diff --git a/tools/tpm/rot.c b/tools/tpm/rot.c
index 9de7bce1..9f0b03e2 100644
--- a/tools/tpm/rot.c
+++ b/tools/tpm/rot.c
@@ -204,6 +204,11 @@ exit:
     wolfTPM2_UnloadHandle(&dev, &tpmSession.handle);
     wolfTPM2_Cleanup(&dev);
 
+    /* Scrub the NV auth copy and the session state from the stack on
+     * every exit path. */
+    wc_ForceZero(&nv, sizeof(nv));
+    wc_ForceZero(&tpmSession, sizeof(tpmSession));
+
     return rc;
 }