diff --git a/servers/lloadd/bind.c b/servers/lloadd/bind.c
index 6f93e03784..071a243e53 100644
--- a/servers/lloadd/bind.c
+++ b/servers/lloadd/bind.c
@@ -126,7 +126,7 @@ request_bind( LloadConnection *client, LloadOperation *op )
 {
     LloadConnection *upstream = NULL;
     BerElement *ber, *copy;
-    struct berval binddn, auth;
+    struct berval binddn, auth, mech = BER_BVNULL;
     ber_int_t version;
     ber_tag_t tag;
     unsigned long pin = client->c_pin_id;
@@ -226,8 +226,6 @@ request_bind( LloadConnection *client, LloadOperation *op )
             BER_BVZERO( &client->c_sasl_bind_mech );
         }
     } else if ( tag == LDAP_AUTH_SASL ) {
-        struct berval mech;
-
         ber_init2( copy, &auth, 0 );
 
         if ( ber_get_stringbv( copy, &mech, LBER_BV_NOTERM ) == LBER_ERROR ) {
@@ -310,6 +308,10 @@ request_bind( LloadConnection *client, LloadOperation *op )
                 "ber_alloc failed\n" );
         ldap_pvt_thread_mutex_unlock( &upstream->c_io_mutex );
         CONNECTION_LOCK_DECREF(upstream);
+        if ( !BER_BVISNULL( &upstream->c_sasl_bind_mech ) ) {
+            ber_memfree( upstream->c_sasl_bind_mech.bv_val );
+            BER_BVZERO( &upstream->c_sasl_bind_mech );
+        }
         CONNECTION_UNLOCK_OR_DESTROY(upstream);
 
         CONNECTION_LOCK_DECREF(client);
@@ -334,6 +336,15 @@ request_bind( LloadConnection *client, LloadOperation *op )
     op->o_upstream_connid = upstream->c_connid;
     op->o_upstream_msgid = upstream->c_next_msgid++;
 
+    if ( BER_BVISNULL( &mech ) ) {
+        if ( !BER_BVISNULL( &upstream->c_sasl_bind_mech ) ) {
+            ber_memfree( upstream->c_sasl_bind_mech.bv_val );
+            BER_BVZERO( &upstream->c_sasl_bind_mech );
+        }
+    } else if ( ber_bvcmp( &upstream->c_sasl_bind_mech, &mech ) ) {
+        ber_bvreplace( &upstream->c_sasl_bind_mech, &mech );
+    }
+
     Debug( LDAP_DEBUG_TRACE, "request_bind: "
             "added bind from client connid=%lu to upstream connid=%lu "
             "as msgid=%d\n",
@@ -440,6 +451,11 @@ handle_bind_response(
 
     CONNECTION_LOCK(upstream);
     if ( result != LDAP_SASL_BIND_IN_PROGRESS ) {
+        if ( !BER_BVISNULL( &upstream->c_sasl_bind_mech ) ) {
+            ber_memfree( upstream->c_sasl_bind_mech.bv_val );
+            BER_BVZERO( &upstream->c_sasl_bind_mech );
+        }
+
         upstream->c_state = LLOAD_C_READY;
         op->o_pin_id = 0;
     } else {
diff --git a/servers/lloadd/connection.c b/servers/lloadd/connection.c
index 5620b91d51..2740409cb1 100644
--- a/servers/lloadd/connection.c
+++ b/servers/lloadd/connection.c
@@ -318,6 +318,11 @@ connection_destroy( LloadConnection *c )
         c->c_pendingber = NULL;
     }
 
+    if ( !BER_BVISNULL( &c->c_sasl_bind_mech ) ) {
+        ber_memfree( c->c_sasl_bind_mech.bv_val );
+        BER_BVZERO( &c->c_sasl_bind_mech );
+    }
+
     CONNECTION_UNLOCK(c);
 
     ldap_pvt_thread_mutex_destroy( &c->c_io_mutex );
diff --git a/servers/lloadd/operation.c b/servers/lloadd/operation.c
index c232c408bc..21ebbf1742 100644
--- a/servers/lloadd/operation.c
+++ b/servers/lloadd/operation.c
@@ -607,6 +607,10 @@ operation_abandon( LloadOperation *op )
     }
     if ( c->c_state == LLOAD_C_BINDING ) {
         c->c_state = LLOAD_C_READY;
+        if ( !BER_BVISNULL( &c->c_sasl_bind_mech ) ) {
+            ber_memfree( c->c_sasl_bind_mech.bv_val );
+            BER_BVZERO( &c->c_sasl_bind_mech );
+        }
     }
     c->c_n_ops_executing--;
     b = (LloadBackend *)c->c_private;
diff --git a/servers/lloadd/upstream.c b/servers/lloadd/upstream.c
index 4cb46b71b4..cf54dced1e 100644
--- a/servers/lloadd/upstream.c
+++ b/servers/lloadd/upstream.c
@@ -243,6 +243,10 @@ handle_one_response( LloadConnection *c )
         if ( !client || !op->o_upstream_refcnt ) {
             if ( c->c_state == LLOAD_C_BINDING ) {
                 c->c_state = LLOAD_C_READY;
+                if ( !BER_BVISNULL( &c->c_sasl_bind_mech ) ) {
+                    ber_memfree( c->c_sasl_bind_mech.bv_val );
+                    BER_BVZERO( &c->c_sasl_bind_mech );
+                }
             }
             operation_destroy_from_upstream( op );
         }