diff --git a/connections/implementation/client_proxy.cc b/connections/implementation/client_proxy.cc
index e275b7a4..c3a2e6fe 100644
--- a/connections/implementation/client_proxy.cc
+++ b/connections/implementation/client_proxy.cc
@@ -26,6 +26,7 @@
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/container/flat_hash_set.h"
+#include "absl/functional/any_invocable.h"
 #include "absl/strings/escaping.h"
 #include "absl/strings/str_format.h"
 #include "connections/v3/bandwidth_info.h"
@@ -554,7 +555,7 @@ bool ClientProxy::IsConnectedToEndpoint(const std::string& endpoint_id) const {
 }
 
 std::vector<std::string> ClientProxy::GetMatchingEndpoints(
-    std::function<bool(const Connection&)> pred) const {
+    absl::AnyInvocable<bool(const Connection&)> pred) const {
   MutexLock lock(&mutex_);
 
   std::vector<std::string> connected_endpoints;
diff --git a/connections/implementation/client_proxy.h b/connections/implementation/client_proxy.h
index b7c97ed2..f19190e4 100644
--- a/connections/implementation/client_proxy.h
+++ b/connections/implementation/client_proxy.h
@@ -16,13 +16,13 @@
 #define CORE_INTERNAL_CLIENT_PROXY_H_
 
 #include <cstdint>
-#include <functional>
 #include <memory>
 #include <optional>
 #include <string>
 #include <utility>
 #include <vector>
 
+#include "absl/functional/any_invocable.h"
 #include "connections/advertising_options.h"
 #include "connections/discovery_options.h"
 #include "connections/implementation/analytics/analytics_recorder.h"
@@ -338,7 +338,7 @@ class ClientProxy final {
   bool ConnectionStatusMatches(const std::string& endpoint_id,
                                Connection::Status status) const;
   std::vector<std::string> GetMatchingEndpoints(
-      std::function<bool(const Connection&)> pred) const;
+      absl::AnyInvocable<bool(const Connection&)> pred) const;
   std::string GenerateLocalEndpointId();
 
   void ScheduleClearLocalHighVisModeCacheEndpointIdAlarm();
diff --git a/connections/implementation/encryption_runner.cc b/connections/implementation/encryption_runner.cc
index b424b5ab..43146980 100644
--- a/connections/implementation/encryption_runner.cc
+++ b/connections/implementation/encryption_runner.cc
@@ -17,15 +17,19 @@
 #include <cinttypes>
 #include <cstdint>
 #include <memory>
+#include <string>
+#include <utility>
 
 #include "securegcm/ukey2_handshake.h"
 #include "absl/strings/ascii.h"
 #include "absl/time/clock.h"
 #include "absl/time/time.h"
+#include "connections/implementation/client_proxy.h"
+#include "connections/implementation/endpoint_channel.h"
 #include "internal/platform/base64_utils.h"
 #include "internal/platform/byte_array.h"
-#include "internal/platform/exception.h"
 #include "internal/platform/cancelable_alarm.h"
+#include "internal/platform/exception.h"
 #include "internal/platform/logging.h"
 
 namespace nearby {
@@ -49,7 +53,7 @@ std::string ToHumanReadableString(const ByteArray& token) {
 
 bool HandleEncryptionSuccess(const std::string& endpoint_id,
                              std::unique_ptr<securegcm::UKey2Handshake> ukey2,
-                             const EncryptionRunner::ResultListener& listener) {
+                             EncryptionRunner::ResultListener& listener) {
   std::unique_ptr<std::string> verification_string =
       ukey2->GetVerificationString(kMaxUkey2VerificationStringLength);
   if (verification_string == nullptr) {
@@ -58,9 +62,9 @@ bool HandleEncryptionSuccess(const std::string& endpoint_id,
 
   ByteArray raw_authentication_token(*verification_string);
 
