diff --git a/capnp-rpc-net/tls_wrapper.mli b/capnp-rpc-net/tls_wrapper.mli
index 00bcb004..81c214f3 100644
--- a/capnp-rpc-net/tls_wrapper.mli
+++ b/capnp-rpc-net/tls_wrapper.mli
@@ -1,11 +1,12 @@
 open Auth
+open Eio.Std
 
 val connect_as_server :
-  _ Eio.Flow.two_way -> Auth.Secret_key.t option ->
+  [> Eio.Flow.two_way_ty | Eio.Resource.close_ty] r -> Auth.Secret_key.t option ->
   (Endpoint.t, [> `Msg of string]) result
 
 val connect_as_client :
-  _ Eio.Flow.two_way -> Auth.Secret_key.t Lazy.t -> Digest.t ->
+  [> Eio.Flow.two_way_ty | Eio.Resource.close_ty] r -> Auth.Secret_key.t Lazy.t -> Digest.t ->
   (Endpoint.t, [> `Msg of string]) result
 (** [connect_as_client underlying key digest] is an endpoint using flow [underlying].
     If [digest] requires TLS, it performs a TLS handshake. It uses [key] as its private key
diff --git a/unix/network.mli b/unix/network.mli
index 772f20ea..ef68b701 100644
--- a/unix/network.mli
+++ b/unix/network.mli
@@ -1,5 +1,7 @@
 (** A network using TCP and Unix-domain sockets. *)
 
+open Eio.Std
+
 module Location : sig
   type t = [
     | `Unix of string
@@ -32,7 +34,7 @@ val v : _ Eio.Net.t -> t
 
 val accept_connection :
   secret_key:Capnp_rpc_net.Auth.Secret_key.t option ->
-  _ Eio.Flow.two_way ->
+  [> Eio.Flow.two_way_ty | Eio.Resource.close_ty] r ->
   (Capnp_rpc_net.Endpoint.t, [> `Msg of string]) result
 (** [accept_connection ~switch ~secret_key flow] is a new endpoint for [flow].
     If [secret_key] is not [None], it is used to perform a TLS server-side handshake.