diff --git a/src/shrpx_config.cc b/src/shrpx_config.cc
index e37d84c7..ae262557 100644
--- a/src/shrpx_config.cc
+++ b/src/shrpx_config.cc
@@ -2182,7 +2182,9 @@ int parse_config(Config *config, int optid, const StringRef &opt,
       return -1;
     }
 
-    config->tls.subcerts.emplace_back(private_key_file.str(), cert_file.str());
+    config->tls.subcerts.emplace_back(
+        make_string_ref(config->balloc, private_key_file),
+        make_string_ref(config->balloc, cert_file));
 
     return 0;
   }
diff --git a/src/shrpx_config.h b/src/shrpx_config.h
index e1905d45..54f8275b 100644
--- a/src/shrpx_config.h
+++ b/src/shrpx_config.h
@@ -522,7 +522,7 @@ struct TLSConfig {
   } client;
 
   // The list of (private key file, certificate file) pair
-  std::vector<std::pair<std::string, std::string>> subcerts;
+  std::vector<std::pair<StringRef, StringRef>> subcerts;
   std::vector<unsigned char> alpn_prefs;
   // list of supported NPN/ALPN protocol strings in the order of
   // preference.