diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index f4860e6310..33b44334e3 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -1138,11 +1138,10 @@ psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
         /* Refuse the destruction of a read-only key (which may or may not work
          * if we attempt it, depending on whether the key is merely read-only
          * by policy or actually physically read-only).
-         * Just do the best we can, which is to wipe the copy in memory. */
-        status = psa_wipe_key_slot( slot );
-        if( status != PSA_SUCCESS )
-            return( status );
-        return( PSA_ERROR_NOT_PERMITTED );
+         * Just do the best we can, which is to wipe the copy in memory
+         * (done in this function's cleanup code). */
+        overall_status = PSA_ERROR_NOT_PERMITTED;
+        goto exit;
     }
 
 #if defined(MBEDTLS_PSA_CRYPTO_SE_C)
@@ -1206,12 +1205,10 @@ psa_status_t psa_destroy_key( mbedtls_svc_key_id_t key )
     }
 #endif /* MBEDTLS_PSA_CRYPTO_SE_C */
 
-#if defined(MBEDTLS_PSA_CRYPTO_SE_C)
 exit:
-#endif /* MBEDTLS_PSA_CRYPTO_SE_C */
     status = psa_wipe_key_slot( slot );
     /* Prioritize CORRUPTION_DETECTED from wiping over a storage error */
-    if( overall_status == PSA_SUCCESS )
+    if( status != PSA_SUCCESS )
         overall_status = status;
     return( overall_status );
 }