diff --git a/src/basic/hmac.c b/src/basic/hmac.c
index d70b874e2c..3697fe2252 100644
--- a/src/basic/hmac.c
+++ b/src/basic/hmac.c
@@ -3,6 +3,7 @@
 #include <string.h>
 
 #include "hmac.h"
+#include "memory-util.h"
 #include "sha256.h"
 
 #define HMAC_BLOCK_SIZE 64
@@ -16,9 +17,13 @@ void hmac_sha256(const void *key,
                  uint8_t res[static SHA256_DIGEST_SIZE]) {
 
         uint8_t inner_padding[HMAC_BLOCK_SIZE] = { };
+        CLEANUP_ERASE(inner_padding);
         uint8_t outer_padding[HMAC_BLOCK_SIZE] = { };
+        CLEANUP_ERASE(outer_padding);
         uint8_t replacement_key[SHA256_DIGEST_SIZE];
+        CLEANUP_ERASE(replacement_key);
         struct sha256_ctx hash;
+        CLEANUP_ERASE(hash);
 
         assert(key);
         assert(key_size > 0);