diff --git a/bin/dnssec/dnssec-ksr.c b/bin/dnssec/dnssec-ksr.c
index b94be54a10..bbb0f19a41 100644
--- a/bin/dnssec/dnssec-ksr.c
+++ b/bin/dnssec/dnssec-ksr.c
@@ -424,6 +424,7 @@ keygen(ksr_ctx_t *ksr) {
 	while (!ISC_LIST_EMPTY(keys)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys);
 		ISC_LIST_UNLINK(keys, key, link);
+		dst_key_free(&key->key);
 		dns_dnsseckey_destroy(mctx, &key);
 	}
 	dns_kasp_detach(&kasp);