diff --git a/library/cipher.c b/library/cipher.c
index b2cffcd..16037fb 100644
--- a/library/cipher.c
+++ b/library/cipher.c
@@ -322,7 +322,7 @@
          * mbedtls_cipher_free() needs to be called in any case. */
 
         /* Setup policy for the new key slot. */
-        psa_key_policy_init( &key_policy );
+        key_policy = psa_key_policy_init();
 
         /* Mbed TLS' cipher layer doesn't enforce the mode of operation
          * (encrypt vs. decrypt): it is possible to setup a key for encryption