diff --git a/hal/stm32h5.c b/hal/stm32h5.c
index 2a55dc0b..3a2da379 100644
--- a/hal/stm32h5.c
+++ b/hal/stm32h5.c
@@ -182,6 +182,14 @@ __attribute__((weak)) int stm32h5_obkeys_read_uds(uint8_t *out, size_t out_len)
 #endif
 
 #if defined(WOLFCRYPT_TZ_PSA)
+static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
+{
+    volatile uint8_t *p = (volatile uint8_t *)ptr;
+    while (len-- > 0U) {
+        *p++ = 0U;
+    }
+}
+
 static int uds_from_uid(uint8_t *out, size_t out_len)
 {
     uint8_t uid[12];
@@ -231,6 +239,8 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
         copy_len = out_len;
     }
     memcpy(out, digest, copy_len);
+    hal_secret_zeroize(digest, sizeof(digest));
+    hal_secret_zeroize(&hash, sizeof(hash));
     return 0;
 }
 
@@ -246,14 +256,6 @@ static int buffer_is_all_value(const uint8_t *buf, size_t len, uint8_t value)
     return 1;
 }
 
-static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
-{
-    volatile uint8_t *p = (volatile uint8_t *)ptr;
-    while (len-- > 0U) {
-        *p++ = 0U;
-    }
-}
-
 int hal_uds_derive_key(uint8_t *out, size_t out_len)
 {
 #if defined(FLASH_OTP_KEYSTORE)
diff --git a/hal/stm32l5.c b/hal/stm32l5.c
index af312f7d..d90755f9 100644
--- a/hal/stm32l5.c
+++ b/hal/stm32l5.c
@@ -120,6 +120,14 @@ int RAMFUNCTION hal_flash_write(uint32_t address, const uint8_t *data, int len)
 #define STM32L5_UID2 (*(volatile uint32_t *)(STM32L5_UID_BASE + 0x8))
 
 #if defined(WOLFCRYPT_TZ_PSA)
+static NOINLINEFUNCTION void hal_secret_zeroize(void *ptr, size_t len)
+{
+    volatile uint8_t *p = (volatile uint8_t *)ptr;
+    while (len-- > 0U) {
+        *p++ = 0U;
+    }
+}
+
 static int uds_from_uid(uint8_t *out, size_t out_len)
 {
     uint8_t uid[12];
@@ -173,6 +181,8 @@ static int uds_from_uid(uint8_t *out, size_t out_len)
         copy_len = out_len;
     }
     memcpy(out, digest, copy_len);
+    hal_secret_zeroize(digest, sizeof(digest));
+    hal_secret_zeroize(&hash, sizeof(hash));
     return 0;
 }