diff --git a/clients/cloud-setup/nmcs-provider-ec2.c b/clients/cloud-setup/nmcs-provider-ec2.c
index 3b5f6d36a8..a3b4c9a0d3 100644
--- a/clients/cloud-setup/nmcs-provider-ec2.c
+++ b/clients/cloud-setup/nmcs-provider-ec2.c
@@ -449,6 +449,8 @@ _get_config_metadata_ready_check (long response_code,
 	}
 
 	r_data = g_bytes_get_data (response_data, &r_len);
+	/* NMHttpClient guarantees that there is a trailing NUL after the data. */
+	nm_assert (r_data[r_len] == 0);
 
 	while (r_len > 0) {
 		const guint8 *p_eol;
diff --git a/clients/cloud-setup/nmcs-provider-gcp.c b/clients/cloud-setup/nmcs-provider-gcp.c
index ba4016dd15..676dd1f27b 100644
--- a/clients/cloud-setup/nmcs-provider-gcp.c
+++ b/clients/cloud-setup/nmcs-provider-gcp.c
@@ -246,10 +246,11 @@ _get_config_ips_list_cb (GObject *source,
 	if (error)
 		goto fips_error;
 
+	response_str = g_bytes_get_data (response, &response_len);
+	/* NMHttpClient guarantees that there is a trailing NUL after the data. */
+	nm_assert (response_str[response_len] == 0);
 
 	uri_arr = g_ptr_array_new_with_free_func (g_free);
-	response_str = g_bytes_get_data (response, &response_len);
-
 	while (nm_utils_parse_next_line (&response_str,
 	                                 &response_len,
 	                                 &line,
@@ -403,6 +404,9 @@ _get_net_ifaces_list_cb (GObject *source,
 	}
 
 	response_str = g_bytes_get_data (response, &response_len);
+	/* NMHttpClient guarantees that there is a trailing NUL after the data. */
+	nm_assert (response_str[response_len] == 0);
+
 	ifaces_arr = g_ptr_array_new ();
 	gstr = g_string_new (NULL);