diff --git a/lightningd/jsonrpc.c b/lightningd/jsonrpc.c
index 6bb3a2428..efd404e7d 100644
--- a/lightningd/jsonrpc.c
+++ b/lightningd/jsonrpc.c
@@ -25,14 +25,15 @@ struct json_output {
 	const char *json;
 };
 
-static void finish_jcon(struct io_conn *conn, struct json_connection *jcon)
+static void destroy_jcon(struct json_connection *jcon)
 {
 	log_debug(jcon->log, "Closing (%s)", strerror(errno));
 	if (jcon->current) {
 		log_unusual(jcon->log, "Abandoning current command");
 		jcon->current->jcon = NULL;
 	}
-	tal_free(jcon);
+	/* Make sure this happens last! */
+	tal_free(jcon->log);
 }
 
 static void json_help(struct command *cmd,
@@ -576,17 +577,18 @@ static struct io_plan *jcon_connected(struct io_conn *conn,
 {
 	struct json_connection *jcon;
 
-	jcon = tal(ld, struct json_connection);
+	jcon = tal(conn, struct json_connection);
 	jcon->ld = ld;
 	jcon->used = 0;
 	jcon->buffer = tal_arr(jcon, char, 64);
 	jcon->stop = false;
 	jcon->current = NULL;
-	jcon->log = new_log(jcon, ld->log_book, "%sjcon fd %i:",
+	/* We want to log on destruction, so we free this in destructor. */
+	jcon->log = new_log(ld->log_book, ld->log_book, "%sjcon fd %i:",
 			    log_prefix(ld->log), io_conn_fd(conn));
 	list_head_init(&jcon->output);
 
-	io_set_finish(conn, finish_jcon, jcon);
+	tal_add_destructor(jcon, destroy_jcon);
 
 	return io_duplex(conn,
 			 io_read_partial(conn, jcon->buffer,