diff --git a/wolfcrypt/src/hmac.c b/wolfcrypt/src/hmac.c
index 9749a8e33..da3c6c6cc 100644
--- a/wolfcrypt/src/hmac.c
+++ b/wolfcrypt/src/hmac.c
@@ -1279,8 +1279,8 @@ int wolfSSL_GetHmacMaxSize(void)
                 ret = wc_HmacUpdate(&myHmac, inKey, inKeySz);
             if (ret == 0)
                 ret = wc_HmacFinal(&myHmac,  out);
-            ForceZero(&myHmac, sizeof(myHmac));
             wc_HmacFree(&myHmac);
+            ForceZero(&myHmac, sizeof(myHmac));
         }
 
         return ret;
@@ -1345,8 +1345,8 @@ int wolfSSL_GetHmacMaxSize(void)
             n++;
         }
 
-        ForceZero(&myHmac, sizeof(myHmac));
         wc_HmacFree(&myHmac);
+        ForceZero(&myHmac, sizeof(myHmac));
 
         return ret;
     }
diff --git a/wolfcrypt/src/kdf.c b/wolfcrypt/src/kdf.c
index cece18239..4b776e588 100644
--- a/wolfcrypt/src/kdf.c
+++ b/wolfcrypt/src/kdf.c
@@ -734,8 +734,8 @@ int wc_SSH_KDF(byte hashId, byte keyId, byte* key, word32 keySz,
         }
     }
 
-    ForceZero(&hash, sizeof(hash));
     _HashFree(enmhashId, &hash);
+    ForceZero(&hash, sizeof(hash));
 
     return ret;
 }