diff --git a/rustls-libssl/src/entry.rs b/rustls-libssl/src/entry.rs
index fdb4edd..5c8084d 100644
--- a/rustls-libssl/src/entry.rs
+++ b/rustls-libssl/src/entry.rs
@@ -604,7 +604,7 @@ entry! {
             return Error::null_pointer().raise().into();
         }
 
-        let pkey = EvpPkey::new_adopt(pkey);
+        let pkey = EvpPkey::new_incref(pkey);
 
         match ctx
             .lock()
@@ -1514,7 +1514,7 @@ entry! {
             return Error::null_pointer().raise().into();
         }
 
-        let pkey = EvpPkey::new_adopt(pkey);
+        let pkey = EvpPkey::new_incref(pkey);
 
         match ssl
             .lock()
diff --git a/rustls-libssl/src/evp_pkey.rs b/rustls-libssl/src/evp_pkey.rs
index 1bc1e36..e489025 100644
--- a/rustls-libssl/src/evp_pkey.rs
+++ b/rustls-libssl/src/evp_pkey.rs
@@ -17,9 +17,12 @@ pub struct EvpPkey {
 }
 
 impl EvpPkey {
-    /// Use a pre-existing private key, adopting ownership.
-    pub fn new_adopt(pkey: *mut EVP_PKEY) -> Self {
+    /// Use a pre-existing private key, incrementing ownership.
+    ///
+    /// `pkey` continues to belong to the caller.
+    pub fn new_incref(pkey: *mut EVP_PKEY) -> Self {
         debug_assert!(!pkey.is_null());
+        unsafe { EVP_PKEY_up_ref(pkey) };
         Self { pkey }
     }