diff --git a/src/feature/hs/hs_descriptor.c b/src/feature/hs/hs_descriptor.c
index 0cabe50369..9c3d4fc96b 100644
--- a/src/feature/hs/hs_descriptor.c
+++ b/src/feature/hs/hs_descriptor.c
@@ -2833,18 +2833,22 @@ hs_desc_intro_point_free_(hs_desc_intro_point_t *ip)
   tor_free(ip);
 }
 
-/* Build a fake client info for the descriptor */
-void
-hs_desc_build_fake_authorized_client(hs_desc_authorized_client_t *client_out)
+/* Allocate and build a new fake client info for the descriptor. Return a
+ * newly allocated object. This can't fail. */
+hs_desc_authorized_client_t *
+hs_desc_build_fake_authorized_client(void)
 {
-  tor_assert(client_out);
+  hs_desc_authorized_client_t *client_auth =
+    tor_malloc_zero(sizeof(*client_auth));
 
-  crypto_rand((char *) client_out->client_id,
-              sizeof(client_out->client_id));
-  crypto_rand((char *) client_out->iv,
-              sizeof(client_out->iv));
-  crypto_rand((char *) client_out->encrypted_cookie,
-              sizeof(client_out->encrypted_cookie));
+  crypto_rand((char *) client_auth->client_id,
+              sizeof(client_auth->client_id));
+  crypto_rand((char *) client_auth->iv,
+              sizeof(client_auth->iv));
+  crypto_rand((char *) client_auth->encrypted_cookie,
+              sizeof(client_auth->encrypted_cookie));
+
+  return client_auth;
 }
 
 /* Using the client public key, auth ephemeral secret key, and descriptor
diff --git a/src/feature/hs/hs_descriptor.h b/src/feature/hs/hs_descriptor.h
index 8ce5fd6a11..9d447105f9 100644
--- a/src/feature/hs/hs_descriptor.h
+++ b/src/feature/hs/hs_descriptor.h
@@ -302,8 +302,7 @@ void hs_desc_authorized_client_free_(hs_desc_authorized_client_t *client);
 link_specifier_t *hs_desc_lspec_to_trunnel(
                                    const hs_desc_link_specifier_t *spec);
 
-void
-hs_desc_build_fake_authorized_client(hs_desc_authorized_client_t *client_out);
+hs_desc_authorized_client_t *hs_desc_build_fake_authorized_client(void);
 void hs_desc_build_authorized_client(const curve25519_public_key_t *
                                      client_auth_pk,
                                      const curve25519_secret_key_t *
diff --git a/src/feature/hs/hs_service.c b/src/feature/hs/hs_service.c
index 09329340c1..79ef0a35e9 100644
--- a/src/feature/hs/hs_service.c
+++ b/src/feature/hs/hs_service.c
@@ -1786,10 +1786,8 @@ build_service_desc_superencrypted(const hs_service_t *service,
   }
 
   for (i = 0; i < num_clients_to_add; i++) {
-    hs_desc_authorized_client_t *desc_client;
-    desc_client = tor_malloc_zero(sizeof(hs_desc_authorized_client_t));
-
-    hs_desc_build_fake_authorized_client(desc_client);
+    hs_desc_authorized_client_t *desc_client =
+      hs_desc_build_fake_authorized_client();
     smartlist_add(superencrypted->clients, desc_client);
   }
 
diff --git a/src/test/hs_test_helpers.c b/src/test/hs_test_helpers.c
index f8c582afc8..4e13ba43a7 100644
--- a/src/test/hs_test_helpers.c
+++ b/src/test/hs_test_helpers.c
@@ -138,10 +138,8 @@ hs_helper_build_hs_desc_impl(unsigned int no_ip,
 
   desc->superencrypted_data.clients = smartlist_new();
   for (i = 0; i < HS_DESC_AUTH_CLIENT_MULTIPLE; i++) {
-    hs_desc_authorized_client_t *desc_client;
-    desc_client = tor_malloc_zero(sizeof(hs_desc_authorized_client_t));
-
-    hs_desc_build_fake_authorized_client(desc_client);
+    hs_desc_authorized_client_t *desc_client =
+      hs_desc_build_fake_authorized_client();
     smartlist_add(desc->superencrypted_data.clients, desc_client);
   }
 
diff --git a/src/test/test_hs_descriptor.c b/src/test/test_hs_descriptor.c
index de977599a0..be7932cd2c 100644
--- a/src/test/test_hs_descriptor.c
+++ b/src/test/test_hs_descriptor.c
@@ -412,8 +412,7 @@ test_decode_descriptor(void *arg)
 
     /* We need to add fake auth clients here. */
     for (i=0; i < 15; ++i) {
-      fake_client = tor_malloc_zero(sizeof(hs_desc_authorized_client_t));
-      hs_desc_build_fake_authorized_client(fake_client);
+      fake_client = hs_desc_build_fake_authorized_client();
       smartlist_add(clients, fake_client);
     }
     desc->superencrypted_data.clients = clients;