diff --git a/agent/divert-tpm2.c b/agent/divert-tpm2.c
index 6ebb9ef78..5779ee974 100644
--- a/agent/divert-tpm2.c
+++ b/agent/divert-tpm2.c
@@ -53,6 +53,7 @@ agent_write_tpm2_shadow_key (ctrl_t ctrl, const unsigned char *grip,
   if (err)
     {
       log_error ("failed to delete unshadowed key: %s\n", gpg_strerror (err));
+      xfree (shdkey);
       return err;
     }