diff --git a/src/nm-device.c b/src/nm-device.c
index ba88c6b0e3..26b00474dc 100644
--- a/src/nm-device.c
+++ b/src/nm-device.c
@@ -1312,6 +1312,22 @@ dhcp_state_changed (NMDHCPClient *client,
 		else if (nm_device_get_state (device) == NM_DEVICE_STATE_ACTIVATED)
 			nm_device_state_changed (device, NM_DEVICE_STATE_FAILED, NM_DEVICE_STATE_REASON_IP_CONFIG_EXPIRED);
 		break;
+	case DHC_STOP:
+	case DHC_STOP6:
+	case DHC_EXPIRE:
+	case DHC_EXPIRE6:
+		if (dev_state == NM_DEVICE_STATE_ACTIVATED) {
+			if (ipv6)
+				nm_dhcp6_config_reset (priv->dhcp6_config);
+			else
+				nm_dhcp4_config_reset (priv->dhcp4_config);
+
+			/* dhclient quit and can't get/renew a lease; so kill the connection */
+			nm_device_state_changed (device,
+			                         NM_DEVICE_STATE_FAILED,
+			                         NM_DEVICE_STATE_REASON_IP_CONFIG_EXPIRED);
+		}
+		break;
 	default:
 		break;
 	}
diff --git a/src/nm-policy.c b/src/nm-policy.c
index 4fccaf4d11..2591de27b6 100644
--- a/src/nm-policy.c
+++ b/src/nm-policy.c
@@ -585,10 +585,23 @@ device_state_changed (NMDevice *device,
 		/* Mark the connection invalid if it failed during activation so that
 		 * it doesn't get automatically chosen over and over and over again.
 		 */
-		if (connection && IS_ACTIVATING_STATE (old_state)) {
-			g_object_set_data (G_OBJECT (connection), INVALID_TAG, GUINT_TO_POINTER (TRUE));
-			nm_log_info (LOGD_DEVICE, "Marking connection '%s' invalid.", get_connection_id (connection));
-			nm_connection_clear_secrets (connection);
+		if (connection) {
+			gboolean fail = FALSE;
+
+			if (IS_ACTIVATING_STATE (old_state)) {
+				nm_log_info (LOGD_DEVICE, "Marking connection '%s' invalid.", get_connection_id (connection));
+				fail = TRUE;
+			} else if (   (old_state == NM_DEVICE_STATE_ACTIVATED)
+			         && (reason == NM_DEVICE_STATE_REASON_IP_CONFIG_EXPIRED)) {
+				nm_log_info (LOGD_DEVICE, "Marking connection '%s' invalid because IP configuration expired.",
+				             get_connection_id (connection));
+				fail = TRUE;
+			}
+
+			if (fail) {
+				g_object_set_data (G_OBJECT (connection), INVALID_TAG, GUINT_TO_POINTER (TRUE));
+				nm_connection_clear_secrets (connection);
+			}
 		}
 		schedule_activate_check (policy, device, 3);
 		break;