diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 90ed611b0..c661e09cc 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -41,6 +41,11 @@ jobs:
         env:
           QUIC_GO_DISABLE_GSO: true
         run: go run github.com/onsi/ginkgo/v2/ginkgo -r -v -randomize-all -randomize-suites -trace integrationtests/self -- -version=1 ${{ env.QLOGFLAG }}
+      - name: Run self tests, with ECN disabled
+        if: ${{ matrix.os == 'ubuntu' && (success() || failure()) }} # run this step even if the previous one failed
+        env:
+          QUIC_GO_DISABLE_ECN: true
+        run: go run github.com/onsi/ginkgo/v2/ginkgo -r -v -randomize-all -randomize-suites -trace integrationtests/self -- -version=1 ${{ env.QLOGFLAG }}
       - name: Run tests (32 bit)
         if: ${{ matrix.os != 'macos' && (success() || failure()) }} # run this step even if the previous one failed
         env:
diff --git a/sys_conn_oob.go b/sys_conn_oob.go
index b9ddf3c18..71a037d5a 100644
--- a/sys_conn_oob.go
+++ b/sys_conn_oob.go
@@ -8,6 +8,8 @@ import (
 	"log"
 	"net"
 	"net/netip"
+	"os"
+	"strconv"
 	"sync"
 	"syscall"
 	"time"
@@ -57,6 +59,11 @@ func inspectWriteBuffer(c syscall.RawConn) (int, error) {
 	return size, serr
 }
 
+func isECNDisabled() bool {
+	disabled, err := strconv.ParseBool(os.Getenv("QUIC_GO_DISABLE_ECN"))
+	return err == nil && disabled
+}
+
 type oobConn struct {
 	OOBCapablePacketConn
 	batchConn batchConn
@@ -141,7 +148,7 @@ func newConn(c OOBCapablePacketConn, supportsDF bool) (*oobConn, error) {
 		cap: connCapabilities{
 			DF:  supportsDF,
 			GSO: isGSOSupported(rawConn),
-			ECN: true,
+			ECN: !isECNDisabled(),
 		},
 	}
 	for i := 0; i < batchSize; i++ {
@@ -239,6 +246,9 @@ func (c *oobConn) WritePacket(b []byte, addr net.Addr, packetInfoOOB []byte, gso
 		oob = appendUDPSegmentSizeMsg(oob, gsoSize)
 	}
 	if ecn != protocol.ECNUnsupported {
+		if !c.capabilities().ECN {
+			panic("tried to send a ECN-marked packet although ECN is disabled")
+		}
 		if remoteUDPAddr, ok := addr.(*net.UDPAddr); ok {
 			if remoteUDPAddr.IP.To4() != nil {
 				oob = appendIPv4ECNMsg(oob, ecn)