diff --git a/nonce.cabal b/nonce.cabal
--- a/nonce.cabal
+++ b/nonce.cabal
@@ -1,5 +1,5 @@
 name:                nonce
-version:             1.0.4
+version:             1.0.5
 synopsis:            Generate cryptographic nonces.
 homepage:            https://github.com/prowdsponsor/nonce
 license:             BSD3
@@ -34,6 +34,8 @@
     , text              >= 0.9
     , transformers      >= 0.2
     , entropy           >= 0.3.7 && < 0.4
+    , unliftio
+    , unliftio-core
   hs-source-dirs: src/
   default-language: Haskell2010
   ghc-options: -Wall
diff --git a/src/Crypto/Nonce.hs b/src/Crypto/Nonce.hs
--- a/src/Crypto/Nonce.hs
+++ b/src/Crypto/Nonce.hs
@@ -25,6 +25,8 @@
 module Crypto.Nonce
   ( Generator
   , new
+  , delete
+  , withGenerator
   , nonce128
   , nonce128url
   , nonce128urlT
@@ -34,6 +36,8 @@
 import Control.Monad.IO.Class (MonadIO, liftIO)
 import qualified System.Entropy as Entropy
 import Data.Typeable (Typeable)
+import Control.Monad.IO.Unlift (MonadUnliftIO)
+import UnliftIO.Exception (bracket)
 
 import qualified Data.ByteString as B
 import qualified Data.ByteString.Base64.URL as B64URL
@@ -42,7 +46,7 @@
 
 
 -- | An encapsulated nonce generator.
-data Generator = G Entropy.CryptHandle
+newtype Generator = G Entropy.CryptHandle
   deriving (Typeable)
 
 instance Show Generator where
@@ -52,6 +56,22 @@
 -- | Create a new nonce generator using the system entropy.
 new :: MonadIO m => m Generator
 new = liftM G . liftIO $ Entropy.openHandle
+
+
+-- | Release the given generator's resources. The generator won't be
+-- usable afterwards.
+delete :: MonadIO m => Generator -> m ()
+delete (G v) = liftIO $ Entropy.closeHandle v
+
+
+-- | An exception-safe convenience function.
+--
+-- @
+-- withGenerator = bracket new delete
+-- @
+--
+withGenerator :: MonadUnliftIO m => (Generator -> m a) -> m a
+withGenerator = bracket new delete
 
 
 -- | (Internal) Generate the given number of bytes from the DRG.