diff --git a/src/action.c b/src/action.c
index ba465a2532..1de97692ee 100644
--- a/src/action.c
+++ b/src/action.c
@@ -39,8 +39,7 @@ int check_action_rules(struct list *rules, struct proxy *px, int *err_code)
 			err++;
 		}
 		*err_code |= warnif_tcp_http_cond(px, rule->cond);
-		free(errmsg);
-		errmsg = NULL;
+		ha_free(&errmsg);
 	}
 
 	return err;
diff --git a/src/server.c b/src/server.c
index a0206021dd..a8e85a982e 100644
--- a/src/server.c
+++ b/src/server.c
@@ -2380,8 +2380,7 @@ struct server *srv_drop(struct server *srv)
 
 	EXTRA_COUNTERS_FREE(srv->extra_counters);
 
-	free(srv);
-	srv = NULL;
+	ha_free(&srv);
 
  end:
 	return next;
diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 2378ee349f..eeb031b27e 100644
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -2506,8 +2506,7 @@ static int cli_parse_set_cafile(char **args, char *payload, struct appctx *appct
 		appctx->ctx.ssl.new_cafile_entry = NULL;
 		appctx->ctx.ssl.old_cafile_entry = NULL;
 
-		free(appctx->ctx.ssl.path);
-		appctx->ctx.ssl.path = NULL;
+		ha_free(&appctx->ctx.ssl.path);
 
 		HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
 		return cli_dynerr(appctx, memprintf(&err, "%sCan't update %s!\n", err ? err : "", args[3]));
@@ -3225,8 +3224,7 @@ static int cli_parse_set_crlfile(char **args, char *payload, struct appctx *appc
 		appctx->ctx.ssl.new_crlfile_entry = NULL;
 		appctx->ctx.ssl.old_crlfile_entry = NULL;
 
-		free(appctx->ctx.ssl.path);
-		appctx->ctx.ssl.path = NULL;
+		ha_free(&appctx->ctx.ssl.path);
 
 		HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
 		return cli_dynerr(appctx, memprintf(&err, "%sCan't update %s!\n", err ? err : "", args[3]));