diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index 13d96ea..83a31ad 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -457,6 +457,7 @@
 #endif
     mbedtls_ctr_drbg_free(&ctr_drbg);
     mbedtls_entropy_free(&entropy);
+    mbedtls_psa_crypto_free();
 
     mbedtls_exit(exit_code);
 }
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index a3eafff..1ca8362 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -469,6 +469,7 @@
     mbedtls_pk_free(&key);
     mbedtls_ctr_drbg_free(&ctr_drbg);
     mbedtls_entropy_free(&entropy);
+    mbedtls_psa_crypto_free();
 
     cur = opt.san_list;
     while (cur != NULL) {
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 7b47e54..e3bd69a 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -894,6 +894,7 @@
     mbedtls_pk_free(&loaded_issuer_key);
     mbedtls_ctr_drbg_free(&ctr_drbg);
     mbedtls_entropy_free(&entropy);
+    mbedtls_psa_crypto_free();
 
     mbedtls_exit(exit_code);
 }
diff --git a/programs/x509/crl_app.c b/programs/x509/crl_app.c
index f45d0b8..aa2e711 100644
--- a/programs/x509/crl_app.c
+++ b/programs/x509/crl_app.c
@@ -134,6 +134,7 @@
 
 exit:
     mbedtls_x509_crl_free(&crl);
+    mbedtls_psa_crypto_free();
 
     mbedtls_exit(exit_code);
 }
diff --git a/programs/x509/load_roots.c b/programs/x509/load_roots.c
index 858a382..43ca0be 100644
--- a/programs/x509/load_roots.c
+++ b/programs/x509/load_roots.c
@@ -123,11 +123,6 @@
     struct mbedtls_timing_hr_time timer;
     unsigned long ms;
 
-    if (argc <= 1) {
-        mbedtls_printf(USAGE);
-        goto exit;
-    }
-
 #if defined(MBEDTLS_USE_PSA_CRYPTO)
     psa_status_t status = psa_crypto_init();
     if (status != PSA_SUCCESS) {
@@ -137,6 +132,11 @@
     }
 #endif /* MBEDTLS_USE_PSA_CRYPTO */
 
+    if (argc <= 1) {
+        mbedtls_printf(USAGE);
+        goto exit;
+    }
+
     opt.filenames = NULL;
     opt.iterations = DFL_ITERATIONS;
     opt.prime_cache = DFL_PRIME_CACHE;
@@ -196,6 +196,7 @@
     exit_code = MBEDTLS_EXIT_SUCCESS;
 
 exit:
+    mbedtls_psa_crypto_free();
     mbedtls_exit(exit_code);
 }
 #endif /* necessary configuration */
diff --git a/programs/x509/req_app.c b/programs/x509/req_app.c
index c63f896..f5fbc79 100644
--- a/programs/x509/req_app.c
+++ b/programs/x509/req_app.c
@@ -134,6 +134,7 @@
 
 exit:
     mbedtls_x509_csr_free(&csr);
+    mbedtls_psa_crypto_free();
 
     mbedtls_exit(exit_code);
 }