diff --git a/quiche/quic/core/crypto/tls_server_connection.cc b/quiche/quic/core/crypto/tls_server_connection.cc
index 2b7ddc7..80a3aa7 100644
--- a/quiche/quic/core/crypto/tls_server_connection.cc
+++ b/quiche/quic/core/crypto/tls_server_connection.cc
@@ -78,28 +78,28 @@
     const std::string& trust_anchor_id) {
   if (GetQuicReloadableFlag(enable_tls_trust_anchor_ids)) {
     QUIC_RELOADABLE_FLAG_COUNT_N(enable_tls_trust_anchor_ids, 1, 2);
-    SSL_CREDENTIAL* credential = SSL_CREDENTIAL_new_x509();
-    SSL_CREDENTIAL_set1_cert_chain(credential, cert_chain.data(),
+    bssl::UniquePtr<SSL_CREDENTIAL> credential(SSL_CREDENTIAL_new_x509());
+    SSL_CREDENTIAL_set1_cert_chain(credential.get(), cert_chain.data(),
                                    cert_chain.size());
     if (ssl_config().signing_algorithm_prefs.has_value()) {
       SSL_CREDENTIAL_set1_signing_algorithm_prefs(
-          credential, ssl_config().signing_algorithm_prefs->data(),
+          credential.get(), ssl_config().signing_algorithm_prefs->data(),
           ssl_config().signing_algorithm_prefs->size());
     }
     SSL_CREDENTIAL_set_private_key_method(
-        credential, &TlsServerConnection::kPrivateKeyMethod);
+        credential.get(), &TlsServerConnection::kPrivateKeyMethod);
 #if defined(BORINGSSL_API_VERSION) && BORINGSSL_API_VERSION >= 36
     if (!trust_anchor_id.empty()) {
       SSL_CREDENTIAL_set1_trust_anchor_id(
-          credential, reinterpret_cast<const uint8_t*>(trust_anchor_id.data()),
+          credential.get(),
+          reinterpret_cast<const uint8_t*>(trust_anchor_id.data()),
           trust_anchor_id.size());
-      SSL_CREDENTIAL_set_must_match_issuer(credential, 1);
+      SSL_CREDENTIAL_set_must_match_issuer(credential.get(), 1);
     }
 #else
     (void)trust_anchor_id;  // Suppress unused parameter error.
 #endif
-    SSL_add1_credential(ssl(), credential);
-    SSL_CREDENTIAL_free(credential);
+    SSL_add1_credential(ssl(), credential.get());
   } else {
     SSL_set_chain_and_key(ssl(), cert_chain.data(), cert_chain.size(), nullptr,
                           &TlsServerConnection::kPrivateKeyMethod);