diff --git a/changes/bug24898-029 b/changes/bug24898-029
new file mode 100644
index 000000000..b33f09384
--- /dev/null
+++ b/changes/bug24898-029
@@ -0,0 +1,6 @@
+  o Minor bugfixes (relay):
+    - Make the internal channel_is_client() function look at what sort
+      of connection handshake the other side used, rather than whether
+      the other side ever sent a create_fast cell to us. Backports part
+      of the fixes from bugs 22805 and 24898.
+
diff --git a/src/or/channeltls.c b/src/or/channeltls.c
index 09cca95b6..31641c3db 100644
--- a/src/or/channeltls.c
+++ b/src/or/channeltls.c
@@ -1640,6 +1640,10 @@ channel_tls_process_netinfo_cell(cell_t *cell, channel_tls_t *chan)
         tor_assert(tor_digest_is_zero(
                   (const char*)(chan->conn->handshake_state->
                       authenticated_peer_id)));
+        /* If the client never authenticated, it's a tor client or bridge
+         * relay, and we must not use it for EXTEND requests (nor could we, as
+         * there are no authenticated peer IDs) */
+        channel_mark_client(TLS_CHAN_TO_BASE(chan));
         channel_set_circid_type(TLS_CHAN_TO_BASE(chan), NULL,
                chan->conn->link_proto < MIN_LINK_PROTO_FOR_WIDE_CIRC_IDS);
 
diff --git a/src/or/command.c b/src/or/command.c
index 5866c386e..8831446f0 100644
--- a/src/or/command.c
+++ b/src/or/command.c
@@ -344,10 +344,6 @@ command_process_create_cell(cell_t *cell, channel_t *chan)
     int len;
     created_cell_t created_cell;
 
-    /* Make sure we never try to use the OR connection on which we
-     * received this cell to satisfy an EXTEND request,  */
-    channel_mark_client(chan);
-
     memset(&created_cell, 0, sizeof(created_cell));
     len = onion_skin_server_handshake(ONION_HANDSHAKE_TYPE_FAST,
                                        create_cell->onionskin,
diff --git a/src/or/connection_or.c b/src/or/connection_or.c
index dadfdc438..8beedcae7 100644
--- a/src/or/connection_or.c
+++ b/src/or/connection_or.c
@@ -1880,6 +1880,12 @@ connection_or_set_state_open(or_connection_t *conn)
   connection_or_change_state(conn, OR_CONN_STATE_OPEN);
   control_event_or_conn_status(conn, OR_CONN_EVENT_CONNECTED, 0);
 
+  /* Link protocol 3 appeared in Tor 0.2.3.6-alpha, so any connection
+   * that uses an earlier link protocol should not be treated as a relay. */
+  if (conn->link_proto < 3) {
+    channel_mark_client(TLS_CHAN_TO_BASE(conn->chan));
+  }
+
   or_handshake_state_free(conn->handshake_state);
   conn->handshake_state = NULL;
   connection_start_reading(TO_CONN(conn));