diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index 2e263844db..f219586927 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -1646,8 +1646,7 @@ static int ssl_tls13_flush_buffers( mbedtls_ssl_context *ssl )
  */
 static int ssl_tls13_handshake_wrapup( mbedtls_ssl_context *ssl )
 {
-    mbedtls_platform_zeroize( &ssl->handshake->tls13_master_secrets,
-                              sizeof(ssl->handshake->tls13_master_secrets));
+
     mbedtls_platform_zeroize( &ssl->handshake->tls13_hs_secrets,
                               sizeof(ssl->handshake->tls13_hs_secrets));
 
diff --git a/library/ssl_tls13_keys.c b/library/ssl_tls13_keys.c
index 45f3287355..765b7fdb84 100644
--- a/library/ssl_tls13_keys.c
+++ b/library/ssl_tls13_keys.c
@@ -1164,6 +1164,9 @@ int mbedtls_ssl_tls13_generate_application_keys(
                                    handshake->tls13_master_secrets.app,
                                    transcript, transcript_len,
                                    app_secrets );
+    /* Erase master secrets*/
+    mbedtls_platform_zeroize( &ssl->handshake->tls13_master_secrets,
+                              sizeof(ssl->handshake->tls13_master_secrets));
     if( ret != 0 )
     {
         MBEDTLS_SSL_DEBUG_RET( 1,