diff --git a/ci_scripts/suppressions/lsan.supp b/ci_scripts/suppressions/lsan.supp
index 3b7d93af62dda..0ec6d73cbca46 100644
--- a/ci_scripts/suppressions/lsan.supp
+++ b/ci_scripts/suppressions/lsan.supp
@@ -59,3 +59,8 @@ leak:GenerateRecoveryConfig
 # Returns strdup'd string which never gets freed in frontend tools. Trying to 
 # free it leads to comiler complains that it discards 'const' qualifier.
 leak:get_progname
+
+# A buch of not freed allocations in putVariableInt right before exit(1). And 
+# malloced `threads` ("Thread state") never gets released (allocated in main(),
+# once, and not in loop).
+leak:bin/pgbench/pgbench.c
diff --git a/contrib/pg_tde/src/bin/pg_tde_archive_decrypt.c b/contrib/pg_tde/src/bin/pg_tde_archive_decrypt.c
index 4dca62c84fcc6..3afe254b491f9 100644
--- a/contrib/pg_tde/src/bin/pg_tde_archive_decrypt.c
+++ b/contrib/pg_tde/src/bin/pg_tde_archive_decrypt.c
@@ -212,6 +212,8 @@ main(int argc, char *argv[])
 	if (system(command) != 0)
 		pg_fatal("ARCHIVE-COMMAND \"%s\" failed: %m", command);
 
+	free(command);
+
 	if (issegment)
 	{
 		if (unlink(tmppath) < 0)
diff --git a/contrib/pg_tde/src/bin/pg_tde_restore_encrypt.c b/contrib/pg_tde/src/bin/pg_tde_restore_encrypt.c
index 8decd4ab52dd9..a02519c787b6f 100644
--- a/contrib/pg_tde/src/bin/pg_tde_restore_encrypt.c
+++ b/contrib/pg_tde/src/bin/pg_tde_restore_encrypt.c
@@ -205,6 +205,8 @@ main(int argc, char *argv[])
 	if (system(command) != 0)
 		pg_fatal("RESTORE-COMMAND \"%s\" failed: %m", command);
 
+	free(command);
+
 	if (issegment)
 	{
 		write_encrypted_segment(targetpath, sourcename, tmppath);