diff --git a/app/flatpak-builtins-create-usb.c b/app/flatpak-builtins-create-usb.c
index 8250029f..08710535 100644
--- a/app/flatpak-builtins-create-usb.c
+++ b/app/flatpak-builtins-create-usb.c
@@ -431,6 +431,7 @@ ostree_create_usb (GOptionContext *context,
               break;
             }
         }
+      glnx_dirfd_iterator_clear (&repos_iter);
 
       /* If we need a symlink, find a unique name for it and create it. */
       if (need_symlink)
diff --git a/app/flatpak-cli-transaction.c b/app/flatpak-cli-transaction.c
index e6653eaf..181b169f 100644
--- a/app/flatpak-cli-transaction.c
+++ b/app/flatpak-cli-transaction.c
@@ -159,7 +159,7 @@ install_authenticator (FlatpakTransaction            *old_transaction,
   FlatpakCliTransaction *old_cli = FLATPAK_CLI_TRANSACTION (old_transaction);
   g_autoptr(FlatpakTransaction)  transaction2 = NULL;
   g_autoptr(GError) local_error = NULL;
-  FlatpakInstallation *installation = flatpak_transaction_get_installation (old_transaction);
+  g_autoptr(FlatpakInstallation) installation = flatpak_transaction_get_installation (old_transaction);
   FlatpakDir *dir = flatpak_installation_get_dir (installation, NULL);
 
   if (dir == NULL)
@@ -888,7 +888,7 @@ end_of_lifed_with_rebase (FlatpakTransaction *transaction,
   EolAction action = EOL_UNDECIDED;
   EolAction old_action = EOL_UNDECIDED;
   gboolean can_rebase = rebased_to_ref != NULL && remote != NULL;
-  FlatpakInstallation *installation = flatpak_transaction_get_installation (transaction);
+  g_autoptr(FlatpakInstallation) installation = flatpak_transaction_get_installation (transaction);
   FlatpakDir *dir = flatpak_installation_get_dir (installation, NULL);
 
   if (ref == NULL)
@@ -1287,7 +1287,7 @@ static gboolean
 transaction_ready_pre_auth (FlatpakTransaction *transaction)
 {
   FlatpakCliTransaction *self = FLATPAK_CLI_TRANSACTION (transaction);
-  GList *ops = flatpak_transaction_get_operations (transaction);
+  g_autolist(FlatpakTransactionOperation) ops = flatpak_transaction_get_operations (transaction);
   GList *l;
   int i;
   FlatpakTablePrinter *printer;
diff --git a/app/flatpak-quiet-transaction.c b/app/flatpak-quiet-transaction.c
index 137c9baf..7b74e2b2 100644
--- a/app/flatpak-quiet-transaction.c
+++ b/app/flatpak-quiet-transaction.c
@@ -190,7 +190,7 @@ install_authenticator (FlatpakTransaction            *old_transaction,
 {
   g_autoptr(FlatpakTransaction)  transaction2 = NULL;
   g_autoptr(GError) local_error = NULL;
-  FlatpakInstallation *installation = flatpak_transaction_get_installation (old_transaction);
+  g_autoptr(FlatpakInstallation) installation = flatpak_transaction_get_installation (old_transaction);
   FlatpakDir *dir = flatpak_installation_get_dir (installation, NULL);
 
   if (dir == NULL)
diff --git a/common/flatpak-dir.c b/common/flatpak-dir.c
index 19219937..e9fe0764 100644
--- a/common/flatpak-dir.c
+++ b/common/flatpak-dir.c
@@ -11513,7 +11513,7 @@ flatpak_dir_get_if_deployed (FlatpakDir        *self,
     }
 
   if (g_file_query_file_type (deploy_dir, G_FILE_QUERY_INFO_NONE, cancellable) == G_FILE_TYPE_DIRECTORY)
-    return g_object_ref (deploy_dir);
+    return g_steal_pointer (&deploy_dir);
 
