diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
index fe20fe4e2a3..c4339272fb6 100644
--- a/libcli/auth/smbencrypt.c
+++ b/libcli/auth/smbencrypt.c
@@ -937,6 +937,7 @@ bool decode_pw_buffer(TALLOC_CTX *ctx,
 		DEBUG(0, ("decode_pw_buffer: failed to convert incoming password\n"));
 		return false;
 	}
+	talloc_keep_secret(*pp_new_pwrd);
 
 #ifdef DEBUG_PASSWORD
 	DEBUG(100,("decode_pw_buffer: new_pwrd: "));