diff --git a/changes/bug3804 b/changes/bug3804
index d498db85b8..7ad091c172 100644
--- a/changes/bug3804
+++ b/changes/bug3804
@@ -1,4 +1,9 @@
   o Major bugfixes (bufferevents):
     - Apply rate-limiting only at the bottom of a chain of filtering
-      bufferevents. This prevents us from filling up internal memory
-      buffers. Bugfix on 0.2.3.1-alpha; fixes bug 3804.
+      bufferevents. This prevents us from filling up internal read
+      buffers and violating rate-limits when filtering bufferevents
+      are enabled. Bugfix on 0.2.3.1-alpha; fixes part of bug 3804.
+    - Add high-watermarks to the output buffers for filtered
+      bufferevents. This prevents us from filling up internal write
+      buffers and wasting CPU cycles when filtering bufferevents are
+      enabled.  Bugfix on 0.2.3.1-alpha; fixes part of bug 3804.
diff --git a/src/common/tortls.c b/src/common/tortls.c
index 2aaa2c49b5..1bb9c74efa 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -51,6 +51,7 @@
 #ifdef USE_BUFFEREVENTS
 #include <event2/bufferevent_ssl.h>
 #include <event2/buffer.h>
+#include <event2/event.h>
 #include "compat_libevent.h"
 #endif
 
@@ -1905,6 +1906,10 @@ tor_tls_init_bufferevent(tor_tls_t *tls, struct bufferevent *bufev_in,
                                          state,
                                          BEV_OPT_DEFER_CALLBACKS|
                                          BEV_OPT_CLOSE_ON_FREE);
+    /* Tell the underlying bufferevent when to accept more data from the SSL
+       filter (only when it's got less than 32K to write), and when to notify
+       the SSL filter that it could write more (when it drops under 24K). */
+    bufferevent_setwatermark(bufev_in, EV_WRITE, 24*1024, 32*1024);
   } else {
     if (bufev_in) {
       evutil_socket_t s = bufferevent_getfd(bufev_in);