diff --git a/lib/nss.c b/lib/nss.c
index 503f97e6..1aa27f3e 100644
--- a/lib/nss.c
+++ b/lib/nss.c
@@ -86,58 +86,50 @@ void nss_init(const char *nsswitch_path) {
 	if (token == NULL) {
 		fprintf(shadow_logfd, "No usable subid NSS module found, using files\n");
 		// subid_nss has to be null here, but to ease reviews:
-		free(subid_nss);
-		subid_nss = NULL;
-		goto done;
+		goto null_subid;
 	}
 	if (strcmp(token, "files") == 0) {
-		subid_nss = NULL;
-		goto done;
+		goto null_subid;
 	}
 	if (strlen(token) > 50) {
 		fprintf(shadow_logfd, "Subid NSS module name too long (longer than 50 characters): %s\n", token);
 		fprintf(shadow_logfd, "Using files\n");
-		subid_nss = NULL;
-		goto done;
+		goto null_subid;
 	}
 	snprintf(libname, 64,  "libsubid_%s.so", token);
 	h = dlopen(libname, RTLD_LAZY);
 	if (!h) {
 		fprintf(shadow_logfd, "Error opening %s: %s\n", libname, dlerror());
 		fprintf(shadow_logfd, "Using files\n");
-		subid_nss = NULL;
-		goto done;
+		goto null_subid;
 	}
 	subid_nss = MALLOC(struct subid_nss_ops);
 	if (!subid_nss) {
-		dlclose(h);
-		goto done;
+		goto close_lib;
 	}
 	subid_nss->has_range = dlsym(h, "shadow_subid_has_range");
 	if (!subid_nss->has_range) {
 		fprintf(shadow_logfd, "%s did not provide @has_range@\n", libname);
-		dlclose(h);
-		free(subid_nss);
-		subid_nss = NULL;
-		goto done;
+		goto close_lib;
 	}
 	subid_nss->list_owner_ranges = dlsym(h, "shadow_subid_list_owner_ranges");
 	if (!subid_nss->list_owner_ranges) {
 		fprintf(shadow_logfd, "%s did not provide @list_owner_ranges@\n", libname);
-		dlclose(h);
-		free(subid_nss);
-		subid_nss = NULL;
-		goto done;
+		goto close_lib;
 	}
 	subid_nss->find_subid_owners = dlsym(h, "shadow_subid_find_subid_owners");
 	if (!subid_nss->find_subid_owners) {
 		fprintf(shadow_logfd, "%s did not provide @find_subid_owners@\n", libname);
-		dlclose(h);
-		free(subid_nss);
-		subid_nss = NULL;
-		goto done;
+		goto close_lib;
 	}
 	subid_nss->handle = h;
+	goto done;
+
+close_lib:
+	dlclose(h);
+	free(subid_nss);
+null_subid:
+	subid_nss = NULL;
 
 done:
 	atomic_store(&nss_init_completed, true);