diff --git a/src/core/security/credentials.c b/src/core/security/credentials.c
index ef1f40633b6..2674003962e 100644
--- a/src/core/security/credentials.c
+++ b/src/core/security/credentials.c
@@ -88,6 +88,7 @@ void grpc_channel_credentials_unref(grpc_channel_credentials *creds) {
   if (creds == NULL) return;
   if (gpr_unref(&creds->refcount)) {
     creds->vtable->destruct(creds);
+    grpc_call_credentials_unref(creds->call_creds);
     gpr_free(creds);
   }
 }
diff --git a/test/core/security/credentials_test.c b/test/core/security/credentials_test.c
index 03a82c09c0b..876a5192a4f 100644
--- a/test/core/security/credentials_test.c
+++ b/test/core/security/credentials_test.c
@@ -54,7 +54,6 @@ static const char test_google_iam_authorization_token[] = "blahblahblhahb";
 static const char test_google_iam_authority_selector[] = "respectmyauthoritah";
 static const char test_oauth2_bearer_token[] =
     "Bearer blaaslkdjfaslkdfasdsfasf";
-static const char test_root_cert[] = "I am the root!";
 
 /* This JSON key was generated with the GCE console and revoked immediately.
    The identifiers have been changed as well.