diff --git a/src/crypto/crypto_keygen.cc b/src/crypto/crypto_keygen.cc
index af489967144d32..684cf8033e72f4 100644
--- a/src/crypto/crypto_keygen.cc
+++ b/src/crypto/crypto_keygen.cc
@@ -54,8 +54,7 @@ EVPKeyCtxPointer NidKeyPairGenTraits::Setup(NidKeyPairGenConfig* params) {
 }
 
 void SecretKeyGenConfig::MemoryInfo(MemoryTracker* tracker) const {
-  if (out != nullptr)
-    tracker->TrackFieldWithSize("out", length);
+  if (out) tracker->TrackFieldWithSize("out", length);
 }
 
 Maybe<bool> SecretKeyGenTraits::AdditionalConfig(
@@ -80,18 +79,17 @@ KeyGenJobStatus SecretKeyGenTraits::DoKeyGen(
     Environment* env,
     SecretKeyGenConfig* params) {
   CHECK_LE(params->length, INT_MAX);
-  params->out = MallocOpenSSL<char>(params->length);
-  EntropySource(reinterpret_cast<unsigned char*>(params->out), params->length);
+  ByteSource::Builder bytes(params->length);
+  EntropySource(bytes.data<unsigned char>(), params->length);
+  params->out = std::move(bytes).release();
   return KeyGenJobStatus::OK;
 }
 
-Maybe<bool> SecretKeyGenTraits::EncodeKey(
-    Environment* env,
-    SecretKeyGenConfig* params,
-    Local<Value>* result) {
-  ByteSource out = ByteSource::Allocated(params->out, params->length);
+Maybe<bool> SecretKeyGenTraits::EncodeKey(Environment* env,
+                                          SecretKeyGenConfig* params,
+                                          Local<Value>* result) {
   std::shared_ptr<KeyObjectData> data =
-      KeyObjectData::CreateSecret(std::move(out));
+      KeyObjectData::CreateSecret(std::move(params->out));
   return Just(KeyObjectHandle::Create(env, data).ToLocal(result));
 }
 
diff --git a/src/crypto/crypto_keygen.h b/src/crypto/crypto_keygen.h
index ed7d5c0601fff1..c9c1b3e5ffbb8c 100644
--- a/src/crypto/crypto_keygen.h
+++ b/src/crypto/crypto_keygen.h
@@ -201,7 +201,7 @@ struct KeyPairGenTraits final {
 
 struct SecretKeyGenConfig final : public MemoryRetainer {
   size_t length;        // In bytes.
-  char* out = nullptr;  // Placeholder for the generated key bytes.
+  ByteSource out;       // Placeholder for the generated key bytes.
 
   void MemoryInfo(MemoryTracker* tracker) const override;
   SET_MEMORY_INFO_NAME(SecretKeyGenConfig)