diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c
index c506b1bfc28..13bea8d40a6 100644
--- a/source3/passdb/pdb_get_set.c
+++ b/source3/passdb/pdb_get_set.c
@@ -899,10 +899,9 @@ bool pdb_set_pw_history(struct samu *sampass, const uint8_t *pwd, uint32_t histo
 
 bool pdb_set_plaintext_pw_only(struct samu *sampass, const char *password, enum pdb_value_state flag)
 {
-	if (password) {
-		if (sampass->plaintext_pw!=NULL)
-			memset(sampass->plaintext_pw,'\0',strlen(sampass->plaintext_pw)+1);
+	BURN_STR(sampass->plaintext_pw);
 
+	if (password != NULL) {
 		sampass->plaintext_pw = talloc_strdup(sampass, password);
 
 		if (!sampass->plaintext_pw) {
diff --git a/source3/passdb/py_passdb.c b/source3/passdb/py_passdb.c
index f6fd50215f2..2d5b2ab5705 100644
--- a/source3/passdb/py_passdb.c
+++ b/source3/passdb/py_passdb.c
@@ -797,6 +797,8 @@ static PyObject *py_samu_get_plaintext_passwd(PyObject *obj, void *closure)
 	}
 
 	py_plaintext_pw = PyUnicode_FromString(plaintext_pw);
+
+	BURN_STR(discard_const_p(char, plaintext_pw));
 	talloc_free(frame);
 	return py_plaintext_pw;
 }