-  listener.on_success_cb(endpoint_id, std::move(ukey2),
-                         ToHumanReadableString(raw_authentication_token),
-                         raw_authentication_token);
+  listener.CallSuccessCallback(endpoint_id, std::move(ukey2),
+                               ToHumanReadableString(raw_authentication_token),
+                               raw_authentication_token);
 
   return true;
 }
@@ -79,14 +83,14 @@ class ServerRunnable final {
  public:
   ServerRunnable(ClientProxy* client, ScheduledExecutor* alarm_executor,
                  const std::string& endpoint_id, EndpointChannel* channel,
-                 EncryptionRunner::ResultListener&& listener)
+                 EncryptionRunner::ResultListener listener)
       : client_(client),
         alarm_executor_(alarm_executor),
         endpoint_id_(endpoint_id),
         channel_(channel),
         listener_(std::move(listener)) {}
 
-  void operator()() const {
+  void operator()() {
     CancelableAlarm timeout_alarm(
         "EncryptionRunner.StartServer() timeout",
         [this]() { CancelableAlarmRunnable(client_, endpoint_id_, channel_); },
@@ -189,9 +193,9 @@ class ServerRunnable final {
                        << endpoint_id_ << ").";
   }
 
-  void HandleHandshakeOrIoException(CancelableAlarm* timeout_alarm) const {
+  void HandleHandshakeOrIoException(CancelableAlarm* timeout_alarm) {
     timeout_alarm->Cancel();
-    listener_.on_failure_cb(endpoint_id_, channel_);
+    listener_.CallFailureCallback(endpoint_id_, channel_);
   }
 
   void HandleAlertException(
@@ -217,14 +221,14 @@ class ClientRunnable final {
  public:
   ClientRunnable(ClientProxy* client, ScheduledExecutor* alarm_executor,
                  const std::string& endpoint_id, EndpointChannel* channel,
-                 EncryptionRunner::ResultListener&& listener)
+                 EncryptionRunner::ResultListener listener)
       : client_(client),
         alarm_executor_(alarm_executor),
         endpoint_id_(endpoint_id),
         channel_(channel),
         listener_(std::move(listener)) {}
 
-  void operator()() const {
+  void operator()() {
     CancelableAlarm timeout_alarm(
         "EncryptionRunner.StartClient() timeout",
         [this]() { CancelableAlarmRunnable(client_, endpoint_id_, channel_); },
@@ -326,9 +330,9 @@ class ClientRunnable final {
                        << endpoint_id_ << ").";
   }
 
-  void HandleHandshakeOrIoException(CancelableAlarm* timeout_alarm) const {
+  void HandleHandshakeOrIoException(CancelableAlarm* timeout_alarm) {
     timeout_alarm->Cancel();
-    listener_.on_failure_cb(endpoint_id_, channel_);
+    listener_.CallFailureCallback(endpoint_id_, channel_);
   }
 
   void HandleAlertException(
@@ -359,28 +363,46 @@ EncryptionRunner::~EncryptionRunner() {
   alarm_executor_.Shutdown();
 }
 
-void EncryptionRunner::StartServer(
-    ClientProxy* client, const std::string& endpoint_id,
-    EndpointChannel* endpoint_channel,
-    EncryptionRunner::ResultListener&& listener) {
-  server_executor_.Execute(
-      "encryption-server",
-      [runnable{ServerRunnable(client, &alarm_executor_, endpoint_id,
-                               endpoint_channel, std::move(listener))}]() {
-        runnable();
-      });
+void EncryptionRunner::StartServer(ClientProxy* client,
+                                   const std::string& endpoint_id,
+                                   EndpointChannel* endpoint_channel,
+                                   EncryptionRunner::ResultListener listener) {
+  ServerRunnable runnable(client, &alarm_executor_, endpoint_id,
+                          endpoint_channel, std::move(listener));
+  server_executor_.Execute("encryption-server", std::move(runnable));
 }
 
