diff --git a/gerrit-pgm/src/main/java/com/google/gerrit/pgm/SwitchSecureStore.java b/gerrit-pgm/src/main/java/com/google/gerrit/pgm/SwitchSecureStore.java
index ac84e82..280795a2 100644
--- a/gerrit-pgm/src/main/java/com/google/gerrit/pgm/SwitchSecureStore.java
+++ b/gerrit-pgm/src/main/java/com/google/gerrit/pgm/SwitchSecureStore.java
@@ -163,20 +163,21 @@
 
   private String getNewSecureStoreClassName(Path secureStore)
       throws IOException {
-    JarScanner scanner = new JarScanner(secureStore);
-    List<String> newSecureStores =
-        scanner.findSubClassesOf(SecureStore.class);
-    if (newSecureStores.isEmpty()) {
-      throw new RuntimeException(String.format(
-          "Cannot find implementation of SecureStore interface in %s",
-          secureStore.toAbsolutePath()));
+    try (JarScanner scanner = new JarScanner(secureStore)) {
+      List<String> newSecureStores =
+          scanner.findSubClassesOf(SecureStore.class);
+      if (newSecureStores.isEmpty()) {
+        throw new RuntimeException(String.format(
+            "Cannot find implementation of SecureStore interface in %s",
+            secureStore.toAbsolutePath()));
+      }
+      if (newSecureStores.size() > 1) {
+        throw new RuntimeException(String.format(
+            "Found too many implementations of SecureStore:\n%s\nin %s", Joiner
+                .on("\n").join(newSecureStores), secureStore.toAbsolutePath()));
+      }
+      return Iterables.getOnlyElement(newSecureStores);
     }
-    if (newSecureStores.size() > 1) {
-      throw new RuntimeException(String.format(
-          "Found too many implementations of SecureStore:\n%s\nin %s", Joiner
-              .on("\n").join(newSecureStores), secureStore.toAbsolutePath()));
-    }
-    return Iterables.getOnlyElement(newSecureStores);
   }
 
   private String getCurrentSecureStoreClassName(SitePaths sitePaths) {
diff --git a/gerrit-pgm/src/main/java/com/google/gerrit/pgm/init/BaseInit.java b/gerrit-pgm/src/main/java/com/google/gerrit/pgm/init/BaseInit.java
index 8ccdebc..1668387 100644
--- a/gerrit-pgm/src/main/java/com/google/gerrit/pgm/init/BaseInit.java
+++ b/gerrit-pgm/src/main/java/com/google/gerrit/pgm/init/BaseInit.java
@@ -310,13 +310,12 @@
       return null;
     }
 
-    try {
-      Path secureStoreLib = Paths.get(secureStore);
-      if (!Files.exists(secureStoreLib)) {
-        throw new InvalidSecureStoreException(String.format(
-            "File %s doesn't exist", secureStore));
-      }
-      JarScanner scanner = new JarScanner(secureStoreLib);
+    Path secureStoreLib = Paths.get(secureStore);
+    if (!Files.exists(secureStoreLib)) {
+      throw new InvalidSecureStoreException(String.format(
+          "File %s doesn't exist", secureStore));
+    }
+    try (JarScanner scanner = new JarScanner(secureStoreLib)) {
       List<String> secureStores =
           scanner.findSubClassesOf(SecureStore.class);
       if (secureStores.isEmpty()) {
diff --git a/gerrit-server/src/main/java/com/google/gerrit/server/plugins/JarScanner.java b/gerrit-server/src/main/java/com/google/gerrit/server/plugins/JarScanner.java
index 3dc4c0b..db564cc 100644
--- a/gerrit-server/src/main/java/com/google/gerrit/server/plugins/JarScanner.java
+++ b/gerrit-server/src/main/java/com/google/gerrit/server/plugins/JarScanner.java
@@ -53,7 +53,7 @@
 import java.util.jar.JarFile;
 import java.util.jar.Manifest;
 
-public class JarScanner implements PluginContentScanner {
+public class JarScanner implements PluginContentScanner, AutoCloseable {
   private static final int SKIP_ALL = ClassReader.SKIP_CODE
       | ClassReader.SKIP_DEBUG | ClassReader.SKIP_FRAMES;
   private final JarFile jarFile;
@@ -131,6 +131,11 @@
     return findSubClassesOf(superClass.getName());
   }
 
+  @Override
+  public void close() throws IOException {
+    jarFile.close();
+  }
+
   private List<String> findSubClassesOf(String superClass) throws IOException {
     String name = superClass.replace('.', '/');