diff --git a/library/pkwrite.c b/library/pkwrite.c
index 225cde9..4e62529 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -860,7 +860,7 @@
 
     ret = 0;
 cleanup:
-    mbedtls_free(output_buf);
+    mbedtls_zeroize_and_free(output_buf, PRV_DER_MAX_BYTES);
     return ret;
 }
 #endif /* MBEDTLS_PEM_WRITE_C */