diff --git a/src/or/rendclient.c b/src/or/rendclient.c
index 566e6d945e..86f9b34faf 100644
--- a/src/or/rendclient.c
+++ b/src/or/rendclient.c
@@ -204,6 +204,9 @@ rend_client_receive_rendezvous(circuit_t *circ, const char *request, int request
     goto err;
   }
 
+  crypto_dh_free(hop->handshake_state);
+  hop->handshake_state = NULL;
+
   /* All is well. Extend the circuit. */
   circ->purpose = CIRCUIT_PURPOSE_C_REND_JOINED;
   hop->state = CPATH_STATE_OPEN;
diff --git a/src/or/rendservice.c b/src/or/rendservice.c
index c4dcd0979c..4325ec9e7a 100644
--- a/src/or/rendservice.c
+++ b/src/or/rendservice.c
@@ -588,6 +588,9 @@ rend_service_rendezvous_is_ready(circuit_t *circuit)
     goto err;
   }
 
+  crypto_dh_free(hop->handshake_state);
+  hop->handshake_state = NULL;
+
   /* Append the cpath entry. */
   hop->state = CPATH_STATE_OPEN;
   onion_append_to_cpath(&circuit->cpath, hop);