diff --git a/dlls/secur32/dispatcher.c b/dlls/secur32/dispatcher.c
index 5e26d41456f..d9dfeef9b5c 100644
--- a/dlls/secur32/dispatcher.c
+++ b/dlls/secur32/dispatcher.c
@@ -264,7 +264,6 @@ void cleanup_helper(PNegoHelper helper)
       
     HeapFree(GetProcessHeap(), 0, helper->password);
     HeapFree(GetProcessHeap(), 0, helper->com_buf);
-    HeapFree(GetProcessHeap(), 0, helper->session_key);
 
     /* closing stdin will terminate ntlm_auth */
     close(helper->pipe_out);
diff --git a/dlls/secur32/ntlm.c b/dlls/secur32/ntlm.c
index fb9495b9c82..1b0bd8c3443 100644
--- a/dlls/secur32/ntlm.c
+++ b/dlls/secur32/ntlm.c
@@ -1240,6 +1240,7 @@ static SECURITY_STATUS SEC_ENTRY ntlm_FreeCredentialsHandle(
         PNegoHelper helper = (PNegoHelper) phCredential->dwLower;
         phCredential->dwUpper = 0;
         phCredential->dwLower = 0;
+        HeapFree(GetProcessHeap(), 0, helper->session_key);
         cleanup_helper(helper);
         ret = SEC_E_OK;
     }