diff --git a/src/fido/oath.c b/src/fido/oath.c
index 19bd8be..901df2b 100644
--- a/src/fido/oath.c
+++ b/src/fido/oath.c
@@ -336,7 +336,6 @@ int calculate_oath(uint8_t truncate,
     if (r != 0) {
         return CCID_EXEC_ERROR;
     }
-    res_APDU_size = 0;
     if (truncate == 0x01) {
         res_APDU[res_APDU_size++] = 4 + 1;
         res_APDU[res_APDU_size++] = key[1];
diff --git a/src/fido/otp.c b/src/fido/otp.c
index f194fd0..c3033ed 100644
--- a/src/fido/otp.c
+++ b/src/fido/otp.c
@@ -156,6 +156,7 @@ int otp_button_pressed(uint8_t slot) {
             imf |= *p++;
         }
         uint8_t chal[8] = {imf >> 56, imf >> 48, imf >> 40, imf >> 32, imf >> 24, imf >> 16, imf >> 8, imf & 0xff};
+        res_APDU_size = 0;
         int ret = calculate_oath(1, tmp_key, sizeof(tmp_key), chal, sizeof(chal));
         if (ret == CCID_OK) {
             uint32_t base = otp_config->cfg_flags & OATH_HOTP8 ? 1e8 : 1e6;