diff --git a/daemon/codec.c b/daemon/codec.c
index c4d8c464e..d9d927e3c 100644
--- a/daemon/codec.c
+++ b/daemon/codec.c
@@ -2070,10 +2070,11 @@ static void codec_add_raw_packet_common(struct media_packet *mp, unsigned int cl
 		if (!p->rtp)
 			p->rtp = mp->rtp;
 	}
-	t_queue_push_tail(&mp->packets_out, p);
+	t_queue_push_tail_link(&mp->packets_out, &p->link);
 }
 void codec_add_raw_packet(struct media_packet *mp, unsigned int clockrate) {
 	struct codec_packet *p = g_new0(__typeof(*p), 1);
+	p->link.data = p;
 	p->s = mp->raw;
 	p->free_func = NULL;
 	codec_add_raw_packet_common(mp, clockrate, p);
@@ -2081,6 +2082,7 @@ void codec_add_raw_packet(struct media_packet *mp, unsigned int clockrate) {
 #ifdef WITH_TRANSCODING
 static void codec_add_raw_packet_dup(struct media_packet *mp, unsigned int clockrate) {
 	struct codec_packet *p = g_new0(__typeof(*p), 1);
+	p->link.data = p;
 	// don't just duplicate the string. need to ensure enough room
 	// if encryption is enabled on this stream
 	p->s.s = bufferpool_alloc(media_bufferpool, mp->raw.len + RTP_BUFFER_TAIL_ROOM);
@@ -2396,6 +2398,7 @@ void codec_output_rtp(struct media_packet *mp, struct codec_scheduler *csch,
 
 	// add to output queue
 	struct codec_packet *p = g_new0(__typeof(*p), 1);
+	p->link.data = p;
 	p->s.s = buf;
 	p->s.len = payload_len + sizeof(struct rtp_header);
 	payload_tracker_add(&ssrc_out->tracker, handler->dest_pt.payload_type);
@@ -2472,7 +2475,7 @@ send:
 			(long unsigned) p->ttq_entry.when.tv_sec,
 			(long unsigned) p->ttq_entry.when.tv_usec);
 
-	t_queue_push_tail(&mp->packets_out, p);
+	t_queue_push_tail_link(&mp->packets_out, &p->link);
 }
 
 // returns new reference
@@ -2812,8 +2815,9 @@ bool codec_packet_copy(struct codec_packet *p) {
 	return true;
 }
 struct codec_packet *codec_packet_dup(struct codec_packet *p) {
-	struct codec_packet *dup = g_new0(__typeof(*p), 1);
+	struct codec_packet *dup = g_new(__typeof(*p), 1);
 	*dup = *p;
+	dup->link.data = dup; // XXX obsolete this
 	codec_packet_copy(dup);
 	if (dup->ssrc_out)
 		ssrc_ctx_hold(dup->ssrc_out);
diff --git a/daemon/media_socket.c b/daemon/media_socket.c
index 75a8aa739..7a0388262 100644
--- a/daemon/media_socket.c
+++ b/daemon/media_socket.c
@@ -2658,8 +2658,9 @@ static int do_rtcp_output(struct packet_handler_ctx *phc) {
 // appropriate locks must be held
 // only frees the output queue if no `sink` is given
 int media_socket_dequeue(struct media_packet *mp, struct packet_stream *sink) {
-	struct codec_packet *p;
-	while ((p = t_queue_pop_head(&mp->packets_out))) {
+	while (mp->packets_out.length) {
+		codec_packet_list *link = t_queue_pop_head_link(&mp->packets_out);
+		__auto_type p = link->data;
 		if (sink && sink->send_timer)
 			send_timer_push(sink->send_timer, p);
 		else
@@ -2957,7 +2958,8 @@ static int stream_packet(struct packet_handler_ctx *phc) {
 
 				for (__auto_type pack = phc->mp.packets_out.head; pack; pack = pack->next) {
 					struct codec_packet *p = pack->data;
-					t_queue_push_tail(&mirror_phc.mp.packets_out, codec_packet_dup(p));
+					__auto_type dup = codec_packet_dup(p);
+					t_queue_push_tail_link(&mirror_phc.mp.packets_out, &dup->link);
 				}
 
 				ret = __media_packet_encrypt(&mirror_phc, mirror_sh);
diff --git a/include/codec.h b/include/codec.h
index 247f64a38..fd1912c20 100644
--- a/include/codec.h
+++ b/include/codec.h
@@ -89,6 +89,7 @@ struct codec_handler {
 
 struct codec_packet {
 	struct timerthread_queue_entry ttq_entry;
+	codec_packet_list link;
 	str s;
 	str plain;
 	struct rtp_header *rtp;
diff --git a/t/test-transcode.c b/t/test-transcode.c
index 09e44a2df..2492d71e8 100644
--- a/t/test-transcode.c
+++ b/t/test-transcode.c
@@ -308,7 +308,8 @@ static void __packet_seq_ts(const char *file, int line, struct call_media *media
 			printf("no packet\n");
 			abort();
 		}
-		struct codec_packet *cp = t_queue_pop_head(&mp.packets_out);
+		__auto_type link = t_queue_pop_head_link(&mp.packets_out);
+		__auto_type cp = link->data;
 		str cp_s = cp->s;
 		rtp = (void *) cp_s.s;
 		if (rtp->m_pt != (unsigned char) pt_out) {