diff --git a/include/hash_index.h b/include/hash_index.h
index a5f8d2a4a..25646e201 100644
--- a/include/hash_index.h
+++ b/include/hash_index.h
@@ -38,6 +38,10 @@ typedef struct {
  * If an existing hash index file is provided via 'hashes_filename', this will
  * be used instead of building a new index.
  *
+ * If creating the hash index succeeded, the ownership of the provided file
+ * descriptor must be 'transferred' to the hash index by manually setting the
+ * provided file descriptor to -1!
+ *
  * @param label label for hash index (used for debugging/identification)
  * @param data_fd open file descriptor of file to hash
  * @param hashes_filename name of existing hash index file to use instead, or NULL
diff --git a/src/bundle.c b/src/bundle.c
index d15277567..1c5ae7a7a 100644
--- a/src/bundle.c
+++ b/src/bundle.c
@@ -422,13 +422,16 @@ static gboolean generate_adaptive_data(RaucManifest *manifest, const gchar *dir,
 					g_close(fd, NULL);
 					return FALSE;
 				}
+				fd = -1; /* belongs to idx now */
 
 				if (!r_hash_index_export(index, indexpath, &ierror)) {
 					g_propagate_prefixed_error(
 							error,
 							ierror,
 							"Failed to write hash index for %s: ", image->filename);
-					g_close(fd, NULL);
+					if (fd >= 0) {
+						g_close(fd, NULL);
+					}
 					return FALSE;
 				}