diff --git a/library/pkwrite.c b/library/pkwrite.c
index 225cde90d9..4e625292ce 100644
--- a/library/pkwrite.c
+++ b/library/pkwrite.c
@@ -860,7 +860,7 @@ int mbedtls_pk_write_key_pem(const mbedtls_pk_context *key, unsigned char *buf,
 
     ret = 0;
 cleanup:
-    mbedtls_free(output_buf);
+    mbedtls_zeroize_and_free(output_buf, PRV_DER_MAX_BYTES);
     return ret;
 }
 #endif /* MBEDTLS_PEM_WRITE_C */