diff --git a/src/shared/pcrextend-util.c b/src/shared/pcrextend-util.c
index 158699a73d..afa1b88cf5 100644
--- a/src/shared/pcrextend-util.c
+++ b/src/shared/pcrextend-util.c
@@ -58,7 +58,8 @@ int pcrextend_pcr_now(unsigned pcr, const char *word, const struct iovec *secret
         if (iovec_is_set(secret))
                 sd_json_variant_sensitive(parameters);
 
-        _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+        /* Both the reply and the error id are borrowed from the connection, don't unref/free them. */
+        sd_json_variant *reply = NULL;
         const char *error_id = NULL;
         r = sd_varlink_call(vl, "io.systemd.PCRExtend.Extend", parameters, &reply, &error_id);
         if (r < 0)
@@ -91,7 +92,8 @@ int pcrextend_nvpcr_now(const char *nvpcr, const char *word, const char *event)
         if (r < 0)
                 return r;
 
-        _cleanup_(sd_json_variant_unrefp) sd_json_variant *reply = NULL;
+        /* Both the reply and the error id are borrowed from the connection, don't unref/free them. */
+        sd_json_variant *reply = NULL;
         const char *error_id = NULL;
         r = sd_varlink_callbo(
                         vl,
diff --git a/src/shared/pkcs7-util.c b/src/shared/pkcs7-util.c
index 4d22d90421..36a46cf9ab 100644
--- a/src/shared/pkcs7-util.c
+++ b/src/shared/pkcs7-util.c
@@ -2,6 +2,7 @@
 
 #include "alloc-util.h"
 #include "crypto-util.h"
+#include "iovec-util.h"
 #include "pkcs7-util.h"
 #include "log.h"
 
@@ -72,13 +73,19 @@ int pkcs7_extract_signers(
                         return log_debug_errno(SYNTHETIC_ERRNO(ENOTRECOVERABLE), "Failed to get signer information.");
 
                 _cleanup_(signer_done) Signer signer = {};
+                _cleanup_(OPENSSL_freep) void *issuer = NULL, *serial = NULL;
 
-                _cleanup_free_ unsigned char *p = NULL;
-                int len = sym_i2d_X509_NAME(si->issuer_and_serial->issuer, &p);
-                signer.issuer = IOVEC_MAKE(TAKE_PTR(p), len);
+                int len = sym_i2d_X509_NAME(si->issuer_and_serial->issuer, (unsigned char**) &issuer);
+                if (len < 0)
+                        return log_openssl_errors(LOG_DEBUG, "Failed to convert issuer name to DER format");
+                if (!iovec_memdup(&IOVEC_MAKE(issuer, len), &signer.issuer))
+                        return log_oom_debug();
 
-                len = sym_i2d_ASN1_INTEGER(si->issuer_and_serial->serial, &p);
-                signer.serial = IOVEC_MAKE(TAKE_PTR(p), len);
+                len = sym_i2d_ASN1_INTEGER(si->issuer_and_serial->serial, (unsigned char**) &serial);
+                if (len < 0)
+                        return log_openssl_errors(LOG_DEBUG, "Failed to convert serial number to DER format");
+                if (!iovec_memdup(&IOVEC_MAKE(serial, len), &signer.serial))
+                        return log_oom_debug();
 
                 signers[n_signers++] = TAKE_STRUCT(signer);
         }