diff --git a/src/hsm/cmd_decrypt_asym.c b/src/hsm/cmd_decrypt_asym.c
index eb9a596..893dcc3 100644
--- a/src/hsm/cmd_decrypt_asym.c
+++ b/src/hsm/cmd_decrypt_asym.c
@@ -178,6 +178,7 @@ int cmd_decrypt_asym() {
                         if (store_dkek_key(n, res_APDU) != CCID_OK) {
                             return SW_EXEC_ERROR();
                         }
+                        mbedtls_platform_zeroize(res_APDU, 32);
                         return SW_OK();
                     }
                 }