diff --git a/doc/Changelog b/doc/Changelog
index bdf5be627..89eeea9ef 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -2,6 +2,7 @@
 	- configure detects ssl security level API function in the autoconf
 	  manner.  Every function on its own, so that other libraries (eg.
 	  LibreSSL) can develop their API without hindrance.
+	- Fix #1154: segfault when reading config with duplicate zones.
 
 3 November 2016: Ralph
 	- Set OpenSSL security level to 0 when using aNULL ciphers.
diff --git a/services/localzone.c b/services/localzone.c
index 7d73f3766..8b12b663c 100644
--- a/services/localzone.c
+++ b/services/localzone.c
@@ -186,13 +186,17 @@ lz_enter_zone_dname(struct local_zones* zones, uint8_t* nm, size_t len,
 	lock_rw_wrlock(&zones->lock);
 	lock_rw_wrlock(&z->lock);
 	if(!rbtree_insert(&zones->ztree, &z->node)) {
+		struct local_zone* oldz;
 		log_warn("duplicate local-zone");
 		lock_rw_unlock(&z->lock);
-		local_zone_delete(z);
+		/* save zone name locally before deallocation,
+		 * otherwise, nm is gone if we zone_delete now. */
+		oldz = z;
 		/* find the correct zone, so not an error for duplicate */
 		z = local_zones_find(zones, nm, len, labs, c);
 		lock_rw_wrlock(&z->lock);
 		lock_rw_unlock(&zones->lock);
+		local_zone_delete(oldz);
 		return z;
 	}
 	lock_rw_unlock(&zones->lock);