diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 27eafb1..da00840 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,4 +1,4 @@
-image: registry.gitlab.gnome.org/gnome/libsecret/master:v1
+image: registry.gitlab.gnome.org/gnome/libsecret/master:v2
 
 stages:
   - build
@@ -26,11 +26,11 @@ fedora:asan:
   before_script:
     - dbus-uuidgen --ensure
   script:
+    - export LSAN_OPTIONS=suppressions=$PWD/build/lsan.supp
     - meson _build -Db_sanitize=address -Dgtk_doc=false -Dintrospection=false
     - meson compile -C _build
     - eval `dbus-launch --sh-syntax`
     - meson test -C _build --print-errorlogs
-  allow_failure: true
   artifacts:
     when: on_failure
     paths:
diff --git a/.gitlab-ci/master.Dockerfile b/.gitlab-ci/master.Dockerfile
index ee0c344..56c8672 100644
--- a/.gitlab-ci/master.Dockerfile
+++ b/.gitlab-ci/master.Dockerfile
@@ -1,4 +1,4 @@
-FROM fedora:34
+FROM fedora:38
 
 RUN dnf update -y \
     && dnf install -y \
diff --git a/build/lsan.supp b/build/lsan.supp
new file mode 100644
index 0000000..665a172
--- /dev/null
+++ b/build/lsan.supp
@@ -0,0 +1,2 @@
+# https://gitlab.gnome.org/GNOME/glib/-/issues/2312
+leak:async_initable_init_first
diff --git a/libsecret/secret-file-collection.c b/libsecret/secret-file-collection.c
index 1819e83..96f8226 100644
--- a/libsecret/secret-file-collection.c
+++ b/libsecret/secret-file-collection.c
@@ -430,13 +430,16 @@ ensure_up_to_date (SecretFileCollection *self)
 		gsize length = 0;
 		gboolean success;
 		GError *error = NULL;
+		gchar *etag = NULL;
 
 		self->file_last_modified = last_modified;
-		g_clear_pointer (&self->etag, g_free);
 
-		success = g_file_load_contents (self->file, NULL, &contents, &length, &self->etag, &error);
+		success = g_file_load_contents (self->file, NULL, &contents, &length, &etag, &error);
 
-		if (!success && g_error_matches (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND)) {
+		if (success) {
+			g_clear_pointer (&self->etag, g_free);
+			self->etag = g_steal_pointer (&etag);
+		} else if (g_error_matches (error, G_IO_ERROR, G_IO_ERROR_NOT_FOUND)) {
 			g_clear_error (&error);
 
 			success = init_empty_file (self, &error);
@@ -464,12 +467,13 @@ on_load_contents (GObject *source_object,
 	gsize length;
 	GError *error = NULL;
 	gboolean ret;
+	gchar *etag = NULL;
 
 	self->file_last_modified = get_file_last_modified (self);
 
 	ret = g_file_load_contents_finish (file, result,
 					   &contents, &length,
-					   &self->etag,
+					   &etag,
 					   &error);
 
 	if (!ret) {
@@ -488,6 +492,9 @@ on_load_contents (GObject *source_object,
 		return;
 	}
 
+	g_clear_pointer (&self->etag, g_free);
+	self->etag = g_steal_pointer (&etag);
+
 	ret = load_contents (self, contents, length, &error);
 	if (ret)
 		g_task_return_boolean (task, ret);
@@ -864,14 +871,17 @@ on_replace_contents (GObject *source_object,
 	GTask *task = G_TASK (user_data);
 	SecretFileCollection *self = g_task_get_source_object (task);
 	GError *error = NULL;
+	gchar *etag = NULL;
 
-	if (!g_file_replace_contents_finish (file, result, &self->etag, &error)) {
+	if (!g_file_replace_contents_finish (file, result, &etag, &error)) {
 		g_task_return_error (task, error);
 		g_object_unref (task);
 		return;
 	}
 
 	self->file_last_modified = get_file_last_modified (self);
+	g_clear_pointer (&self->etag, g_free);
+	self->etag = g_steal_pointer (&etag);
 
 	g_task_return_boolean (task, TRUE);
 	g_object_unref (task);
diff --git a/libsecret/secret-paths.c b/libsecret/secret-paths.c
index fdd0580..f837bb2 100644
--- a/libsecret/secret-paths.c
+++ b/libsecret/secret-paths.c
@@ -783,6 +783,7 @@ secret_service_get_secret_for_dbus_path_finish (SecretService *self,
                                                 GError **error)
 {
 	GVariant *ret;
+	SecretValue *value;
 
 	g_return_val_if_fail (SECRET_IS_SERVICE (self), NULL);
 	g_return_val_if_fail (g_task_is_valid (result, self), NULL);
@@ -796,7 +797,9 @@ secret_service_get_secret_for_dbus_path_finish (SecretService *self,
 		return NULL;
 	}
 
-	return _secret_service_decode_get_secrets_first (self, ret);
+	value = _secret_service_decode_get_secrets_first (self, ret);
+	g_variant_unref (ret);
+	return value;
 }
 
 /**
@@ -920,6 +923,7 @@ secret_service_get_secrets_for_dbus_paths_finish (SecretService *self,
                                                   GError **error)
 {
 	GVariant *ret;
+	GHashTable *values;
 
 	g_return_val_if_fail (SECRET_IS_SERVICE (self), NULL);
 	g_return_val_if_fail (g_task_is_valid (result, self), NULL);
@@ -933,7 +937,9 @@ secret_service_get_secrets_for_dbus_paths_finish (SecretService *self,
 		return NULL;
 	}
 
-	return _secret_service_decode_get_secrets_all (self, ret);
+	values = _secret_service_decode_get_secrets_all (self, ret);
+	g_variant_unref (ret);
+	return values;
 }
 
 /**
@@ -1044,7 +1050,6 @@ on_xlock_called (GObject *source,
 	XlockClosure *closure = g_task_get_task_data (task);
 	GCancellable *cancellable = g_task_get_cancellable (task);
 	SecretService *self = SECRET_SERVICE (g_task_get_source_object (task));
-	GPtrArray *xlocked_array;
 	const gchar *prompt = NULL;
 	gchar **xlocked = NULL;
 	GError *error = NULL;
@@ -1056,11 +1061,13 @@ on_xlock_called (GObject *source,
 		g_task_return_error (task, g_steal_pointer (&error));
 
 	} else {
-		xlocked_array = g_ptr_array_new_with_free_func (g_free);
-
 		g_variant_get (retval, "(^ao&o)", &xlocked, &prompt);
 
 		if (_secret_util_empty_path (prompt)) {
+			GPtrArray *xlocked_array;
+
+			xlocked_array = g_ptr_array_new_with_free_func (g_free);
+
 			for (i = 0; xlocked[i]; i++)
 				g_ptr_array_add (xlocked_array, g_strdup (xlocked[i]));
 
diff --git a/libsecret/secret-service.c b/libsecret/secret-service.c
index 6b3a743..909ab37 100644
--- a/libsecret/secret-service.c
+++ b/libsecret/secret-service.c
@@ -372,7 +372,7 @@ secret_service_real_prompt_finish (SecretService *self,
 		return NULL;
 	}
 
-	return g_variant_ref_sink (retval);
+	return retval;
 }
 
 static void