diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 45f3287..765b7fd 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -1164,6 +1164,9 @@
                                    handshake->tls13_master_secrets.app,
                                    transcript, transcript_len,
                                    app_secrets );
+    /* Erase master secrets*/
+    mbedtls_platform_zeroize( &ssl->handshake->tls13_master_secrets,
+                              sizeof(ssl->handshake->tls13_master_secrets));
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1,