diff --git a/src/internal.c b/src/internal.c
index 0dca6aaec..417841ad4 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -1764,12 +1764,13 @@ int SetSSL_CTX(WOLFSSL* ssl, WOLFSSL_CTX* ctx)
     byte havePSK = 0;
     byte haveAnon = 0;
     byte haveRSA = 0;
-    byte newSSL = ssl->ctx == NULL;
     (void) haveAnon; /* Squash unused var warnings */
 
     if(!ssl || !ctx || ssl->suites == NULL)
         return BAD_FUNC_ARG;
 
+    byte newSSL = ssl->ctx == NULL; /* Assign after null check */
+
 #ifndef NO_PSK
     if (ctx->server_hint[0] && ssl->arrays == NULL) {
         return BAD_FUNC_ARG;  /* needed for copy below */