diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 7304a3b..a0e6074 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -5421,7 +5421,9 @@
  *       this distinction. If use_context is 0 and TLS 1.3 is used, context and
  *       context_len are ignored and a 0-length context is used.
  *
- * \return            0 on success. An SSL specific error on failure.
+ * \return            0 on success.
+ * \return            MBEDTLS_ERR_SSL_BAD_INPUT_DATA if the handshake is not yet completed.
+ * \return            An SSL-specific error on failure.
  */
 int mbedtls_ssl_export_keying_material(mbedtls_ssl_context *ssl,
                                        uint8_t *out, const size_t key_len,