diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 3d3ab0c..a5d4a38 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -1075,6 +1075,9 @@
     init_key_bi_ctx_send(&ctx->encrypt, &send_key, kt, name);
     init_key_bi_ctx_recv(&ctx->decrypt, &recv_key, kt, name);
     ctx->initialized = true;
+
+    secure_memzero(&send_key, sizeof(send_key));
+    secure_memzero(&recv_key, sizeof(recv_key));
 }
 
 void
diff --git a/src/openvpn/tls_crypt.c b/src/openvpn/tls_crypt.c
index 23c7975..1ac25ce 100644
--- a/src/openvpn/tls_crypt.c
+++ b/src/openvpn/tls_crypt.c
@@ -359,6 +359,7 @@
 
     init_key_ctx(key_ctx, &srv_key_params, &kt, encrypt, "tls-crypt-v2 server key");
     secure_memzero(&srv_key, sizeof(srv_key));
+    secure_memzero(&srv_key_params, sizeof(srv_key_params));
 }
 
 static bool