diff --git a/internal/store/store.go b/internal/store/store.go
index da10279..70a6f09 100644
--- a/internal/store/store.go
+++ b/internal/store/store.go
@@ -16,6 +16,7 @@ func New(ctx context.Context, dsn string) (*Store, error) {
 		return nil, err
 	}
 	if err := pool.Ping(ctx); err != nil {
+		pool.Close()
 		return nil, err
 	}
 	return &Store{Pool: pool}, nil
diff --git a/internal/store/store_test.go b/internal/store/store_test.go
index ef9d556..2a12c33 100644
--- a/internal/store/store_test.go
+++ b/internal/store/store_test.go
@@ -38,3 +38,23 @@ func TestCreateAndGetEndpoint(t *testing.T) {
 		t.Fatalf("got %+v", got)
 	}
 }
+
+func TestListEndpointsOrdered(t *testing.T) {
+	s := testStore(t)
+	ctx := context.Background()
+	id1, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "src", Host: "a.com", Port: 993, TLSMode: "ssl"})
+	id2, _ := s.CreateEndpoint(ctx, Endpoint{RoleLabel: "dst", Host: "b.com", Port: 143, TLSMode: "starttls"})
+	eps, err := s.ListEndpoints(ctx)
+	if err != nil {
+		t.Fatalf("list: %v", err)
+	}
+	if len(eps) != 2 {
+		t.Fatalf("len=%d want 2", len(eps))
+	}
+	if eps[0].ID != id1 || eps[1].ID != id2 {
+		t.Fatalf("order wrong: %d,%d want %d,%d", eps[0].ID, eps[1].ID, id1, id2)
+	}
+	if eps[1].TLSMode != "starttls" {
+		t.Fatalf("eps[1].TLSMode=%q want starttls", eps[1].TLSMode)
+	}
+}