diff --git a/src/libvlr/vlr.c b/src/libvlr/vlr.c
index 4ef52da4e..59eb37d2f 100644
--- a/src/libvlr/vlr.c
+++ b/src/libvlr/vlr.c
@@ -973,8 +973,12 @@ void vlr_subscr_conn_timeout(struct vlr_subscr *vsub)
 	if (!vsub)
 		return;
 
-	vlr_loc_update_conn_timeout(vsub->lu_fsm);
-	vlr_parq_conn_timeout(vsub->proc_arq_fsm);
+	vlr_subscr_get(vsub);
+	if (vsub->lu_fsm)
+		vlr_loc_update_conn_timeout(vsub->lu_fsm);
+	if (vsub->proc_arq_fsm)
+		vlr_parq_conn_timeout(vsub->proc_arq_fsm);
+	vlr_subscr_put(vsub);
 }
 
 struct vlr_instance *vlr_alloc(void *ctx, const struct vlr_ops *ops)
diff --git a/tests/msc_vlr/msc_vlr_test_hlr_timeout.err b/tests/msc_vlr/msc_vlr_test_hlr_timeout.err
index 4caaf1e1a..8ca29918f 100644
--- a/tests/msc_vlr/msc_vlr_test_hlr_timeout.err
+++ b/tests/msc_vlr/msc_vlr_test_hlr_timeout.err
@@ -46,6 +46,7 @@ DREF IMSI:901700000004620: MSC conn use - 1 == 1
   llist_count(&net->subscr_conns) == 1
 - Total time passed: 5.001598 s
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_NEW}: Timeout of T0
+DREF VLR subscr IMSI:901700000004620 usage increases to: 2
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Connection timed out
 - sending LU Reject for IMSI:901700000004620, cause 22
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_DONE
@@ -67,10 +68,11 @@ DMM msc_subscr_conn_close(vsub=IMSI:901700000004620, cause=2): no conn fsm, rele
 - BSSAP Clear --RAN_GERAN_A--> MS
 DREF IMSI:901700000004620: MSC conn use - 1 == 0
 DRLL subscr IMSI:901700000004620: Freeing subscriber connection
-DREF VLR subscr IMSI:901700000004620 usage decreases to: 0
-DREF freeing VLR subscr IMSI:901700000004620
+DREF VLR subscr IMSI:901700000004620 usage decreases to: 1
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing instance
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
+DREF VLR subscr IMSI:901700000004620 usage decreases to: 0
+DREF freeing VLR subscr IMSI:901700000004620
 - SUBSCR_CONN_TIMEOUT has passed, conn is gone.
   bssap_clear_sent == 1
   llist_count(&net->subscr_conns) == 0
@@ -146,6 +148,7 @@ DREF VLR subscr MSISDN:46071 usage decreases to: 1
   lu_result_sent == 0
 - Total time passed: 5.001598 s
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_NEW}: Timeout of T0
+DREF VLR subscr MSISDN:46071 usage increases to: 2
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_HLR_UPD}: Connection timed out
 - sending LU Reject for MSISDN:46071, cause 22
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_HLR_UPD}: state_chg to VLR_ULA_S_DONE
@@ -167,10 +170,11 @@ DMM msc_subscr_conn_close(vsub=MSISDN:46071, cause=2): no conn fsm, releasing di
 - BSSAP Clear --RAN_GERAN_A--> MS
 DREF MSISDN:46071: MSC conn use - 1 == 0
 DRLL subscr MSISDN:46071: Freeing subscriber connection
-DREF VLR subscr MSISDN:46071 usage decreases to: 0
-DREF freeing VLR subscr MSISDN:46071
+DREF VLR subscr MSISDN:46071 usage decreases to: 1
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing instance
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
+DREF VLR subscr MSISDN:46071 usage decreases to: 0
+DREF freeing VLR subscr MSISDN:46071
 - SUBSCR_CONN_TIMEOUT has passed, conn is gone.
   bssap_clear_sent == 1
   llist_count(&net->subscr_conns) == 0
diff --git a/tests/msc_vlr/msc_vlr_test_ms_timeout.err b/tests/msc_vlr/msc_vlr_test_ms_timeout.err
index 47af3596f..df34b86ef 100644
--- a/tests/msc_vlr/msc_vlr_test_ms_timeout.err
+++ b/tests/msc_vlr/msc_vlr_test_ms_timeout.err
@@ -66,6 +66,7 @@ DREF VLR subscr IMSI:901700000004620 usage decreases to: 1
   lu_result_sent == 0
 - Total time passed: 5.001598 s
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_NEW}: Timeout of T0
+DREF VLR subscr IMSI:901700000004620 usage increases to: 2
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: Connection timed out
 - sending LU Reject for IMSI:901700000004620, cause 22
 DVLR vlr_lu_fsm(901700000004620){VLR_ULA_S_WAIT_AUTH}: state_chg to VLR_ULA_S_DONE
@@ -87,10 +88,11 @@ DMM msc_subscr_conn_close(vsub=IMSI:901700000004620, cause=2): no conn fsm, rele
 - BSSAP Clear --RAN_GERAN_A--> MS
 DREF IMSI:901700000004620: MSC conn use - 1 == 0
 DRLL subscr IMSI:901700000004620: Freeing subscriber connection
-DREF VLR subscr IMSI:901700000004620 usage decreases to: 0
-DREF freeing VLR subscr IMSI:901700000004620
+DREF VLR subscr IMSI:901700000004620 usage decreases to: 1
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing instance
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
+DREF VLR subscr IMSI:901700000004620 usage decreases to: 0
+DREF freeing VLR subscr IMSI:901700000004620
 - SUBSCR_CONN_TIMEOUT has passed, conn is gone.
   bssap_clear_sent == 1
   llist_count(&net->subscr_conns) == 0
@@ -298,6 +300,7 @@ DREF MSISDN:46071: MSC conn use - 1 == 1
   cm_service_result_sent == 0
 - Total time passed: 5.001598 s
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_NEW}: Timeout of T0
+DREF VLR subscr MSISDN:46071 usage increases to: 3
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: Connection timed out
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: proc_arq_fsm_done(VLR_PR_ARQ_RES_TIMEOUT)
 DVLR Process_Access_Request_VLR(901700000004620){PR_ARQ_S_WAIT_AUTH}: state_chg to PR_ARQ_S_DONE
@@ -320,9 +323,10 @@ DMM msc_subscr_conn_close(vsub=MSISDN:46071, cause=2): no conn fsm, releasing di
 - BSSAP Clear --RAN_GERAN_A--> MS
 DREF MSISDN:46071: MSC conn use - 1 == 0
 DRLL subscr MSISDN:46071: Freeing subscriber connection
-DREF VLR subscr MSISDN:46071 usage decreases to: 1
+DREF VLR subscr MSISDN:46071 usage decreases to: 2
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Freeing instance
 DMM Subscr_Conn(901700000004620){SUBSCR_CONN_S_RELEASED}: Deallocated
+DREF VLR subscr MSISDN:46071 usage decreases to: 1
 - SUBSCR_CONN_TIMEOUT has passed, conn is gone.
   bssap_clear_sent == 1
   llist_count(&net->subscr_conns) == 0