-void EncryptionRunner::StartClient(
-    ClientProxy* client, const std::string& endpoint_id,
-    EndpointChannel* endpoint_channel,
-    EncryptionRunner::ResultListener&& listener) {
-  client_executor_.Execute(
-      "encryption-client",
-      [runnable{ClientRunnable(client, &alarm_executor_, endpoint_id,
-                               endpoint_channel, std::move(listener))}]() {
-        runnable();
-      });
+void EncryptionRunner::StartClient(ClientProxy* client,
+                                   const std::string& endpoint_id,
+                                   EndpointChannel* endpoint_channel,
+                                   EncryptionRunner::ResultListener listener) {
+  ClientRunnable runnable(client, &alarm_executor_, endpoint_id,
+                          endpoint_channel, std::move(listener));
+  client_executor_.Execute("encryption-client", std::move(runnable));
+}
+
+void EncryptionRunner::ResultListener::CallSuccessCallback(
+    const std::string& endpoint_id,
+    std::unique_ptr<securegcm::UKey2Handshake> ukey2,
+    const std::string& auth_token, const ByteArray& raw_auth_token) {
+  if (on_success_cb) {
+    std::move(on_success_cb)(endpoint_id, std::move(ukey2), auth_token,
+                             raw_auth_token);
+  }
+  Reset();
+}
+
+void EncryptionRunner::ResultListener::CallFailureCallback(
+    const std::string& endpoint_id, EndpointChannel* channel) {
+  if (on_failure_cb) {
+    std::move(on_failure_cb)(endpoint_id, channel);
+  }
+  Reset();
+}
+
+void EncryptionRunner::ResultListener::Reset() {
+  on_success_cb = nullptr;
+  on_failure_cb = nullptr;
 }
 
 }  // namespace connections
diff --git a/connections/implementation/encryption_runner.h b/connections/implementation/encryption_runner.h
index a8bb367d..7c2b401f 100644
--- a/connections/implementation/encryption_runner.h
+++ b/connections/implementation/encryption_runner.h
@@ -18,6 +18,7 @@
 #include <string>
 
 #include "securegcm/ukey2_handshake.h"
+#include "absl/functional/any_invocable.h"
 #include "connections/implementation/client_proxy.h"
 #include "connections/implementation/endpoint_channel.h"
 #include "connections/listeners.h"
@@ -39,14 +40,20 @@ class EncryptionRunner {
   ~EncryptionRunner();
 
   struct ResultListener {
+    void CallSuccessCallback(const std::string& endpoint_id,
+                             std::unique_ptr<securegcm::UKey2Handshake> ukey2,
+                             const std::string& auth_token,
+                             const ByteArray& raw_auth_token);
+    void CallFailureCallback(const std::string& endpoint_id,
+                             EndpointChannel* channel);
+    void Reset();
+
     // @EncryptionRunnerThread
-    std::function<void(const std::string& endpoint_id,
-                       std::unique_ptr<securegcm::UKey2Handshake> ukey2,
-                       const std::string& auth_token,
-                       const ByteArray& raw_auth_token)>
-        on_success_cb = [](const std::string&,
-                           std::unique_ptr<securegcm::UKey2Handshake>,
-                           const std::string&, const ByteArray&) {};
+    absl::AnyInvocable<void(const std::string& endpoint_id,
+                            std::unique_ptr<securegcm::UKey2Handshake> ukey2,
+                            const std::string& auth_token,
+                            const ByteArray& raw_auth_token) &&>
+        on_success_cb;
 
     // Encryption has failed. The remote_endpoint_id and channel are given so
     // that any pending state can be cleaned up.
@@ -57,19 +64,19 @@ class EncryptionRunner {
     // channel to the same endpoint.
     //
     // @EncryptionRunnerThread
-    std::function<void(const std::string& endpoint_id,
-                       EndpointChannel* channel)>
-        on_failure_cb = [](const std::string&, EndpointChannel*) {};
+    absl::AnyInvocable<void(const std::string& endpoint_id,
+                            EndpointChannel* channel) &&>
+        on_failure_cb;
   };
 
   // @AnyThread
   void StartServer(ClientProxy* client, const std::string& endpoint_id,
                    EndpointChannel* endpoint_channel,
-                   ResultListener&& result_listener);
+                   ResultListener result_listener);
   // @AnyThread
   void StartClient(ClientProxy* client, const std::string& endpoint_id,
                    EndpointChannel* endpoint_channel,
-                   ResultListener&& result_listener);
+                   ResultListener result_listener);
 
  private:
   ScheduledExecutor alarm_executor_;