diff --git a/CHANGES b/CHANGES
index 948c4fa0cf4145637ed2dd0a42e7aeb0c83716f2..45a05fffa098929f8634e5ae2ac2e6e93739811a 100644
--- a/CHANGES
+++ b/CHANGES
@@ -6,7 +6,8 @@ OpenLDAP 2.4.6 Engineering
 	Fixed slapd alock_close with Quick mode (ITS#5129)
 	Fixed slapd ordered values add normalization issue (ITS#5136)
 	Fixed slapd-bdb/hdb suffix logging (ITS#5128)
-	Fixed slapd-ldap SASL idassert w/o autchId
+	Fixed slapd-ldap SASL idassert w/o authcId
+	Fixed slapd-meta conn caching on bind failure (ITS#5154)
 	Fixed slapo-chain double-free (ITS#5137)
 	Fixed slapo-dynlist entry release (ITS#5135)
 	Fixed slapo-rwm modlist handling (ITS#5124)
diff --git a/servers/slapd/back-meta/bind.c b/servers/slapd/back-meta/bind.c
index bae5a477829799959517cfca5f2ea6072803a2b7..ebd537409f1f68a531cbd67287affb5f57b8e9fd 100644
--- a/servers/slapd/back-meta/bind.c
+++ b/servers/slapd/back-meta/bind.c
@@ -189,6 +189,10 @@ meta_back_bind( Operation *op, SlapReply *rs )
 
 		if ( lerr != LDAP_SUCCESS ) {
 			rc = rs->sr_err = lerr;
+			/* Mark the meta_conn struct as tainted so
+			 * it'll be freed by meta_conn_back_destroy below */
+			LDAP_BACK_CONN_TAINTED_SET( mc );
+
 			/* FIXME: in some cases (e.g. unavailable)
 			 * do not assume it's not candidate; rather
 			 * mark this as an error to be eventually