diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
index 6993152e7..5dbdc17fb 100644
--- a/daemons/ipa-sam/ipa_sam.c
+++ b/daemons/ipa-sam/ipa_sam.c
@@ -4441,7 +4441,8 @@ static char *sec_key(TALLOC_CTX *mem_ctx, const char *d)
 
 static NTSTATUS save_sid_to_secret(struct ipasam_private *ipasam_state)
 {
-	const char *hostname;
+	char hostname[IPA_HOST_FQDN_LEN];
+	const char *fqdn;
 	char *p;
 	TALLOC_CTX *tmp_ctx;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
@@ -4466,12 +4467,15 @@ static NTSTATUS save_sid_to_secret(struct ipasam_private *ipasam_state)
 		goto done;
 	}
 
-	hostname = ipa_gethostfqdn();
-	if (hostname == NULL) {
+	fqdn = ipa_gethostfqdn();
+	if (fqdn == NULL) {
 		DEBUG(1, ("ipa_gethostfqdn failed.\n"));
 		status = NT_STATUS_UNSUCCESSFUL;
 		goto done;
 	}
+	/* Copy is necessary, otherwise we this will corrupt the static
+	 * buffer returned by ipa_gethostfqdn(). */
+	strncpy(hostname, fqdn, sizeof(hostname));
 	p = strchr(hostname, '.');
 	if (p != NULL) {
 		*p = '\0';
diff --git a/util/ipa_hostname.h b/util/ipa_hostname.h
index f98da69a4..0cda02219 100644
--- a/util/ipa_hostname.h
+++ b/util/ipa_hostname.h
@@ -11,5 +11,12 @@
  */
 #define IPA_HOST_FQDN_LEN 255
 
+/* Get the host FQDN.
+ *
+ * Returns a null-terminated static char[].  The string length is
+ * at most IPA_HOST_FQDN_LEN - 1.  The caller MUST NOT modify this
+ * buffer.  If modification could occur, the caller MUST copy
+ * the string.
+ */
 const char*
 ipa_gethostfqdn(void);