diff --git a/scripts/riot b/scripts/riot
index 93a27bb..b9ccef8 100755
--- a/scripts/riot
+++ b/scripts/riot
@@ -255,6 +255,10 @@ prepare_gpg_forwarding() {
         fi
     fi
 
+    # A pre-existing multiplex master cannot apply this connection's -R
+    # forwarding request. Put this first because OpenSSH keeps the first
+    # value for repeated options, and force a dedicated connection.
+    SSH_OPTIONS=("-o" "ControlMaster=no" "${SSH_OPTIONS[@]}")
     SSH_OPTIONS+=(
         # The probe already removed the old socket. Do not let the main SSH
         # connection unlink a path recreated during the gap between them.
diff --git a/tools/test-riot-gpg.sh b/tools/test-riot-gpg.sh
index 154df6b..818c9fc 100755
--- a/tools/test-riot-gpg.sh
+++ b/tools/test-riot-gpg.sh
@@ -127,6 +127,7 @@ grep -Fq 'ARG=-T' "$MOCK_SSH_LOG"
 ! grep -Fq 'ARG=RequestTTY=' "$MOCK_SSH_LOG"
 grep -Fq 'ARG=StreamLocalBindUnlink=no' "$MOCK_SSH_LOG"
 grep -Fq "ARG=$MOCK_REMOTE_SOCKET:$MOCK_LOCAL_SOCKET" "$MOCK_SSH_LOG"
+grep -Fq 'ARG=ControlMaster=no' "$MOCK_SSH_LOG"
 [[ ! -e "$MOCK_REMOTE_SOCKET" ]]
 
 echo 'riot gpg forwarding tests passed'