diff --git a/shared/nm-utils/nm-compat.c b/shared/nm-utils/nm-compat.c
index 22ab675de..b470e804c 100644
--- a/shared/nm-utils/nm-compat.c
+++ b/shared/nm-utils/nm-compat.c
@@ -44,25 +44,32 @@ _get_keys (NMSettingVpn *setting,
 
 	nm_assert (NM_IS_SETTING_VPN (setting));
 
-	a = g_ptr_array_new ();
+	if (is_secrets)
+		len = nm_setting_vpn_get_num_secrets (setting);
+	else
+		len = nm_setting_vpn_get_num_data_items (setting);
+
+	a = g_ptr_array_new_full (len + 1, (GDestroyNotify) g_free);
+
 	if (is_secrets)
 		nm_setting_vpn_foreach_secret (setting, _get_keys_cb, a);
 	else
 		nm_setting_vpn_foreach_data_item (setting, _get_keys_cb, a);
+
 	len = a->len;
 
-	if (a->len) {
+	if (len) {
 		g_ptr_array_sort (a, nm_strcmp_p);
 		g_ptr_array_add (a, NULL);
-		keys = (const char **) g_ptr_array_free (g_steal_pointer (&a), FALSE);
+		keys = g_memdup (a->pdata, a->len * sizeof *keys);
 
 		/* we need to cache the keys *somewhere*. */
 		g_object_set_qdata_full (G_OBJECT (setting),
 		                         is_secrets
 		                         ? NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_secret_keys")
 		                         : NM_CACHED_QUARK ("libnm._nm_setting_vpn_get_data_keys"),
-		                         keys,
-		                         (GDestroyNotify) g_strfreev);
+		                         g_ptr_array_ref (a),
+		                         (GDestroyNotify) g_ptr_array_unref);
 	}
 
 	NM_SET_OUT (out_length, len);