diff --git a/library/pkwrite.c b/library/pkwrite.c
index f0dc718..5e3fcc9 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -641,6 +641,7 @@
 
     ret = 0;
 cleanup:
+    mbedtls_platform_zeroize(output_buf, PRV_DER_MAX_BYTES);
     mbedtls_free(output_buf);
     return ret;
 }