diff --git a/lib/ldb/ABI/ldb-2.8.0.sigs b/lib/ldb/ABI/ldb-2.8.0.sigs
index f1ba036c0a1..b450b0c8191 100644
--- a/lib/ldb/ABI/ldb-2.8.0.sigs
+++ b/lib/ldb/ABI/ldb-2.8.0.sigs
@@ -197,6 +197,7 @@ ldb_msg_remove_element: void (struct ldb_message *, struct ldb_message_element *
 ldb_msg_remove_inaccessible: void (struct ldb_message *)
 ldb_msg_rename_attr: int (struct ldb_message *, const char *, const char *)
 ldb_msg_sanity_check: int (struct ldb_context *, const struct ldb_message *)
+ldb_msg_shrink_to_fit: void (struct ldb_message *)
 ldb_msg_sort_elements: void (struct ldb_message *)
 ldb_next_del_trans: int (struct ldb_module *)
 ldb_next_end_trans: int (struct ldb_module *)
diff --git a/lib/ldb/common/ldb_msg.c b/lib/ldb/common/ldb_msg.c
index 3f4f5ac90f1..a308b32ed42 100644
--- a/lib/ldb/common/ldb_msg.c
+++ b/lib/ldb/common/ldb_msg.c
@@ -1537,6 +1537,22 @@ void ldb_msg_remove_attr(struct ldb_message *msg, const char *attr)
 	msg->num_elements -= num_del;
 }
 
+/* Reallocate elements to drop any excess capacity. */
+void ldb_msg_shrink_to_fit(struct ldb_message *msg)
+{
+	if (msg->num_elements > 0) {
+		struct ldb_message_element *elements = talloc_realloc(msg,
+								      msg->elements,
+								      struct ldb_message_element,
+								      msg->num_elements);
+		if (elements != NULL) {
+			msg->elements = elements;
+		}
+	} else {
+		TALLOC_FREE(msg->elements);
+	}
+}
+
 /*
   return a LDAP formatted GeneralizedTime string
 */
diff --git a/lib/ldb/include/ldb_private.h b/lib/ldb/include/ldb_private.h
index 7d9a47c8ef3..f6f47c28cf3 100644
--- a/lib/ldb/include/ldb_private.h
+++ b/lib/ldb/include/ldb_private.h
@@ -317,6 +317,9 @@ int ldb_match_message(struct ldb_context *ldb,
 		      const struct ldb_parse_tree *tree,
 		      enum ldb_scope scope, bool *matched);
 
+/* Reallocate elements to drop any excess capacity. */
+void ldb_msg_shrink_to_fit(struct ldb_message *msg);
+
 /**
  * @brief Convert a character to uppercase with ASCII precedence.
  *