diff --git a/pkg/session/stream.go b/pkg/session/stream.go
index a3b93259..2cc79284 100644
--- a/pkg/session/stream.go
+++ b/pkg/session/stream.go
@@ -69,6 +69,12 @@ func stream(ctx context.Context, dir Direction, r, w net.Conn, h Handler, preIc,
 		switch dir {
 		case Up:
 			if err = authorize(ctx, pkt, h); err != nil {
+				if _, ok := pkt.(*packets.PublishPacket); ok {
+					pkt = packets.NewControlPacket(packets.Disconnect)
+					if wErr := pkt.Write(w); wErr != nil {
+						err = errors.Join(err, wErr)
+					}
+				}
 				errs <- wrap(ctx, err, dir)
 				return
 			}