   /* Maybe it was removed but is still living? */
   if (checksum != NULL)
@@ -11527,7 +11527,7 @@ flatpak_dir_get_if_deployed (FlatpakDir        *self,
       removed_deploy_dir = g_file_get_child (removed_dir, dirname);
 
       if (g_file_query_file_type (removed_deploy_dir, G_FILE_QUERY_INFO_NONE, cancellable) == G_FILE_TYPE_DIRECTORY)
-        return g_object_ref (removed_deploy_dir);
+        return g_steal_pointer (&removed_deploy_dir);
     }
 
   return NULL;
diff --git a/common/flatpak-locale-utils.c b/common/flatpak-locale-utils.c
index 859721bc..37aabfa2 100644
--- a/common/flatpak-locale-utils.c
+++ b/common/flatpak-locale-utils.c
@@ -298,7 +298,7 @@ flatpak_get_locale_langs_from_accounts_dbus_for_user (GDBusProxy *proxy, GPtrArr
       value = g_dbus_proxy_get_cached_property (accounts_proxy, "Languages");
       if (value != NULL)
         {
-          const char **locales = g_variant_get_strv (value, NULL);
+          g_autofree const char **locales = g_variant_get_strv (value, NULL);
           guint i;
 
           for (i = 0; locales != NULL && locales[i] != NULL; i++)
diff --git a/common/flatpak-prune.c b/common/flatpak-prune.c
index b2d08b37..f74d5d4b 100644
--- a/common/flatpak-prune.c
+++ b/common/flatpak-prune.c
@@ -775,6 +775,7 @@ flatpak_repo_prune (OstreeRepo    *repo,
 
     g_timer_stop (timer);
     g_info ("Elapsed time: %.1f sec",  g_timer_elapsed (timer, NULL));
+    g_clear_pointer (&timer, g_timer_destroy);
   }
 
   {
diff --git a/common/flatpak-transaction.c b/common/flatpak-transaction.c
index 86f866f9..a6f87166 100644
--- a/common/flatpak-transaction.c
+++ b/common/flatpak-transaction.c
@@ -3941,9 +3941,11 @@ request_tokens_for_remote (FlatpakTransaction *self,
       g_autoptr(GFile) deploy = NULL;
       deploy = flatpak_dir_get_if_deployed (priv->dir, auto_install_ref, NULL, cancellable);
       if (deploy == NULL)
-        g_signal_emit (self, signals[INSTALL_AUTHENTICATOR], 0,
-                       remote, flatpak_decomposed_get_ref (auto_install_ref));
-      deploy = flatpak_dir_get_if_deployed (priv->dir, auto_install_ref, NULL, cancellable);
+        {
+          g_signal_emit (self, signals[INSTALL_AUTHENTICATOR], 0,
+                         remote, flatpak_decomposed_get_ref (auto_install_ref));
+          deploy = flatpak_dir_get_if_deployed (priv->dir, auto_install_ref, NULL, cancellable);
+        }
       if (deploy == NULL)
         return flatpak_fail (error, _("No authenticator installed for remote '%s'"), remote);
     }
@@ -4024,7 +4026,7 @@ request_tokens_for_remote (FlatpakTransaction *self,
   g_assert (priv->active_request_id == 0); /* No outstanding requests */
   priv->active_request = NULL;
 
-  results = data.results; /* Make sure its freed as needed */
+  results = data.results; /* Make sure it's freed as needed */
 
   {
     g_autofree char *results_str = results != NULL ? g_variant_print (results, FALSE) : g_strdup ("NULL");
@@ -4082,6 +4084,7 @@ request_tokens_for_remote (FlatpakTransaction *self,
               token = token_for_refs;
               break;
             }
+          g_clear_pointer (&refs_strv, g_free);
         }
 
       if (token == NULL)
diff --git a/common/flatpak-utils.c b/common/flatpak-utils.c
index be9f1d46..42353409 100644
--- a/common/flatpak-utils.c
+++ b/common/flatpak-utils.c
@@ -633,7 +633,7 @@ flatpak_get_bwrap (void)
 gboolean
 flatpak_bwrap_is_unprivileged (void)
 {
-  const char *path = g_find_program_in_path (flatpak_get_bwrap ());
+  g_autofree char *path = g_find_program_in_path (flatpak_get_bwrap ());
   struct stat st;
 
   /* Various features are supported only if bwrap exists and is not setuid */
@@ -3530,6 +3530,7 @@ _ostree_repo_static_delta_superblock_digest (OstreeRepo    *repo,
   glnx_autofd int fd = -1;
   guint8 digest[OSTREE_SHA256_DIGEST_LEN];
   gsize len;
+  gpointer data = NULL;
 
   if (!glnx_openat_rdonly (ostree_repo_get_dfd (repo), superblock, TRUE, &fd, error))
     return NULL;
@@ -3543,9 +3544,10 @@ _ostree_repo_static_delta_superblock_digest (OstreeRepo    *repo,
   len = sizeof digest;
   g_checksum_get_digest (checksum, digest, &len);
 
