diff --git a/lib/krb5/plugin.c b/lib/krb5/plugin.c
index b96d20869..ef7886391 100644
--- a/lib/krb5/plugin.c
+++ b/lib/krb5/plugin.c
@@ -201,21 +201,18 @@ load_plugins(krb5_context context)
 	dirs = rk_UNCONST(sysplugin_dirs);
 
     for (di = dirs; *di != NULL; di++) {
+        char * dir = *di;
+
 #ifdef KRB5_USE_PATH_TOKENS
-	{
-	    char * dir = NULL;
-
-	    if (_krb5_expand_path_tokens(context, *di, &dir))
-		continue;
-	    d = opendir(dir);
-
-	    free(dir);
-	}
-#else
-	d = opendir(*di);
+        if (_krb5_expand_path_tokens(context, *di, &dir))
+            goto next_dir;
 #endif
+
+        d = opendir(dir);
+
 	if (d == NULL)
-	    continue;
+	    goto next_dir;
+
 	rk_cloexec_dir(d);
 
 	while ((entry = readdir(d)) != NULL) {
@@ -231,11 +228,11 @@ load_plugins(krb5_context context)
 	    { /* support loading bundles on MacOS */
 		size_t len = strlen(n);
 		if (len > 7 && strcmp(&n[len - 7],  ".bundle") == 0)
-		    ret = asprintf(&path, "%s/%s/Contents/MacOS/%.*s", *di, n, (int)(len - 7), n);
+		    ret = asprintf(&path, "%s/%s/Contents/MacOS/%.*s", dir, n, (int)(len - 7), n);
 	    }
 #endif
 	    if (ret < 0 || path == NULL)
-		ret = asprintf(&path, "%s/%s", *di, n);
+		ret = asprintf(&path, "%s/%s", dir, n);
 
 	    if (ret < 0 || path == NULL) {
 		ret = ENOMEM;
@@ -254,6 +251,10 @@ load_plugins(krb5_context context)
 	    }
 	}
 	closedir(d);
+
+    next_dir:
+        if (dir != *di)
+            free(dir);
     }
     if (dirs != rk_UNCONST(sysplugin_dirs))
 	krb5_config_free_strings(dirs);