diff --git a/g10/keygen.c b/g10/keygen.c
index 17fde7f4a..10cca7d8d 100644
--- a/g10/keygen.c
+++ b/g10/keygen.c
@@ -3839,6 +3839,7 @@ generate_subkeypair (KBNODE pub_keyblock, KBNODE sec_keyblock)
   if (!rc)
     rc = do_create (algo, nbits, pub_keyblock, sec_keyblock,
                     dek, s2k, &sub_sk, cur_time, expire, 1 );
+  xfree (dek);
   if (!rc)
     rc = write_keybinding (pub_keyblock, pub_keyblock, pri_sk, sub_sk,
                           use, cur_time);
@@ -3855,7 +3856,6 @@ generate_subkeypair (KBNODE pub_keyblock, KBNODE sec_keyblock)
   if (rc)
     log_error (_("Key generation failed: %s\n"), g10_errstr(rc) );
   xfree (passphrase);
-  xfree (dek);
   xfree (s2k);
   /* Release the copy of the (now unprotected) secret keys.  */
   if (pri_sk)