diff --git a/library/ssl_msg.c b/library/ssl_msg.c
index 51eb4619c6..1f946b68f9 100644
--- a/library/ssl_msg.c
+++ b/library/ssl_msg.c
@@ -5404,6 +5404,11 @@ void mbedtls_ssl_transform_free( mbedtls_ssl_transform *transform )
     mbedtls_cipher_free( &transform->cipher_ctx_enc );
     mbedtls_cipher_free( &transform->cipher_ctx_dec );
 
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    psa_destroy_key( &transform->psa_key_enc );
+    psa_destroy_key( &transform->psa_key_dec );
+#endif
+
 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
     mbedtls_md_free( &transform->md_ctx_enc );
     mbedtls_md_free( &transform->md_ctx_dec );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 61b8c6cbd5..ff56dcb3b2 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -3025,6 +3025,11 @@ void mbedtls_ssl_transform_init( mbedtls_ssl_transform *transform )
     mbedtls_cipher_init( &transform->cipher_ctx_enc );
     mbedtls_cipher_init( &transform->cipher_ctx_dec );
 
+#if defined(MBEDTLS_USE_PSA_CRYPTO)
+    transform->psa_key_enc = MBEDTLS_SVC_KEY_ID_INIT;
+    transform->psa_key_dec = MBEDTLS_SVC_KEY_ID_INIT;
+#endif
+
 #if defined(MBEDTLS_SSL_SOME_SUITES_USE_MAC)
     mbedtls_md_init( &transform->md_ctx_enc );
     mbedtls_md_init( &transform->md_ctx_dec );