+  data = g_memdup2 (digest, len);
   return g_variant_new_from_data (G_VARIANT_TYPE ("ay"),
-                                  g_memdup2 (digest, len), len,
-                                  FALSE, g_free, FALSE);
+                                  data, len,
+                                  FALSE, g_free, data);
 }
 
 static char *
@@ -4630,7 +4632,7 @@ flatpak_repo_gc_digested_summaries (OstreeRepo *repo,
         {
           if (strcmp (ext, ".gz") == 0 && strlen (dent->d_name) == 64 + 3)
             {
-              char *sha256 = g_strndup (dent->d_name, 64);
+              g_autofree char *sha256 = g_strndup (dent->d_name, 64);
 
               /* Keep all the referenced summaries */
               if (g_hash_table_contains (digested_summary_cache, sha256))
@@ -4646,7 +4648,7 @@ flatpak_repo_gc_digested_summaries (OstreeRepo *repo,
               const char *dash = strchr (dent->d_name, '-');
               if (dash != NULL && dash < ext && (ext - dash) == 1 + 64)
                 {
-                  char *to_sha256 = g_strndup (dash + 1, 64);
+                  g_autofree char *to_sha256 = g_strndup (dash + 1, 64);
 
                   /* Only keep deltas going to a generated summary */
                   if (g_hash_table_contains (digested_summaries, to_sha256))
diff --git a/icon-validator/validate-icon.c b/icon-validator/validate-icon.c
index d45d62e1..ffe52648 100644
--- a/icon-validator/validate-icon.c
+++ b/icon-validator/validate-icon.c
@@ -39,7 +39,7 @@ validate_icon (const char *arg_width,
   GdkPixbufFormat *format;
   int max_width, max_height;
   int width, height;
-  const char *name;
+  g_autofree char *name = NULL;
   const char *allowed_formats[] = { "png", "jpeg", "svg", NULL };
   g_autoptr(GdkPixbuf) pixbuf = NULL;
   g_autoptr(GError) error = NULL;
@@ -252,7 +252,7 @@ static GOptionEntry entries[] = {
 int
 main (int argc, char *argv[])
 {
-  GOptionContext *context;
+  g_autoptr(GOptionContext) context = NULL;
   GError *error = NULL;
 
   context = g_option_context_new ("WIDTH HEIGHT PATH");
diff --git a/portal/flatpak-portal-app-info.c b/portal/flatpak-portal-app-info.c
index b3eb11ed..f6c81622 100644
--- a/portal/flatpak-portal-app-info.c
+++ b/portal/flatpak-portal-app-info.c
@@ -199,7 +199,9 @@ name_owner_changed (GDBusConnection *connection,
                     GVariant        *parameters,
                     gpointer         user_data)
 {
-  const char *name, *from, *to;
+  g_autofree char *name = NULL;
+  g_autofree char *from = NULL;
+  g_autofree char *to = NULL;
 
   g_variant_get (parameters, "(sss)", &name, &from, &to);
 
diff --git a/portal/flatpak-portal.c b/portal/flatpak-portal.c
index 5ba8ec76..f2933401 100644
--- a/portal/flatpak-portal.c
+++ b/portal/flatpak-portal.c
@@ -3013,7 +3013,7 @@ main (int    argc,
   ssize_t exe_path_len;
   gboolean replace;
   gboolean show_version;
-  GOptionContext *context;
+  g_autoptr(GOptionContext) context = NULL;
   GBusNameOwnerFlags flags;
   g_autoptr(GError) error = NULL;
   const GOptionEntry options[] = {
diff --git a/session-helper/flatpak-session-helper.c b/session-helper/flatpak-session-helper.c
index a04eb9af..4fa8c04f 100644
--- a/session-helper/flatpak-session-helper.c
+++ b/session-helper/flatpak-session-helper.c
@@ -626,7 +626,7 @@ file_monitor_do (MonitorData *data)
       /* We can't update the /etc/localtime symlink at runtime, nor can we make it a of the
        * correct form "../usr/share/zoneinfo/$timezone". So, instead we use the old debian
        * /etc/timezone file for telling the sandbox the timezone. */
-      char *dest = g_build_filename (monitor_dir, "timezone", NULL);
+      g_autofree char *dest = g_build_filename (monitor_dir, "timezone", NULL);
       g_autofree char *raw_timezone = flatpak_get_timezone ();
       g_autofree char *timezone_content = g_strdup_printf ("%s\n", raw_timezone);
 
