diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 23c7975..ee4acdf 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -331,6 +331,7 @@
 
     tls_crypt_v2_load_client_key(key, &key2, false);
     *original_key = key2;
+    secure_memzero(&key2, sizeof(key2));
 
     *wkc_buf = client_key;
 }
@@ -783,6 +784,7 @@
     tls_crypt_v2_init_client_key(&check_client_key, &keydata, &check_wrapped_client_key, client_file,
                                  client_inline);
     free_key_ctx_bi(&check_client_key);
+    secure_memzero(&keydata, sizeof(keydata));
 
     /* Sanity check: unwrap and load client key (as "server") */
     struct buffer check_metadata = alloc_buf_gc(TLS_CRYPT_V2_MAX_METADATA_LEN, &gc);
@@ -793,6 +795,7 @@
     ASSERT(tls_crypt_v2_unwrap_client_key(&check_client_key2, &check_metadata,
                                           check_wrapped_client_key, &server_key));
     secure_memzero(&check_client_key2, sizeof(check_client_key2));
+    buf_clear(&check_wrapped_client_key);
     free_buf(&check_wrapped_client_key);
 
 cleanup: