diff --git a/include/psa/crypto_builtin_key_derivation.h b/include/psa/crypto_builtin_key_derivation.h
index 5d01f6c..245f26a 100644
--- a/include/psa/crypto_builtin_key_derivation.h
+++ b/include/psa/crypto_builtin_key_derivation.h
@@ -119,7 +119,7 @@
     size_t MBEDTLS_PRIVATE(input_cost);
     uint8_t *MBEDTLS_PRIVATE(salt);
     size_t MBEDTLS_PRIVATE(salt_length);
-    uint8_t *MBEDTLS_PRIVATE(password);
+    uint8_t MBEDTLS_PRIVATE(password)[PSA_HMAC_MAX_HASH_BLOCK_SIZE];
     size_t MBEDTLS_PRIVATE(password_length);
 } psa_pbkdf2_key_derivation_t;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_PBKDF2_HMAC */
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index af4ab65..4615920 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -5101,11 +5101,6 @@
                                      operation->ctx.pbkdf2.salt_length);
             mbedtls_free(operation->ctx.pbkdf2.salt);
         }
-        if (operation->ctx.pbkdf2.password != NULL) {
-            mbedtls_platform_zeroize(operation->ctx.pbkdf2.password,
-                                     operation->ctx.pbkdf2.password_length);
-            mbedtls_free(operation->ctx.pbkdf2.password);
-        }
 
         status = PSA_SUCCESS;
     } else