diff --git a/boot/bootutil/src/image_rsa.c b/boot/bootutil/src/image_rsa.c
index 37c35e0..778a92b 100644
--- a/boot/bootutil/src/image_rsa.c
+++ b/boot/bootutil/src/image_rsa.c
@@ -97,6 +97,7 @@
         bootutil_sha_update(&ctx, hash, PSS_HLEN);
         bootutil_sha_update(&ctx, counter, 4);
         bootutil_sha_finish(&ctx, htmp);
+        bootutil_sha_drop(&ctx);
 
         counter[3]++;
 
@@ -108,8 +109,6 @@
         mask += bytes;
         count -= bytes;
     }
-
-    bootutil_sha_drop(&ctx);
 }
 
 /*
diff --git a/boot/bootutil/src/image_validate.c b/boot/bootutil/src/image_validate.c
index 123d8c4..521251a 100644
--- a/boot/bootutil/src/image_validate.c
+++ b/boot/bootutil/src/image_validate.c
@@ -289,12 +289,11 @@
         bootutil_sha_init(&sha_ctx);
         bootutil_sha_update(&sha_ctx, key->key, *key->len);
         bootutil_sha_finish(&sha_ctx, hash);
+        bootutil_sha_drop(&sha_ctx);
         if (!memcmp(hash, keyhash, keyhash_len)) {
-            bootutil_sha_drop(&sha_ctx);
             return i;
         }
     }
-    bootutil_sha_drop(&sha_ctx);
     return -1;
 }
 #else /* !MCUBOOT_HW_KEY */