diff --git a/quic/core/quic_crypto_client_handshaker.cc b/quic/core/quic_crypto_client_handshaker.cc
index f59e56c..013ab3f 100644
--- a/quic/core/quic_crypto_client_handshaker.cc
+++ b/quic/core/quic_crypto_client_handshaker.cc
@@ -295,7 +295,7 @@
   // Send the client hello in plaintext.
   session()->connection()->SetDefaultEncryptionLevel(ENCRYPTION_INITIAL);
   encryption_established_ = false;
-  if (num_client_hellos_ > QuicCryptoClientStream::kMaxClientHellos) {
+  if (num_client_hellos_ >= QuicCryptoClientStream::kMaxClientHellos) {
     stream_->CloseConnectionWithDetails(
         QUIC_CRYPTO_TOO_MANY_REJECTS,
         QuicStrCat("More than ", QuicCryptoClientStream::kMaxClientHellos,
diff --git a/quic/core/quic_crypto_client_stream.h b/quic/core/quic_crypto_client_stream.h
index 3518fa7..d0e4ee1 100644
--- a/quic/core/quic_crypto_client_stream.h
+++ b/quic/core/quic_crypto_client_stream.h
@@ -46,12 +46,15 @@
     : public QuicCryptoClientStreamBase {
  public:
   // kMaxClientHellos is the maximum number of times that we'll send a client
-  // hello. The value 3 accounts for:
+  // hello. The value 4 accounts for:
   //   * One failure due to an incorrect or missing source-address token.
   //   * One failure due the server's certificate chain being unavailible and
   //     the server being unwilling to send it without a valid source-address
   //     token.
-  static const int kMaxClientHellos = 3;
+  //   * One failure due to the ServerConfig private key being located on a
+  //     remote oracle which has become unavailable, forcing the server to send
+  //     the client a fallback ServerConfig.
+  static const int kMaxClientHellos = 4;
 
   // QuicCryptoClientStream creates a HandshakerDelegate at construction time
   // based on the QuicTransportVersion of the connection. Different