diff --git a/lightningd/htlc_end.c b/lightningd/htlc_end.c
index 7ce344eca..c6d17709b 100644
--- a/lightningd/htlc_end.c
+++ b/lightningd/htlc_end.c
@@ -153,7 +153,7 @@ struct htlc_out *new_htlc_out(const tal_t *ctx,
 	hout->msatoshi = msatoshi;
 	hout->cltv_expiry = cltv_expiry;
 	hout->payment_hash = *payment_hash;
-	hout->payment = payment;
+	hout->payment = tal_steal(hout, payment);
 	memcpy(hout->onion_routing_packet, onion_routing_packet,
 	       sizeof(hout->onion_routing_packet));
 
diff --git a/lightningd/htlc_end.h b/lightningd/htlc_end.h
index 176673788..9e41375df 100644
--- a/lightningd/htlc_end.h
+++ b/lightningd/htlc_end.h
@@ -127,7 +127,7 @@ struct htlc_in *new_htlc_in(const tal_t *ctx,
 			    const struct secret *shared_secret,
 			    const u8 *onion_routing_packet);
 
-/* You need to set the ID, then connect_htlc_out this! */
+/* You need to set the ID, then connect_htlc_out this!  Steals @payment. */
 struct htlc_out *new_htlc_out(const tal_t *ctx,
 			      struct peer *peer,
 			      u64 msatoshi, u32 cltv_expiry,
diff --git a/lightningd/pay.c b/lightningd/pay.c
index 6a47d6f50..6c79005b1 100644
--- a/lightningd/pay.c
+++ b/lightningd/pay.c
@@ -157,9 +157,11 @@ static bool send_payment(struct command *cmd,
 	struct onionpacket *packet;
 	struct secret *path_secrets;
 	enum onion_type failcode;
+	/* Freed automatically on cmd completion: only manually at end. */
+	const tal_t *tmpctx = tal_tmpctx(cmd);
 	size_t i, n_hops = tal_count(route);
-	struct hop_data *hop_data = tal_arr(cmd, struct hop_data, n_hops);
-	struct pubkey *ids = tal_arr(cmd, struct pubkey, n_hops);
+	struct hop_data *hop_data = tal_arr(tmpctx, struct hop_data, n_hops);
+	struct pubkey *ids = tal_arr(tmpctx, struct pubkey, n_hops);
 	struct wallet_payment *payment = NULL;
 
 	/* Expiry for HTLCs is absolute.  And add one to give some margin. */
@@ -239,7 +241,7 @@ static bool send_payment(struct command *cmd,
 		list_add_tail(&cmd->ld->pay_commands, &pc->list);
 		tal_add_destructor(pc, pay_command_destroyed);
 
-		payment = tal(pc, struct wallet_payment);
+		payment = tal(tmpctx, struct wallet_payment);
 		payment->id = 0;
 		payment->incoming = false;
 		payment->payment_hash = *rhash;
@@ -276,6 +278,7 @@ static bool send_payment(struct command *cmd,
 			     onion_type_name(failcode));
 		return false;
 	}
+	tal_free(tmpctx);
 	return true;
 }