diff --git a/p2p/host/resource-manager/conn_limiter.go b/p2p/host/resource-manager/conn_limiter.go
index 2cea6b30cd..8c0b3d20eb 100644
--- a/p2p/host/resource-manager/conn_limiter.go
+++ b/p2p/host/resource-manager/conn_limiter.go
@@ -1,6 +1,7 @@
 package rcmgr
 
 import (
+	"fmt"
 	"net/netip"
 	"sync"
 )
@@ -85,7 +86,6 @@ func (cl *connLimiter) addConn(ip netip.Addr) bool {
 			return false
 		}
 		masked := prefix.String()
-
 		counts, ok := countsPerLimit[i][masked]
 		if !ok {
 			if countsPerLimit[i] == nil {
diff --git a/p2p/host/resource-manager/rcmgr.go b/p2p/host/resource-manager/rcmgr.go
index dceb18bd8a..739657c2c9 100644
--- a/p2p/host/resource-manager/rcmgr.go
+++ b/p2p/host/resource-manager/rcmgr.go
@@ -677,10 +677,15 @@ func (s *connectionScope) PeerScope() network.PeerScope {
 }
 
 func (s *connectionScope) Done() {
+	s.Lock()
+	defer s.Unlock()
+	if s.done {
+		return
+	}
 	if s.ip.IsValid() {
 		s.rcmgr.connLimiter.rmConn(s.ip)
 	}
-	s.resourceScope.Done()
+	s.resourceScope.doneUnlocked()
 }
 
 // transferAllowedToStandard transfers this connection scope from being part of
diff --git a/p2p/host/resource-manager/scope.go b/p2p/host/resource-manager/scope.go
index bb70c10053..8a6bc23036 100644
--- a/p2p/host/resource-manager/scope.go
+++ b/p2p/host/resource-manager/scope.go
@@ -743,10 +743,13 @@ func (s *resourceScope) Done() {
 	s.Lock()
 	defer s.Unlock()
 
+	s.doneUnlocked()
+}
+
+func (s *resourceScope) doneUnlocked() {
 	if s.done {
 		return
 	}
-
 	stat := s.rc.stat()
 	if s.owner != nil {
 		s.owner.ReleaseResources(stat)