diff --git a/sys/netipsec/ipsec_offload.c b/sys/netipsec/ipsec_offload.c
index bbf98ac7a67..1ff91ec585c 100644
--- a/sys/netipsec/ipsec_offload.c
+++ b/sys/netipsec/ipsec_offload.c
@@ -386,7 +386,7 @@ ipsec_accel_sa_newkey_impl(struct secasvar *sav)
 
 	TASK_INIT(&tq->install_task, 0, ipsec_accel_sa_newkey_act, tq);
 	tq->sav = sav;
-	tq->install_vnet = curthread->td_vnet;	/* XXXKIB liveness */
+	tq->install_vnet = curthread->td_vnet;
 	taskqueue_enqueue(taskqueue_thread, &tq->install_task);
 }
 
diff --git a/sys/netipsec/key.c b/sys/netipsec/key.c
index 5a3e5727bc2..ad1d6164f15 100644
--- a/sys/netipsec/key.c
+++ b/sys/netipsec/key.c
@@ -8713,6 +8713,9 @@ key_vnet_destroy(void *arg __unused)
 	}
 	SAHTREE_WUNLOCK();
 
+	/* Wait for async work referencing this VNET to finish. */
+	ipsec_accel_sync();
+
 	key_freesah_flushed(&sahdrainq);
 	hashdestroy(V_sphashtbl, M_IPSEC_SP, V_sphash_mask);
 	hashdestroy(V_savhashtbl, M_IPSEC_SA, V_savhash_mask);