diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 5ba6183599..85b687c0e4 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1202,9 +1202,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = dns_kasplist_find(kasplist, "default", &kasp);
 		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
 		dns_zone_setdefaultkasp(zone, kasp);
+		dns_kasp_detach(&kasp);
 
 		obj = NULL;
-		kasp = NULL;
 		result = named_config_get(maps, "dnssec-policy", &obj);
 		if (result == ISC_R_SUCCESS) {
 			kaspname = cfg_obj_asstring(obj);
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 18b7d187d7..271445e70c 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -5725,11 +5725,11 @@ dns_zone_setdefaultkasp(dns_zone_t *zone, dns_kasp_t *kasp) {
 
 	LOCK_ZONE(zone);
 	if (zone->defaultkasp != NULL) {
-		dns_kasp_t *oldkasp = zone->defaultkasp;
-		zone->defaultkasp = NULL;
-		dns_kasp_detach(&oldkasp);
+		dns_kasp_detach(&zone->defaultkasp);
+	}
+	if (kasp != NULL) {
+		dns_kasp_attach(kasp, &zone->defaultkasp);
 	}
-	zone->defaultkasp = kasp;
 	UNLOCK_ZONE(zone);
 }