diff --git a/ChangeLog.d/psa-zeroize.txt b/ChangeLog.d/psa-zeroize.txt
new file mode 100644
index 0000000..e597302
--- /dev/null
+++ b/ChangeLog.d/psa-zeroize.txt
@@ -0,0 +1,2 @@
+Security
+   * Zeroize temporary heap buffers used in PSA operations.
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index b576f95..54e497e 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -9300,7 +9300,7 @@
     return PSA_SUCCESS;
 
 error:
-    mbedtls_free(local_input->buffer);
+    mbedtls_zeroize_and_free(local_input->buffer, local_input->length);
     local_input->buffer = NULL;
     local_input->length = 0;
     return status;
@@ -9308,7 +9308,7 @@
 
 void psa_crypto_local_input_free(psa_crypto_local_input_t *local_input)
 {
-    mbedtls_free(local_input->buffer);
+    mbedtls_zeroize_and_free(local_input->buffer, local_input->length);
     local_input->buffer = NULL;
     local_input->length = 0;
 }
@@ -9352,7 +9352,7 @@
         return status;
     }
 
-    mbedtls_free(local_output->buffer);
+    mbedtls_zeroize_and_free(local_output->buffer, local_output->length);
     local_output->buffer = NULL;
     local_output->length = 0;