diff --git a/client/internal/engine.go b/client/internal/engine.go
index cebdc94bc..cf8dcf8ae 100644
--- a/client/internal/engine.go
+++ b/client/internal/engine.go
@@ -2577,6 +2577,7 @@ func (e *Engine) rebindOverlayListeners() {
 func (e *Engine) overlayRebinds() []overlayRebind {
 	return []overlayRebind{
 		e.restartSSHListeners,
+		e.restartVNCListeners,
 		e.restartDNSForwarder,
 	}
 }
diff --git a/client/internal/engine_vnc.go b/client/internal/engine_vnc.go
index 8270b2e88..e03c3f471 100644
--- a/client/internal/engine_vnc.go
+++ b/client/internal/engine_vnc.go
@@ -100,6 +100,22 @@ func (e *Engine) updateVNC() error {
 	return e.startVNCServer()
 }
 
+// restartVNCListeners rebuilds the VNC server so it listens on new sockets.
+// No-op when it is not running. See Engine.rebindOverlayListeners for why this
+// is needed.
+func (e *Engine) restartVNCListeners() error {
+	if e.vncSrv == nil {
+		return nil
+	}
+	if err := e.stopVNCServer(); err != nil {
+		return fmt.Errorf("rebind VNC listeners: %w", err)
+	}
+	if err := e.startVNCServer(); err != nil {
+		return fmt.Errorf("rebind VNC listeners: %w", err)
+	}
+	return nil
+}
+
 func (e *Engine) startVNCServer() error {
 	if e.wgInterface == nil {
 		return errors.New("wg interface not initialized")
diff --git a/client/internal/engine_vnc_stub.go b/client/internal/engine_vnc_stub.go
index b36206380..9c4dd790e 100644
--- a/client/internal/engine_vnc_stub.go
+++ b/client/internal/engine_vnc_stub.go
@@ -21,3 +21,5 @@ func (e *Engine) updateVNCServerAuth(auth *mgmProto.VNCAuth) {
 }
 
 func (e *Engine) stopVNCServer() error { return nil }
+
+func (e *Engine) restartVNCListeners() error { return nil }