diff --git a/NEWS b/NEWS
index 810379466..f42c8545a 100644
--- a/NEWS
+++ b/NEWS
@@ -6,6 +6,8 @@ ver 0.22.10 (not yet released)
 * input
   - curl: fix crash bug after stream with Icy metadata was closed by peer
   - tidal: remove defunct unmaintained plugin
+* tags
+  - fix crash caused by bug in TagBuilder and a few potential reference leaks
 
 ver 0.22.9 (2021/06/23)
 * database
diff --git a/src/tag/Builder.cxx b/src/tag/Builder.cxx
index 8f38ae172..76b404499 100644
--- a/src/tag/Builder.cxx
+++ b/src/tag/Builder.cxx
@@ -69,8 +69,8 @@ TagBuilder::operator=(const TagBuilder &other) noexcept
 
 	/* increment the tag pool refcounters */
 	const std::lock_guard<Mutex> protect(tag_pool_lock);
-	for (auto i : items)
-		tag_pool_dup_item(i);
+	for (auto &i : items)
+		i = tag_pool_dup_item(i);
 
 	return *this;
 }
@@ -80,6 +80,8 @@ TagBuilder::operator=(TagBuilder &&other) noexcept
 {
 	duration = other.duration;
 	has_playlist = other.has_playlist;
+
+	RemoveAll();
 	items = std::move(other.items);
 
 	return *this;