diff --git a/libfreerdp/core/nla.c b/libfreerdp/core/nla.c
index 2e35af856..e3e189986 100644
--- a/libfreerdp/core/nla.c
+++ b/libfreerdp/core/nla.c
@@ -1853,6 +1853,8 @@ void nla_free(rdpNla* nla)
 	if (nla->table)
 	{
 		SECURITY_STATUS status;
+		status = nla->table->FreeCredentialsHandle(&nla->credentials);
+
 		status = nla->table->DeleteSecurityContext(&nla->context);
 
 		if (status != SEC_E_OK)
diff --git a/winpr/libwinpr/sspi/Negotiate/negotiate.c b/winpr/libwinpr/sspi/Negotiate/negotiate.c
index 54582080d..4829b8886 100644
--- a/winpr/libwinpr/sspi/Negotiate/negotiate.c
+++ b/winpr/libwinpr/sspi/Negotiate/negotiate.c
@@ -381,7 +381,7 @@ SECURITY_STATUS SEC_ENTRY negotiate_FreeCredentialsHandle(PCredHandle phCredenti
 		return SEC_E_INVALID_HANDLE;
 
 	sspi_CredentialsFree(credentials);
-
+	sspi_SecureHandleInvalidate(phCredential);
 	return SEC_E_OK;
 }
 
diff --git a/winpr/libwinpr/sspi/sspi_winpr.c b/winpr/libwinpr/sspi/sspi_winpr.c
index ec41f5632..3d731e3f5 100644
--- a/winpr/libwinpr/sspi/sspi_winpr.c
+++ b/winpr/libwinpr/sspi/sspi_winpr.c
@@ -304,6 +304,15 @@ void* sspi_SecureHandleGetLowerPointer(SecHandle* handle)
 	return pointer;
 }
 
+void sspi_SecureHandleInvalidate(SecHandle* handle)
+{
+	if (!handle)
+		return;
+
+	handle->dwLower = 0;
+	handle->dwUpper = 0;
+}
+
 void sspi_SecureHandleSetLowerPointer(SecHandle* handle, void* pointer)
 {
 	if (!handle)