diff --git a/daemon/codec.c b/daemon/codec.c
index 786684514..25ce6b37d 100644
--- a/daemon/codec.c
+++ b/daemon/codec.c
@@ -894,6 +894,7 @@ static int __handler_func_sequencer(struct media_packet *mp, struct transcode_pa
 			break;
 
 		h = packet->handler;
+		obj_put(&ch->h);
 		ch = get_ssrc(ssrc_in_p->h.ssrc, h->ssrc_hash);
 		if (G_UNLIKELY(!ch))
 			goto next;
@@ -995,10 +996,13 @@ static void __output_rtp(struct media_packet *mp, struct codec_ssrc_handler *ch,
 	atomic64_set(&ssrc_out->last_ts, ts);
 }
 
+// returns new reference
 static struct codec_ssrc_handler *__output_ssrc_handler(struct codec_ssrc_handler *ch, struct media_packet *mp) {
 	struct codec_handler *handler = ch->handler;
-	if (handler->output_handler == handler)
+	if (handler->output_handler == handler) {
+		obj_get(&ch->h);
 		return ch;
+	}
 
 	// our encoder is in a different codec handler
 	ilog(LOG_DEBUG, "Switching context from decoder to encoder");
@@ -1006,6 +1010,7 @@ static struct codec_ssrc_handler *__output_ssrc_handler(struct codec_ssrc_handle
 	struct codec_ssrc_handler *new_ch = get_ssrc(mp->ssrc_in->parent->h.ssrc, handler->ssrc_hash);
 	if (G_UNLIKELY(!new_ch)) {
 		ilog(LOG_ERR, "Switched from input to output codec context, but no codec handler present");
+		obj_get(&ch->h);
 		return ch;
 	}
 
@@ -1058,6 +1063,7 @@ static void packet_dtmf_fwd(struct codec_ssrc_handler *ch, struct transcode_pack
 			ch->last_dtmf_event_ts = duration;
 		}
 		payload_type = ch->handler->dtmf_payload_type;
+		obj_put(&output_ch->h);
 	}
 
 	char *buf = malloc(packet->payload->len + sizeof(struct rtp_header) + RTP_BUFFER_TAIL_ROOM);
@@ -1546,6 +1552,7 @@ static int __packet_decoded(decoder_t *decoder, AVFrame *frame, void *u1, void *
 discard:
 	av_frame_free(&frame);
 	//mp->iter_out++;
+	obj_put(&new_ch->h);
 
 	return 0;
 }
@@ -1599,6 +1606,7 @@ static int handler_func_inject_dtmf(struct codec_handler *h, struct media_packet
 	struct codec_ssrc_handler *ch = get_ssrc(mp->ssrc_in->parent->h.ssrc, h->ssrc_hash);
 	decoder_input_data(ch->decoder, &mp->payload, mp->rtp->timestamp,
 			__packet_decoded, ch, mp);
+	obj_put(&ch->h);
 	return 0;
 }
 
diff --git a/daemon/dtmf.c b/daemon/dtmf.c
index 646825fa0..d9e6c35cb 100644
--- a/daemon/dtmf.c
+++ b/daemon/dtmf.c
@@ -175,6 +175,7 @@ static char dtmf_code_to_char(int code) {
 	return codes[code];
 }
 
+// takes over the csh reference
 static const char *dtmf_inject_pcm(struct call_media *media, struct call_monologue *monologue,
 		struct packet_stream *ps, struct ssrc_ctx *ssrc_in, struct codec_handler *ch,
 		struct codec_ssrc_handler *csh,
@@ -224,6 +225,7 @@ static const char *dtmf_inject_pcm(struct call_media *media, struct call_monolog
 
 	media_socket_dequeue(&packet, packet_stream_sink(ps));
 
+	obj_put_o((struct obj *) csh);
 	return 0;
 }
 
@@ -271,6 +273,7 @@ const char *dtmf_inject(struct call_media *media, int code, int volume, int dura
 	codec_add_dtmf_event(csh, dtmf_code_to_char(code), volume, codec_encoder_pts(csh));
 	codec_add_dtmf_event(csh, 0, 0, codec_encoder_pts(csh) + num_samples);
 
+	obj_put_o((struct obj *) csh);
 	return NULL;
 }