diff --git a/session.go b/session.go
index 817d673c..19817be5 100644
--- a/session.go
+++ b/session.go
@@ -118,6 +118,7 @@ func newSession(conn connection, v protocol.VersionNumber, connectionID protocol
 
 	s.setup()
 	cryptoStream, _ := s.GetOrOpenStream(1)
+	_, _ = s.AcceptStream() // don't expose the crypto stream
 	var sourceAddr []byte
 	if udpAddr, ok := conn.RemoteAddr().(*net.UDPAddr); ok {
 		sourceAddr = udpAddr.IP
diff --git a/session_test.go b/session_test.go
index 5590751d..5beb9dbc 100644
--- a/session_test.go
+++ b/session_test.go
@@ -581,12 +581,7 @@ var _ = Describe("Session", func() {
 
 	Context("accepting streams", func() {
 		It("waits for new streams", func() {
-			// stream 1 was already opened
-			str, err := sess.AcceptStream()
-			Expect(err).ToNot(HaveOccurred())
-			Expect(str.StreamID()).To(Equal(protocol.StreamID(1)))
-			str = nil
-
+			var str utils.Stream
 			go func() {
 				defer GinkgoRecover()
 				var err error
@@ -602,8 +597,6 @@ var _ = Describe("Session", func() {
 		})
 
 		It("stops accepting when the session is closed", func() {
-			sess.AcceptStream() // accept stream 1
-
 			testErr := errors.New("testErr")
 			var err error
 			go func() {
@@ -617,8 +610,6 @@ var _ = Describe("Session", func() {
 		})
 
 		It("stops accepting when the session is closed after version negotiation", func() {
-			sess.AcceptStream() // accept stream 1
-
 			testErr := errCloseSessionForNewVersion
 			var err error
 			go func() {