diff --git a/gnutls.cabal b/gnutls.cabal
--- a/gnutls.cabal
+++ b/gnutls.cabal
@@ -1,5 +1,5 @@
 name: gnutls
-version: 0.1.3
+version: 0.1.4
 license: GPL-3
 license-file: license.txt
 author: John Millikin <jmillikin@gmail.com>
@@ -26,7 +26,7 @@
 source-repository this
   type: bazaar
   location: https://john-millikin.com/branches/haskell-gnutls/0.1/
-  tag: haskell-gnutls_0.1.3
+  tag: haskell-gnutls_0.1.4
 
 library
   hs-source-dirs: lib
@@ -34,7 +34,7 @@
 
   build-depends:
       base >= 4.0 && < 5.0
-    , bytestring >= 0.9 && < 0.10
+    , bytestring >= 0.9
     , transformers >= 0.2
     , monads-tf >= 0.1 && < 0.2
 
diff --git a/lib/Network/Protocol/TLS/GNU.hs b/lib/Network/Protocol/TLS/GNU.hs
--- a/lib/Network/Protocol/TLS/GNU.hs
+++ b/lib/Network/Protocol/TLS/GNU.hs
@@ -51,6 +51,7 @@
 import qualified Data.ByteString as B
 import qualified Data.ByteString.Lazy as BL
 import qualified Data.ByteString.Unsafe as B
+import           Data.IORef
 import qualified Foreign as F
 import qualified Foreign.C as F
 import           Foreign.Concurrent as FC
@@ -81,6 +82,15 @@
 data Session = Session
 	{ sessionPtr :: F.ForeignPtr F.Session
 	, sessionGlobalState :: GlobalState
+	
+	-- TLS credentials are not copied into the gnutls session struct,
+	-- so pointers to them must be kept alive until the credentials
+	-- are no longer needed.
+	--
+	-- TODO: Have some way to mark credentials as no longer needed.
+	--       The current code just keeps them alive for the duration
+	--       of the session, which may be excessive.
+	, sessionCredentials :: IORef [F.ForeignPtr F.Credentials]
 	}
 
 newtype TLS a = TLS { unTLS :: ErrorT Error (R.ReaderT Session IO) a }
@@ -123,11 +133,12 @@
 		F.gnutls_transport_set_push_function session push
 		F.gnutls_transport_set_pull_function session pull
 		_ <- F.gnutls_set_default_priority session
+		creds <- newIORef []
 		fp <- FC.newForeignPtr ptr $ do
 			F.gnutls_deinit session
 			F.freeHaskellFunPtr push
 			F.freeHaskellFunPtr pull
-		return $ Session fp global
+		return (Session fp global creds)
 
 getSession :: TLS Session
 getSession = TLS R.ask
@@ -211,7 +222,11 @@
 	rc <- withSession $ \s ->
 		F.withForeignPtr fp $ \ptr -> do
 		F.gnutls_credentials_set s ctype ptr
-	checkRC rc
+	
+	s <- getSession
+	if F.unRC rc == 0
+		then liftIO (atomicModifyIORef (sessionCredentials s) (\creds -> (fp:creds, ())))
+		else checkRC rc
 
 certificateCredentials :: TLS Credentials
 certificateCredentials = do