diff --git a/changes/feature25150 b/changes/feature25150
new file mode 100644
index 0000000000..eb65327a8d
--- /dev/null
+++ b/changes/feature25150
@@ -0,0 +1,4 @@
+  o Minor features (performance, allocation):
+    - Avoid a needless malloc()/free() pair every time we handle an ntor
+      handshake. Closes ticket 25150.
+
diff --git a/src/or/onion.c b/src/or/onion.c
index bd80c2f503..4fc5013835 100644
--- a/src/or/onion.c
+++ b/src/or/onion.c
@@ -563,20 +563,19 @@ onion_skin_server_handshake(int type,
       return -1;
     {
       size_t keys_tmp_len = keys_out_len + DIGEST_LEN;
-      uint8_t *keys_tmp = tor_malloc(keys_out_len + DIGEST_LEN);
+      uint8_t keys_tmp[keys_tmp_len];
 
       if (onion_skin_ntor_server_handshake(
                                    onion_skin, keys->curve25519_key_map,
                                    keys->junk_keypair,
                                    keys->my_identity,
                                    reply_out, keys_tmp, keys_tmp_len)<0) {
-        tor_free(keys_tmp);
+        /* no need to memwipe here, since the output will never be used */
         return -1;
       }
       memcpy(keys_out, keys_tmp, keys_out_len);
       memcpy(rend_nonce_out, keys_tmp+keys_out_len, DIGEST_LEN);
       memwipe(keys_tmp, 0, keys_tmp_len);
-      tor_free(keys_tmp);
       r = NTOR_REPLY_LEN;
     }
     break;