diff --git a/internal/cache/backend.go b/internal/cache/backend.go
index 9f545f309..827a25341 100644
--- a/internal/cache/backend.go
+++ b/internal/cache/backend.go
@@ -127,6 +127,7 @@ func (b *Backend) cacheFile(ctx context.Context, h restic.Handle) error {
 	}
 
 	if err = b.Cache.Save(h, rd); err != nil {
+		_ = rd.Close()
 		return err
 	}
 
diff --git a/internal/checker/checker.go b/internal/checker/checker.go
index 3348ddaa8..f1b94a170 100644
--- a/internal/checker/checker.go
+++ b/internal/checker/checker.go
@@ -637,6 +637,7 @@ func checkPack(ctx context.Context, r restic.Repository, id restic.ID) error {
 
 	packfile, err := fs.TempFile("", "restic-temp-check-")
 	if err != nil {
+		_ = rd.Close()
 		return errors.Wrap(err, "TempFile")
 	}
 
@@ -648,6 +649,7 @@ func checkPack(ctx context.Context, r restic.Repository, id restic.ID) error {
 	hrd := hashing.NewReader(rd, sha256.New())
 	size, err := io.Copy(packfile, hrd)
 	if err != nil {
+		_ = rd.Close()
 		return errors.Wrap(err, "Copy")
 	}
 
diff --git a/internal/repository/repack.go b/internal/repository/repack.go
index 6ef0bebec..3572b9411 100644
--- a/internal/repository/repack.go
+++ b/internal/repository/repack.go
@@ -40,6 +40,7 @@ func Repack(ctx context.Context, repo restic.Repository, packs restic.IDSet, kee
 		hrd := hashing.NewReader(beRd, sha256.New())
 		packLength, err := io.Copy(tempfile, hrd)
 		if err != nil {
+			_ = beRd.Close()
 			return nil, errors.Wrap(err, "Copy")
 		}