diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c
index 4c550632ba..7ae4550a18 100644
--- a/wolfcrypt/src/aes.c
+++ b/wolfcrypt/src/aes.c
@@ -11445,6 +11445,9 @@ int WARN_UNUSED_RESULT AES_GCM_decrypt_C(
     ret = (ret & ~res);
     ret |= (res & WC_NO_ERR_TRACE(AES_GCM_AUTH_E));
 #endif
+    if (ret != 0) {
+        ForceZero(out, sz);
+    }
     return ret;
 }
 #elif (defined(__aarch64__) || defined(WOLFSSL_ARMASM_NO_HW_CRYPTO)) || \