diff --git a/src/scheduler/src/core.c b/src/scheduler/src/core.c
index 6d888c98..b86b3017 100644
--- a/src/scheduler/src/core.c
+++ b/src/scheduler/src/core.c
@@ -3,6 +3,7 @@
 #include <stdlib.h>
 #include <string.h>
 
+#include "controller.capnp.h"
 #include "core.h"
 #include "decision.h"
 #include "group.h"
@@ -253,6 +254,11 @@ void xce_sched_core_fini(xce_sched_core_t* core)
 
     resreq_fini();
 
+    /* bug-1884: the core owns the config it was last given (a CONFIG_PUSH,
+     * sched_init_config() or a snapshot load); freed last, after the
+     * plugins and group managers that may point into it. */
+    free_Conf4Sched_ptr(&(core->config));
+
     mylock_fini(&(core->lock));
 
     return;
diff --git a/src/scheduler/src/sim.c b/src/scheduler/src/sim.c
index af0a7c63..ff8bfda0 100644
--- a/src/scheduler/src/sim.c
+++ b/src/scheduler/src/sim.c
@@ -281,17 +281,14 @@ static int sim_locate_and_load_snapshot(xce_sched_sim_driver_t* sim,
         return rc;
     }
 
-    /* `best` (specifically best.data->config) is NOT freed on success:
-     * xce_sched_core_load_snapshot() aliases `core->config = in->config`
-     * (a borrowed-reference assignment, not a deep copy -- core.h/
-     * snapshot_load.c's own documented "config -- borrowed reference"
-     * choice) -- core->config now points at the SAME memory as
-     * best.data->config. Freeing `best` here would immediately dangle
-     * `sim->core.config`. Same "no free-snapshot function, deliberate
-     * accepted leak of the non-aliased remainder" precedent
-     * recording.c's write_snapshot_entry() already documents for the
-     * identical save-side ownership shape (detect_leaks=0 across this
-     * whole test suite, by design). */
+    /* xce_sched_core_load_snapshot() keeps best.data->config as
+     * core->config (a borrowed reference, snapshot_load.c) and copies
+     * everything else. bug-1884: hand the config to the core, which frees
+     * it in xce_sched_core_fini(), and free the rest of the entry. */
+    if (best.data != NULL) {
+        best.data->config = NULL;
+    }
+    free_SnapshotEntry(&best);
 
     /* Read from `best_ts` (captured while the message's own capn arena was
      * still live), never by re-reading `sp` here -- the capn_free(&c) call