diff --git a/tests/valgrind.supp b/tests/valgrind.supp
index 31dc984c..cc81dd25 100644
--- a/tests/valgrind.supp
+++ b/tests/valgrind.supp
@@ -201,3 +201,114 @@
    fun:gcry_pk_genkey
    ...
 }
+# NSS
+{
+   Reachable memory from getaddrinfo
+   Memcheck:Leak
+   match-leak-kinds: reachable
+   fun:malloc
+   fun:malloc
+   fun:strdup
+   fun:_dl_load_cache_lookup
+   fun:_dl_map_object
+   fun:dl_open_worker_begin
+   fun:_dl_catch_exception
+   fun:dl_open_worker
+   fun:_dl_catch_exception
+   fun:_dl_open
+   fun:do_dlopen
+   fun:_dl_catch_exception
+   fun:_dl_catch_error
+   fun:dlerror_run
+   fun:__libc_dlopen_mode
+   fun:module_load
+   fun:__nss_module_get_function
+   fun:getaddrinfo
+   ...
+   fun:krb5_sname_to_principal
+   ...
+   fun:gss_init_sec_context
+   fun:ssh_packet_userauth_gssapi_response
+   fun:ssh_packet_process
+   fun:ssh_packet_socket_callback
+   fun:ssh_socket_pollcallback
+   fun:ssh_poll_ctx_dopoll
+   fun:ssh_handle_packets
+   fun:ssh_handle_packets_termination
+   fun:ssh_userauth_get_response
+   fun:ssh_userauth_gssapi
+   fun:torture_gssapi_auth_server_identity
+   ...
+   fun:_cmocka_run_group_tests
+   fun:torture_run_tests
+   fun:main
+}
+
+{
+   Reachable memory from getaddrinfo
+   Memcheck:Leak
+   match-leak-kinds: reachable
+   fun:malloc
+   fun:UnknownInlinedFun
+   fun:_dl_new_object
+   fun:_dl_map_object_from_fd
+   fun:_dl_map_object
+   fun:dl_open_worker_begin
+   fun:_dl_catch_exception
+   fun:dl_open_worker
+   fun:_dl_catch_exception
+   fun:_dl_open
+   fun:do_dlopen
+   fun:_dl_catch_exception
+   fun:_dl_catch_error
+   fun:dlerror_run
+   fun:__libc_dlopen_mode
+   fun:module_load
+   fun:__nss_module_get_function
+   fun:getaddrinfo
+   ...
+   fun:krb5_sname_to_principal
+   ...
+   fun:gss_init_sec_context
+   fun:ssh_packet_userauth_gssapi_response
+   fun:ssh_packet_process
+   fun:ssh_packet_socket_callback
+   fun:ssh_socket_pollcallback
+   fun:ssh_poll_ctx_dopoll
+   fun:ssh_handle_packets
+   fun:ssh_handle_packets_termination
+   fun:ssh_userauth_get_response
+   fun:ssh_userauth_gssapi
+   fun:torture_gssapi_auth_server_identity
+   ...
+   fun:_cmocka_run_group_tests
+   fun:torture_run_tests
+   fun:main
+}
+
+{
+   Reachable memory from libkrb5
+   Memcheck:Leak
+   match-leak-kinds: reachable
+   fun:malloc
+   fun:k5_hashtab_create
+   ...
+   fun:krb5_cc_new_unique
+   ...
+   fun:gss_accept_sec_context
+   fun:ssh_packet_userauth_gssapi_token_server
+   ...
+   fun:ssh_packet_process
+   fun:ssh_packet_socket_callback
+   fun:ssh_socket_pollcallback
+   fun:ssh_poll_ctx_dopoll
+   ...
+   fun:default_handle_session_cb
+   fun:run_server
+   fun:fork_run_server
+   fun:setup_callback_server
+   ...
+   fun:_cmocka_run_group_tests
+   fun:torture_run_tests
+   fun:main
+}