context) ([]*api.IPPort, error) {
 	var res []*api.IPPort
-	socketsList, err := sockets.List()
+	socketsList, err := a.socketLister.List()
 	if err != nil {
 		return res, err
 	}
@@ -227,3 +232,12 @@ func (a *agent) HandleInotify(event *api.Inotify) {
 		}
 	}
 }
+
+func (a *agent) Close() error {
+	if a.socketLister != nil {
+		if err := a.socketLister.Close(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
diff --git a/pkg/guestagent/sockets/sockets_linux.go b/pkg/guestagent/sockets/sockets_linux.go
index de7bf984c91..67cca7747c6 100644
--- a/pkg/guestagent/sockets/sockets_linux.go
+++ b/pkg/guestagent/sockets/sockets_linux.go
@@ -97,21 +97,26 @@ func parseMessages(msgs []netlink.Message, proto int) ([]Socket, error) {
 	return sockets, nil
 }
 
-func List() ([]Socket, error) {
-	// open NETLINK_INET_DIAG once and reuse
-	var sockets []Socket
+func NewLister() (*Lister, error) {
 	conn, err := netlink.Dial(unix.NETLINK_SOCK_DIAG, nil)
 	if err != nil {
-		return sockets, fmt.Errorf("failed to open netlink connection: %w", err)
+		return nil, fmt.Errorf("failed to open netlink connection: %w", err)
 	}
-	defer conn.Close()
+	return &Lister{conn: conn}, nil
+}
+
+type Lister struct {
+	conn *netlink.Conn
+}
 
+func (lister *Lister) List() ([]Socket, error) {
 	protos := []int{unix.IPPROTO_TCP, unix.IPPROTO_UDP}
 	families := []int{unix.AF_INET, unix.AF_INET6}
 
+	var sockets []Socket
 	for _, proto := range protos {
 		for _, fam := range families {
-			msgs, err := query(conn, fam, proto)
+			msgs, err := query(lister.conn, fam, proto)
 			if err != nil {
 				continue
 			}
@@ -124,3 +129,7 @@ func List() ([]Socket, error) {
 	}
 	return sockets, nil
 }
+
+func (lister *Lister) Close() error {
+	return lister.conn.Close()
+}
diff --git a/pkg/guestagent/sockets/sockets_linux_test.go b/pkg/guestagent/sockets/sockets_linux_test.go
index 6380c1dea3d..78b82c4734b 100644
--- a/pkg/guestagent/sockets/sockets_linux_test.go
+++ b/pkg/guestagent/sockets/sockets_linux_test.go
@@ -104,7 +104,10 @@ func TestParseMessages_ShortDataSkipped(t *testing.T) {
 }
 
 func TestListS_Integration(t *testing.T) {
-	_, err := List()
+	lister, err := NewLister()
+	assert.NilError(t, err, "NewLister error")
+	defer lister.Close()
+	_, err = lister.List()
 	if err != nil {
 		t.Skipf("skipping: cannot query netlink inet_diag (%v)", err)
 	}