diff --git a/tool/net/net.mk b/tool/net/net.mk
index 9a8072629..9652722cb 100644
--- a/tool/net/net.mk
+++ b/tool/net/net.mk
@@ -203,7 +203,8 @@ o/$(MODE)/tool/net/redbean-demo.com:						\
 		-o o/$(MODE)/tool/net/.redbean-demo/.symtab $<
 	@$(COMPILE) -AZIP -T$@ o/$(MODE)/third_party/infozip/zip.com -9qj $@	\
 		o/$(MODE)/tool/net/.redbean-demo/.ape				\
-		o/$(MODE)/tool/net/.redbean-demo/.symtab
+		o/$(MODE)/tool/net/.redbean-demo/.symtab			\
+		tool/net/help.txt
 
 # REDBEAN-STATIC.COM
 #
diff --git a/tool/net/redbean.c b/tool/net/redbean.c
index 4c4162b42..abf20524b 100644
--- a/tool/net/redbean.c
+++ b/tool/net/redbean.c
@@ -1434,7 +1434,7 @@ static void WipeSigningKeys(void) {
     if (!certs.p[i].cert) continue;
     if (!certs.p[i].cert->ca_istrue) continue;
     mbedtls_pk_free(certs.p[i].key);
-    certs.p[i].key = 0;
+    Free(&certs.p[i].key);
   }
 }
 
@@ -1451,6 +1451,12 @@ static void PsksDestroy(void) {
 
 static void CertsDestroy(void) {
   size_t i;
+  // break up certificate chains to prevent double free
+  for (i = 0; i < certs.n; ++i) {
+    if (certs.p[i].cert) {
+      certs.p[i].cert->next = 0;
+    }
+  }
   for (i = 0; i < certs.n; ++i) {
     mbedtls_x509_crt_free(certs.p[i].cert);
     free(certs.p[i].cert);