diff --git a/metropolis/node/core/consensus/status.go b/metropolis/node/core/consensus/status.go
index a19fa14..992d0ac 100644
--- a/metropolis/node/core/consensus/status.go
+++ b/metropolis/node/core/consensus/status.go
@@ -188,6 +188,7 @@
 	}
 
 	crlW := s.ca.WatchCRL(clPKI)
+	defer crlW.Close()
 	crl, err := crlW.Get(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("could not retrieve initial CRL: %w", err)