diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c
index 9b877a9..9a8d661 100644
--- a/libraries/libldap/init.c
+++ b/libraries/libldap/init.c
@@ -473,7 +473,7 @@ static void openldap_ldap_init_w_env(
  * Sorry, don't know how to handle this for non-GCC environments.
  */
 static void ldap_int_destroy_global_options(void)
-	__attribute__ ((destructor));
+	__attribute__ ((destructor (2)));
 #endif
 
 static void
diff --git a/libraries/libldap/tls_m.c b/libraries/libldap/tls_m.c
index 7f92783..f6c27de 100644
--- a/libraries/libldap/tls_m.c
+++ b/libraries/libldap/tls_m.c
@@ -1951,6 +1951,18 @@ tlsm_clientauth_init( tlsm_ctx *ctx )
 	return ( status == SECSuccess ? 0 : -1 );
 }
 
+#if defined(__GNUC__)
+static void
+tlsm_destroy_on_unload(void) __attribute__ ((destructor (1)));
+
+static void
+tlsm_destroy_on_unload(void)
+{
+	if (NSS_IsInitialized())
+		NSS_UnregisterShutdown(tlsm_nss_shutdown_cb, NULL);
+}
+#endif
+
 /*
  * Tear down the TLS subsystem. Should only be called once.
  */