diff --git a/modules/caddytls/tls.go b/modules/caddytls/tls.go
index d6324788e..36c1931fd 100644
--- a/modules/caddytls/tls.go
+++ b/modules/caddytls/tls.go
@@ -428,10 +428,10 @@ func (t *TLS) Start() error {
 				case <-time.After(1 * time.Hour):
 					// ensure old keys are rotated out
 					t.EncryptedClientHello.configsMu.Lock()
-					err = t.EncryptedClientHello.rotateECHKeys(t.ctx, echLogger, false)
+					rotateErr := t.EncryptedClientHello.rotateECHKeys(t.ctx, echLogger, false)
 					t.EncryptedClientHello.configsMu.Unlock()
-					if err != nil {
-						echLogger.Error("rotating ECH configs failed", zap.Error(err))
+					if rotateErr != nil {
+						echLogger.Error("rotating ECH configs failed", zap.Error(rotateErr))
 					}
 				case <-t.ctx.Done():
 					return