diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index 1a7f7dd0c7..b7fc15fbc8 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -759,6 +759,10 @@ doshutdown(void) {
 
 static void
 maybeshutdown(void) {
+	/* when called from getinput, doshutdown might be already finished */
+	if (requestmgr == NULL)
+		return;
+
 	ddebug("Shutting down request manager");
 	dns_requestmgr_shutdown(requestmgr);
 
@@ -3036,6 +3040,8 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	isc_sockaddr_t *srcaddr;
 
 	debug("send_gssrequest");
+	REQUIRE(destaddr != NULL);
+
 	reqinfo = isc_mem_get(gmctx, sizeof(nsu_gssinfo_t));
 	reqinfo->msg = msg;
 	reqinfo->addr = destaddr;
@@ -3327,21 +3333,7 @@ cleanup(void) {
 		ddebug("Detaching GSS-TSIG keyring");
 		dns_tsigkeyring_detach(&gssring);
 	}
-	if (kserver != NULL) {
-		isc_mem_put(gmctx, kserver, sizeof(isc_sockaddr_t));
-		kserver = NULL;
-	}
-	if (realm != NULL) {
-		isc_mem_free(gmctx, realm);
-		realm = NULL;
-	}
-	if (dns_name_dynamic(&tmpzonename)) {
-		dns_name_free(&tmpzonename, gmctx);
-	}
-	if (dns_name_dynamic(&restart_master)) {
-		dns_name_free(&restart_master, gmctx);
-	}
-#endif /* HAVE_GSSAPI */
+#endif /* ifdef HAVE_GSSAPI */
 
 	if (sig0key != NULL) {
 		dst_key_free(&sig0key);
@@ -3359,6 +3351,26 @@ cleanup(void) {
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);
 
+#ifdef HAVE_GSSAPI
+	/*
+	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
+	 */
+	if (kserver != NULL) {
+		isc_mem_put(gmctx, kserver, sizeof(isc_sockaddr_t));
+		kserver = NULL;
+	}
+	if (realm != NULL) {
+		isc_mem_free(gmctx, realm);
+		realm = NULL;
+	}
+	if (dns_name_dynamic(&tmpzonename)) {
+		dns_name_free(&tmpzonename, gmctx);
+	}
+	if (dns_name_dynamic(&restart_master)) {
+		dns_name_free(&restart_master, gmctx);
+	}
+#endif /* ifdef HAVE_GSSAPI */
+
 	ddebug("Removing log context");
 	isc_log_destroy(&glctx);