diff --git a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
index fbfa208a..dc54bca7 100644
--- a/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
+++ b/src/libsodium/crypto_aead/aes256gcm/aesni/aead_aes256gcm_aesni.c
@@ -855,12 +855,16 @@ crypto_aead_aes256gcm_encrypt(unsigned char *c,
                               const unsigned char *k)
 {
     CRYPTO_ALIGN(16) crypto_aead_aes256gcm_state ctx;
+    int ret;
 
     crypto_aead_aes256gcm_beforenm(&ctx, k);
 
-    return crypto_aead_aes256gcm_encrypt_afternm
+    ret = crypto_aead_aes256gcm_encrypt_afternm
         (c, clen_p, m, mlen, ad, adlen, nsec, npub,
             (const crypto_aead_aes256gcm_state *) &ctx);
+    sodium_memzero(ctx, sizeof ctx);
+
+    return ret;
 }
 
 int
@@ -895,12 +899,16 @@ crypto_aead_aes256gcm_decrypt(unsigned char *m,
                               const unsigned char *k)
 {
     CRYPTO_ALIGN(16) crypto_aead_aes256gcm_state ctx;
+    int ret;
 
     crypto_aead_aes256gcm_beforenm(&ctx, k);
 
-    return crypto_aead_aes256gcm_decrypt_afternm
+    ret = crypto_aead_aes256gcm_decrypt_afternm
         (m, mlen_p, nsec, c, clen, ad, adlen, npub,
          (const crypto_aead_aes256gcm_state *) &ctx);
+    sodium_memzero(ctx, sizeof ctx);
+
+    return ret;
 }
 
 int