diff --git a/netwerk/base/nsSocketTransportService2.cpp b/netwerk/base/nsSocketTransportService2.cpp
index 9a925c7bb5f7..888f1a456338 100644
--- a/netwerk/base/nsSocketTransportService2.cpp
+++ b/netwerk/base/nsSocketTransportService2.cpp
@@ -728,17 +728,7 @@ int32_t nsSocketTransportService::Poll(PRIntervalTime ts) {
   int32_t n;
   {
     TimeStamp startTime = TimeStamp::Now();
-    if (pollTimeout != PR_INTERVAL_NO_WAIT) {
-      // There will be an actual non-zero wait, let the profiler know about it
-      // by marking thread as sleeping around the polling call.
-      profiler_thread_sleep();
-    }
-
     n = PR_Poll(firstPollEntry, pollCount, pollTimeout);
-
-    if (pollTimeout != PR_INTERVAL_NO_WAIT) {
-      profiler_thread_wake();
-    }
     if (profiler_thread_is_being_profiled_for_markers()) {
       PROFILER_MARKER_TEXT(
           "SocketTransportService::Poll", NETWORK,
diff --git a/security/manager/ssl/nsNSSIOLayer.cpp b/security/manager/ssl/nsNSSIOLayer.cpp
index fb0babcac866..c006c49855cd 100644
--- a/security/manager/ssl/nsNSSIOLayer.cpp
+++ b/security/manager/ssl/nsNSSIOLayer.cpp
@@ -18,6 +18,7 @@
 #include "brotli/decode.h"
 #include "keyhi.h"
 #include "mozilla/Base64.h"
+#include "mozilla/BaseProfiler.h"
 #include "mozilla/Logging.h"
 #include "mozilla/Preferences.h"
 #include "mozilla/RandomNum.h"
@@ -1002,6 +1003,14 @@ static int32_t PlaintextRecv(PRFileDesc* fd, void* buf, int32_t amount,
   return bytesRead;
 }
 
+static int16_t PlaintextPoll(PRFileDesc* fd, int16_t in_flags,
+                             int16_t* out_flags) {
+  // This thread may sleep as a result of this poll call - let the profiler
+  // know about it.
+  AutoProfilerThreadSleep _;
+  return fd->lower->methods->poll(fd->lower, in_flags, out_flags);
+}
+
 nsSSLIOLayerHelpers::~nsSSLIOLayerHelpers() {
   // Pref observers must have been removed before destruction, since the
   // destructor may run off the main thread.
@@ -1079,6 +1088,7 @@ nsresult nsSSLIOLayerHelpers::Init() {
     nsSSLPlaintextLayerIdentity = PR_GetUniqueIdentity("Plaintxext PSM layer");
     nsSSLPlaintextLayerMethods = *PR_GetDefaultIOMethods();
     nsSSLPlaintextLayerMethods.recv = PlaintextRecv;
+    nsSSLPlaintextLayerMethods.poll = PlaintextPoll;
   }
 
   loadVersionFallbackLimit();
diff --git a/security/manager/ssl/tests/unit/test_pkcs11_module_client_auth.js b/security/manager/ssl/tests/unit/test_pkcs11_module_client_auth.js
index 6f08c461853e..73588687cef6 100644
--- a/security/manager/ssl/tests/unit/test_pkcs11_module_client_auth.js
+++ b/security/manager/ssl/tests/unit/test_pkcs11_module_client_auth.js
@@ -7,10 +7,6 @@
 // Ensure that the appropriate initialization has happened.
 do_get_profile();
 
-const gCertDB = Cc["@mozilla.org/security/x509certdb;1"].getService(
-  Ci.nsIX509CertDB
-);
-
 var gPrompt = {
   QueryInterface: ChromeUtils.generateQI(["nsIPrompt"]),
 
@@ -58,22 +54,6 @@ add_task(async function run_test() {
     "requireclientauth.example.com"
   );
 
-  // The test module currently has a slot that uses a protected authentication
-  // path (i.e., when Firefox wants to authenticate to it, it opens a dialog
-  // that says "okay, authenticate to your token by using an external keypad or
-  // something" and waits for that to happen). For some reason, if this
-  // authentication happens as a result of the socket thread looking for client
-  // auth certificates, it results in an assertion failure ("Assertion
-  // failure: mSleep == AWAKE") in profiler_thread_sleep(). This probably has
-  // something to do with the fact that the socket thread is synchronously
-  // waiting on the main thread, which is spinning a nested event loop (which
-  // tends to cause problems like this).
-  // Since this is an uncommon configuration and since this issue hasn't been
-  // reproduced outside of this test infrastructure, this works around it for
-  // the time being by authenticating to all tokens beforehand so that the
-  // socket thread doesn't have to.
-  await gCertDB.getCerts();
-
   await asyncStartTLSTestServer("BadCertAndPinningServer", "bad_certs");
   gClientAuthDialogService.certificateNameToUse = "CN=client cert rsa";
   await asyncConnectTo("requireclientauth.example.com", PRErrorCodeSuccess);