diff --git a/internal/http/retry.go b/internal/http/retry.go
index fa7ae9d3..d740ce46 100644
--- a/internal/http/retry.go
+++ b/internal/http/retry.go
@@ -188,6 +188,10 @@ func (r *Retry) Do(req *http.Request) (*http.Response, error) {
 
 	resp, err := r.Client.Do(req)
 	for N > 0 && (isTemporary(err) || (resp != nil && resp.StatusCode >= http.StatusInternalServerError)) {
+		if resp != nil {
+			resp.Body.Close()
+		}
+
 		N--
 		var delay time.Duration
 		switch {
diff --git a/internal/keystore/entrust/keycontrol.go b/internal/keystore/entrust/keycontrol.go
index a5d06a17..4a1a5416 100644
--- a/internal/keystore/entrust/keycontrol.go
+++ b/internal/keystore/entrust/keycontrol.go
@@ -148,6 +148,7 @@ func (kc *KeyControl) Status(ctx context.Context) (kes.KeyStoreState, error) {
 			Err: fmt.Errorf("keycontrol: failed to fetch status: %v", err),
 		}
 	}
+	defer resp.Body.Close()
 	latency := time.Since(start)
 
 	if resp.StatusCode != http.StatusOK {
@@ -295,6 +296,7 @@ func (kc *KeyControl) Delete(ctx context.Context, name string) error {
 	if err != nil {
 		return fmt.Errorf("keycontrol: failed to delete key: %v", err)
 	}
+	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		return parseErrorResponse(resp)
 	}
@@ -380,6 +382,7 @@ func (kc *KeyControl) List(ctx context.Context, prefix string, n int) ([]string,
 	if err != nil {
 		return nil, "", fmt.Errorf("keycontrol: failed to list keys: %v", err)
 	}
+	defer resp.Body.Close()
 	if resp.StatusCode != http.StatusOK {
 		return nil, "", parseErrorResponse(resp)
 	}