diff --git a/rcl/include/rcl/security_directory.h b/rcl/include/rcl/security_directory.h
index c9292a613..e3d8b52f7 100644
--- a/rcl/include/rcl/security_directory.h
+++ b/rcl/include/rcl/security_directory.h
@@ -51,9 +51,10 @@ extern "C"
  * \param[in] node_namespace validated, absolute namespace (starting with "/")
  * \param[in] allocator the allocator to use for allocation
  * \returns machine specific (absolute) node secure root path or NULL on failure
+ *          returned pointer must be deallocated by the caller of this function
  */
 RCL_PUBLIC
-const char * rcl_get_secure_root(
+char * rcl_get_secure_root(
   const char * node_name,
   const char * node_namespace,
   const rcl_allocator_t * allocator
diff --git a/rcl/src/rcl/node.c b/rcl/src/rcl/node.c
index 19cdf5dc1..2a31abe33 100644
--- a/rcl/src/rcl/node.c
+++ b/rcl/src/rcl/node.c
@@ -126,6 +126,7 @@ rcl_node_init(
   rcl_ret_t ret;
   rcl_ret_t fail_ret = RCL_RET_ERROR;
   char * remapped_node_name = NULL;
+  char * node_secure_root = NULL;
 
   // Check options and allocator first, so allocator can be used for errors.
   RCL_CHECK_ARGUMENT_FOR_NULL(options, RCL_RET_INVALID_ARGUMENT);
@@ -306,7 +307,7 @@ rcl_node_init(
     node_security_options.enforce_security = RMW_SECURITY_ENFORCEMENT_PERMISSIVE;
   } else {  // if use_security
     // File discovery magic here
-    const char * node_secure_root = rcl_get_secure_root(name, local_namespace_, allocator);
+    node_secure_root = rcl_get_secure_root(name, local_namespace_, allocator);
     if (node_secure_root) {
       RCUTILS_LOG_INFO_NAMED(ROS_PACKAGE_NAME, "Found security directory: %s", node_secure_root);
       node_security_options.security_root_path = node_secure_root;
@@ -408,6 +409,7 @@ rcl_node_init(
   if (NULL != remapped_node_name) {
     allocator->deallocate(remapped_node_name, allocator->state);
   }
+  allocator->deallocate(node_secure_root, allocator->state);
   return ret;
 }
 
diff --git a/rcl/src/rcl/security_directory.c b/rcl/src/rcl/security_directory.c
index 8d654520f..6559eb824 100644
--- a/rcl/src/rcl/security_directory.c
+++ b/rcl/src/rcl/security_directory.c
@@ -173,7 +173,7 @@ char * prefix_match_lookup(
   return node_secure_root;
 }
 
-const char * rcl_get_secure_root(
+char * rcl_get_secure_root(
   const char * node_name,
   const char * node_namespace,
   const rcl_allocator_t * allocator)