diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index c791f81ba8..26d570a2e4 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -2682,6 +2682,7 @@ static int ssl_get_ecdh_params_from_cert(mbedtls_ssl_context *ssl)
                 break;
             }
 
+            mbedtls_platform_zeroize(buf, sizeof(buf));
             ret = 0;
             break;
 #endif /* !MBEDTLS_PK_USE_PSA_EC_DATA */