diff --git a/changes/ticket40586 b/changes/ticket40586
new file mode 100644
index 0000000000..a872ac2448
--- /dev/null
+++ b/changes/ticket40586
@@ -0,0 +1,5 @@
+  o Major bugfixes (onion service, congestion control):
+    - Fix the onion service upload case where the congestion control parameters
+      were not added to the right object. Fixes bug 40586; bugfix on
+      0.4.7.4-alpha.
+
diff --git a/src/feature/hs/hs_circuit.c b/src/feature/hs/hs_circuit.c
index f8a0e06d90..6c4e315e4e 100644
--- a/src/feature/hs/hs_circuit.c
+++ b/src/feature/hs/hs_circuit.c
@@ -131,6 +131,12 @@ finalize_rend_circuit(origin_circuit_t *circ, crypt_path_t *hop,
    * so we can actually use it. */
   circ->hs_circ_has_timed_out = 0;
 
+  /* If congestion control, transfer ccontrol onto the cpath. */
+  if (TO_CIRCUIT(circ)->ccontrol) {
+    hop->ccontrol = TO_CIRCUIT(circ)->ccontrol;
+    TO_CIRCUIT(circ)->ccontrol = NULL;
+  }
+
   /* Append the hop to the cpath of this circuit */
   cpath_extend_linked_list(&circ->cpath, hop);
 
@@ -416,6 +422,11 @@ launch_rendezvous_point_circuit,(const hs_service_t *service,
       .sendme_inc_cells = congestion_control_sendme_inc(),
     };
 
+    /* It is setup on the circuit in order to indicate that congestion control
+     * is enabled. It will be transferred to the RP crypt_path_t once the
+     * handshake is finalized in finalize_rend_circuit() because the final hop
+     * is not available until then. */
+
     /* Initialize ccontrol for appropriate path type */
     if (service->config.is_single_onion) {
       TO_CIRCUIT(circ)->ccontrol = congestion_control_new(&circ_params,
@@ -533,6 +544,11 @@ retry_service_rendezvous_point(const origin_circuit_t *circ)
       .sendme_inc_cells = TO_CIRCUIT(circ)->ccontrol->sendme_inc,
     };
 
+    /* It is setup on the circuit in order to indicate that congestion control
+     * is enabled. It will be transferred to the RP crypt_path_t once the
+     * handshake is finalized in finalize_rend_circuit() because the final hop
+     * is not available until then. */
+
     /* As per above, in this case, we are a full 3 hop rend, even if we're a
      * single-onion service */
     if (get_options()->HSLayer3Nodes) {
diff --git a/src/feature/hs/hs_client.c b/src/feature/hs/hs_client.c
index eb68adfd76..c845a5a945 100644
--- a/src/feature/hs/hs_client.c
+++ b/src/feature/hs/hs_client.c
@@ -826,6 +826,11 @@ setup_rendezvous_circ_congestion_control(origin_circuit_t *circ)
   if (circ_params.cc_enabled) {
     circ_params.sendme_inc_cells = desc->encrypted_data.sendme_inc;
 
+    /* It is setup on the circuit in order to indicate that congestion control
+     * is enabled. It will be transferred to the RP crypt_path_t once the
+     * handshake is finalized in finalize_rend_circuit() because the final hop
+     * is not available until then. */
+
     if (desc->encrypted_data.single_onion_service) {
       TO_CIRCUIT(circ)->ccontrol = congestion_control_new(&circ_params,
                                                           CC_PATH_ONION_SOS);