diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index c84bbd2371..7fc0d9677f 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -165,14 +165,16 @@ mbedtls_psa_drbg_context_t *const mbedtls_psa_random_state =
  */
 #define FREE_LOCAL_OUTPUT(output) \
     output = NULL; \
-    psa_status_t output##_local_output_status; \
-    output##_local_output_status = psa_crypto_local_output_free(&output##_copy); \
-    if (output##_local_output_status != PSA_SUCCESS) { \
-        /* Since this error case is an internal error, it's more serious than \
-         * any existing error code and so it's fine to overwrite the existing \
-         * status. */ \
-        status = output##_local_output_status; \
-    }
+    do { \
+        psa_status_t local_output_status; \
+        local_output_status = psa_crypto_local_output_free(&output##_copy); \
+        if (local_output_status != PSA_SUCCESS) { \
+            /* Since this error case is an internal error, it's more serious than \
+             * any existing error code and so it's fine to overwrite the existing \
+             * status. */ \
+            status = local_output_status; \
+        } \
+    } while (0)
 #else /* MBEDTLS_PSA_COPY_CALLER_BUFFERS */
 #define SWAP_FOR_LOCAL_INPUT(input, length)
 #define FREE_LOCAL_INPUT(input)