@@ -769,6 +769,7 @@ main (int    argc,
   gboolean show_version;
   GOptionContext *context;
   GBusNameOwnerFlags flags;
+  g_autofree char *pk11_program = NULL;
   g_autofree char *flatpak_dir = NULL;
   g_autoptr(GError) error = NULL;
   const GOptionEntry options[] = {
@@ -849,7 +850,8 @@ main (int    argc,
       exit (1);
     }
 
-  if (g_find_program_in_path ("p11-kit"))
+  pk11_program = g_find_program_in_path ("p11-kit");
+  if (pk11_program)
     start_p11_kit_server (flatpak_dir);
   else
     g_info ("p11-kit not found");
diff --git a/system-helper/flatpak-system-helper.c b/system-helper/flatpak-system-helper.c
index 28cf5154..df0b7aa9 100644
--- a/system-helper/flatpak-system-helper.c
+++ b/system-helper/flatpak-system-helper.c
@@ -2314,7 +2314,7 @@ main (int    argc,
   gboolean replace;
   gboolean show_version;
   GBusNameOwnerFlags flags;
-  GOptionContext *context;
+  g_autoptr(GOptionContext) context = NULL;
   g_autoptr(GError) error = NULL;
   const GOptionEntry options[] = {
     { "replace", 'r', 0, G_OPTION_ARG_NONE, &replace,  "Replace old daemon.", NULL },
diff --git a/tests/test-portal.c b/tests/test-portal.c
index 306215cb..027f8aa4 100644
--- a/tests/test-portal.c
+++ b/tests/test-portal.c
@@ -466,6 +466,7 @@ teardown (Fixture *f,
   tests_dbus_daemon_teardown (&f->dbus_daemon);
   g_clear_object (&f->portal);
   g_free (f->portal_path);
+  g_free (f->mock_flatpak);
 }
 
 int
diff --git a/tests/test-update-portal.c b/tests/test-update-portal.c
index f283f182..c0734517 100644
--- a/tests/test-update-portal.c
+++ b/tests/test-update-portal.c
@@ -205,7 +205,7 @@ update_test (PortalFlatpak *portal, int status_pipe)
   g_autoptr(GError) error = NULL;
   PortalFlatpakUpdateMonitor *monitor;
   GVariantBuilder opt_builder;
-  GMainLoop *loop = g_main_loop_new (NULL, FALSE);
+  g_autoptr(GMainLoop) loop = g_main_loop_new (NULL, FALSE);
   UpdateData data = { loop };
 
   monitor = create_monitor (portal, NULL, NULL, &error);
@@ -241,7 +241,7 @@ update_null_test (PortalFlatpak *portal, int status_pipe)
   g_autoptr(GError) error = NULL;
   PortalFlatpakUpdateMonitor *monitor;
   GVariantBuilder opt_builder;
-  GMainLoop *loop = g_main_loop_new (NULL, FALSE);
+  g_autoptr(GMainLoop) loop = g_main_loop_new (NULL, FALSE);
   UpdateData data = { loop };
 
   monitor = create_monitor (portal, NULL, NULL, &error);
@@ -277,7 +277,7 @@ update_fail_test (PortalFlatpak *portal, int status_pipe)
   g_autoptr(GError) error = NULL;
   PortalFlatpakUpdateMonitor *monitor;
   GVariantBuilder opt_builder;
-  GMainLoop *loop = g_main_loop_new (NULL, FALSE);
+  g_autoptr(GMainLoop) loop = g_main_loop_new (NULL, FALSE);
   UpdateData data = { loop };
 
   monitor = create_monitor (portal, NULL, NULL, &error);
@@ -313,7 +313,7 @@ update_notsupp_test (PortalFlatpak *portal, int status_pipe)
   g_autoptr(GError) error = NULL;
   PortalFlatpakUpdateMonitor *monitor;
   GVariantBuilder opt_builder;
-  GMainLoop *loop = g_main_loop_new (NULL, FALSE);
+  g_autoptr(GMainLoop) loop = g_main_loop_new (NULL, FALSE);
   UpdateData data = { loop };
 
   monitor = create_monitor (portal, NULL, NULL, &error);