diff --git a/ChangeLog b/ChangeLog
index e7715dafb..049a1d861 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -8,6 +8,12 @@
      [sshkey.c]
      make Ed25519 keys' title fit properly in the randomart border; bz#2247
      based on patch from Christian Hesse
+   - djm@cvs.openbsd.org 2014/07/03 03:11:03
+     [ssh-agent.c]
+     Only cleanup agent socket in the main agent process and not in any
+     subprocesses it may have started (e.g. forked askpass). Fixes
+     agent sockets being zapped when askpass processes fatal();
+     bz#2236 patch from Dmitry V. Levin
 
 20140702
  - OpenBSD CVS Sync
diff --git a/ssh-agent.c b/ssh-agent.c
index 693d763e2..f7a021364 100644
--- a/ssh-agent.c
+++ b/ssh-agent.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: ssh-agent.c,v 1.186 2014/06/24 01:13:21 djm Exp $ */
+/* $OpenBSD: ssh-agent.c,v 1.187 2014/07/03 03:11:03 djm Exp $ */
 /*
  * Author: Tatu Ylonen <ylo@cs.hut.fi>
  * Copyright (c) 1995 Tatu Ylonen <ylo@cs.hut.fi>, Espoo, Finland
@@ -126,6 +126,9 @@ int max_fd = 0;
 pid_t parent_pid = -1;
 time_t parent_alive_interval = 0;
 
+/* pid of process for which cleanup_socket is applicable */
+pid_t cleanup_pid = 0;
+
 /* pathname and directory for AUTH_SOCKET */
 char socket_name[MAXPATHLEN];
 char socket_dir[MAXPATHLEN];
@@ -976,6 +979,9 @@ after_select(fd_set *readset, fd_set *writeset)
 static void
 cleanup_socket(void)
 {
+	if (cleanup_pid != 0 && getpid() != cleanup_pid)
+		return;
+	debug("%s: cleanup", __func__);
 	if (socket_name[0])
 		unlink(socket_name);
 	if (socket_dir[0])
@@ -1244,6 +1250,8 @@ main(int ac, char **av)
 
 skip:
 
+	cleanup_pid = getpid();
+
 #ifdef ENABLE_PKCS11
 	pkcs11_init(0);
 #endif