diff --git a/src/linker-macosx.syms b/src/linker-macosx.syms
index f26e4e3b..63a9877d 100644
--- a/src/linker-macosx.syms
+++ b/src/linker-macosx.syms
@@ -1,11 +1,13 @@
-_mosquitto_log_printf
+_mosquitto_broker_publish
+_mosquitto_broker_publish_copy
 _mosquitto_client_address
+_mosquitto_client_certificate
 _mosquitto_client_clean_session
 _mosquitto_client_id
 _mosquitto_client_keepalive
-_mosquitto_client_certificate
 _mosquitto_client_protocol
 _mosquitto_client_protocol_version
 _mosquitto_client_sub_count
 _mosquitto_client_username
+_mosquitto_log_printf
 _mosquitto_set_username
diff --git a/src/linker.syms b/src/linker.syms
index 5a3e8fca..a77c97c1 100644
--- a/src/linker.syms
+++ b/src/linker.syms
@@ -1,4 +1,6 @@
 {
+	mosquitto_broker_publish;
+	mosquitto_broker_publish_copy;
 	mosquitto_client_address;
 	mosquitto_client_certificate;
 	mosquitto_client_clean_session;
diff --git a/src/mosquitto_broker.h b/src/mosquitto_broker.h
index 9d1a8353..4962cadf 100644
--- a/src/mosquitto_broker.h
+++ b/src/mosquitto_broker.h
@@ -179,7 +179,7 @@ const char *mosquitto_client_username(const struct mosquitto *client);
 int mosquitto_set_username(struct mosquitto *client, const char *username);
 
 
-/* Function: mosquitto_plugin_publish
+/* Function: mosquitto_broker_publish
  *
  * Publish a message from within a plugin.
  *
@@ -188,8 +188,33 @@ int mosquitto_set_username(struct mosquitto *client, const char *username);
  * `mosquitto_auth_acl_check(, MOSQ_ACL_WRITE, , )` for checking. Read access
  * will be enforced as normal for individual clients when they are due to
  * receive the message.
+ *
+ * payload must be allocated on the heap, and will be freed by mosquitto after
+ * use.
+ */
+int mosquitto_broker_publish(
+		const char *topic,
+		int payloadlen,
+		void *payload,
+		int qos,
+		bool retain,
+		mosquitto_property *properties);
+
+
+/* Function: mosquitto_broker_publish_copy
+ *
+ * Publish a message from within a plugin.
+ *
+ * This function allows a plugin to publish a message. Messages published in
+ * this way are treated as coming from the broker and so will not be passed to
+ * `mosquitto_auth_acl_check(, MOSQ_ACL_WRITE, , )` for checking. Read access
+ * will be enforced as normal for individual clients when they are due to
+ * receive the message.
+ *
+ * This function is identical to mosquitto_broker_publish, except that a copy
+ * of `payload` is taken.
  */
-int mosquitto_plugin_publish(
+int mosquitto_broker_publish_copy(
 		const char *topic,
 		int payloadlen,
 		const void *payload,
diff --git a/src/plugin.c b/src/plugin.c
index c34fa7ac..256ce39b 100644
--- a/src/plugin.c
+++ b/src/plugin.c
@@ -111,10 +111,10 @@ const char *mosquitto_client_username(const struct mosquitto *context)
 }
 
 
-int mosquitto_plugin_publish(
+int mosquitto_broker_publish(
 		const char *topic,
 		int payloadlen,
-		const void *payload,
+		void *payload,
 		int qos,
 		bool retain,
 		mosquitto_property *properties)
@@ -128,18 +128,8 @@ int mosquitto_plugin_publish(
 	msg->next = NULL;
 	msg->prev = NULL;
 	msg->topic = mosquitto__strdup(topic);
-	if(msg->topic == NULL){
-		mosquitto__free(msg);
-		return MOSQ_ERR_NOMEM;
-	}
 	msg->payloadlen = payloadlen;
-	msg->payload = mosquitto__calloc(1, payloadlen+1);
-	if(msg->payload == NULL){
-		mosquitto__free(msg->topic);
-		mosquitto__free(msg);
-		return MOSQ_ERR_NOMEM;
-	}
-	memcpy(msg->payload, payload, payloadlen);
+	msg->payload = payload;
 	msg->qos = qos;
 	msg->retain = retain;
 	msg->properties = properties;
@@ -152,6 +142,32 @@ int mosquitto_plugin_publish(
 }
 
 
+int mosquitto_broker_publish_copy(
+		const char *topic,
+		int payloadlen,
+		const void *payload,
+		int qos,
+		bool retain,
+		mosquitto_property *properties)
+{
+	void *payload_out;
+
+	payload_out = calloc(1, payloadlen+1);
+	if(payload_out == NULL){
+		return MOSQ_ERR_NOMEM;
+	}
+	memcpy(payload_out, payload, payloadlen);
+
+	return mosquitto_broker_publish(
+			topic,
+			payloadlen,
+			payload_out,
+			qos,
+			retain,
+			properties);
+}
+
+
 int mosquitto_set_username(struct mosquitto *client, const char *username)
 {
 	char *u_dup;