diff --git a/sdk/include/thread_pool.h b/sdk/include/thread_pool.h
index 7ff9ba1..0dd87b8 100644
--- a/sdk/include/thread_pool.h
+++ b/sdk/include/thread_pool.h
@@ -94,7 +94,14 @@
 				return;
 			}
 			(*fn)();
-			token_obj_destroy(MALLOC_CAPABILITY, key, static_cast<SObj>(rawFn));
+			/*
+			 * This fails only if the thread pool runner compartment can't make
+			 * cross-compartment calls to the allocator at all, since we're
+			 * in its initial trusted activation frame and near the beginning
+			 * (highest address) of its stack.
+			 */
+			(void)token_obj_destroy(
+			  MALLOC_CAPABILITY, key, static_cast<SObj>(rawFn));
 		}
 
 		/**