diff --git a/pkg/grpc/exec/exec.go b/pkg/grpc/exec/exec.go
index 97eb8723ba9..f222ca0f52d 100644
--- a/pkg/grpc/exec/exec.go
+++ b/pkg/grpc/exec/exec.go
@@ -166,7 +166,6 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 
 	process, parent := process.GetParentProcessInternal(event.ProcessKey.Pid, event.ProcessKey.Ktime)
 	if process != nil {
-		process.RefDec()
 		tetragonProcess = process.UnsafeGetProcess()
 	} else {
 		tetragonProcess = &tetragon.Process{
@@ -175,7 +174,6 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 		}
 	}
 	if parent != nil {
-		parent.RefDec()
 		tetragonParent = parent.GetProcessCopy()
 	}
 
@@ -195,7 +193,11 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 		ec.Add(process, tetragonEvent, event.ProcessKey.Ktime, event)
 		return nil
 	}
+	if parent != nil {
+		parent.RefDec()
+	}
 	if process != nil {
+		process.RefDec()
 		tetragonEvent.Process = process.GetProcessCopy()
 	}
 	return tetragonEvent
diff --git a/pkg/grpc/exec/exec_test.go b/pkg/grpc/exec/exec_test.go
index 09654e27b37..88da97dec4e 100644
--- a/pkg/grpc/exec/exec_test.go
+++ b/pkg/grpc/exec/exec_test.go
@@ -764,7 +764,7 @@ func TestGrpcParentRefcntInOrder(t *testing.T) {
 	assert.Equal(t, currentExitEv.Process.Pid.Value, currentPid)
 	assert.Equal(t, currentExitEv.Process.Refcnt, uint32(0))
 	assert.Equal(t, currentExitEv.Parent.Pid.Value, parentPid)
-	assert.Equal(t, currentExitEv.Parent.Refcnt, uint32(1))
+	assert.Equal(t, currentExitEv.Parent.Refcnt, uint32(2))
 
 	// 4th event: exit from parent
 	// 1. should match pid of parent