diff --git a/lib/isccfg/kaspconf.c b/lib/isccfg/kaspconf.c
index 58b0818fe4..09129e4298 100644
--- a/lib/isccfg/kaspconf.c
+++ b/lib/isccfg/kaspconf.c
@@ -852,6 +852,7 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
 						    "find keystore (%s)",
 						    isc_result_totext(result));
 				}
+				dns_kasp_key_destroy(new_key);
 				goto cleanup;
 			}
 			dns_kasp_addkey(kasp, new_key);
@@ -972,6 +973,7 @@ cfg_kasp_builtinconfig(isc_mem_t *mctx, const char *name,
 					       DNS_KEYSTORE_KEYDIRECTORY,
 					       &new_key->keystore);
 		if (result != ISC_R_SUCCESS) {
+			dns_kasp_key_destroy(new_key);
 			goto cleanup;
 		}
 		dns_kasp_addkey(kasp, new_key);