diff --git a/apps/wolfsshd/wolfsshd.c b/apps/wolfsshd/wolfsshd.c
index a8e6e860a..8304b8a69 100644
--- a/apps/wolfsshd/wolfsshd.c
+++ b/apps/wolfsshd/wolfsshd.c
@@ -1916,6 +1916,8 @@ static int SHELL_Subsystem(WOLFSSHD_CONNECTION* conn, WOLFSSH* ssh,
         }
     }
 
+    wc_ForceZero(channelBuffer, sizeof channelBuffer);
+    wc_ForceZero(shellBuffer, sizeof shellBuffer);
     (void)conn;
     return WS_SUCCESS;
 }
diff --git a/src/agent.c b/src/agent.c
index 5eac61788..1174f35b6 100644
--- a/src/agent.c
+++ b/src/agent.c
@@ -1607,7 +1607,7 @@ void wolfSSH_AGENT_ID_free(WOLFSSH_AGENT_ID* id, void* heap)
             WS_FORCEZERO(id->keyBuffer, id->keyBufferSz);
             WFREE(id->keyBuffer, heap, DYNTYPE_STRING);
         }
-        WMEMSET(id, 0, sizeof(WOLFSSH_AGENT_ID));
+        WS_FORCEZERO(id, sizeof(WOLFSSH_AGENT_ID));
         WFREE(id, heap, DYNTYPE_AGENT_ID);
     }
 
diff --git a/src/internal.c b/src/internal.c
index a5fa0ee3b..be7798f85 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -1558,6 +1558,10 @@ void SshResourceFree(WOLFSSH* ssh, void* heap)
     HandshakeInfoFree(ssh->handshake, heap);
     WS_FORCEZERO(&ssh->keys, sizeof(Keys));
     WS_FORCEZERO(&ssh->peerKeys, sizeof(Keys));
+    WS_FORCEZERO(ssh->h, sizeof(ssh->h));
+    ssh->hSz = 0;
+    WS_FORCEZERO(ssh->sessionId, sizeof(ssh->sessionId));
+    ssh->sessionIdSz = 0;
     if (ssh->rng) {
         wc_FreeRng(ssh->rng);
         WFREE(ssh->rng, heap, DYNTYPE_RNG);
@@ -3560,6 +3564,8 @@ void ChannelDelete(WOLFSSH_CHANNEL* channel, void* heap)
         if (channel->origin)
             WFREE(channel->origin, heap, DYNTYPE_STRING);
     #endif /* WOLFSSH_FWD */
+        if (channel->inputBuffer.buffer)
+            WS_FORCEZERO(channel->inputBuffer.buffer, channel->inputBuffer.bufferSz);
         WFREE(channel->inputBuffer.buffer,
               channel->inputBuffer.heap, DYNTYPE_BUFFER);
         if (channel->command)
@@ -6684,6 +6690,9 @@ static int KeyAgreeEcdhMlKem_client(WOLFSSH* ssh, byte hashId,
              ret);
     }
 
+    /* Zero the ML-KEM private key material in handshake->x now that
+     * decapsulation is done, matching the DH path's post-use WS_FORCEZERO. */
+    WS_FORCEZERO(ssh->handshake->x, ssh->handshake->xSz);
     wc_MlKemKey_Free(&kem);
 
     WS_FORCEZERO(ssh->handshake->x, ssh->handshake->xSz);
@@ -8302,8 +8311,11 @@ static int DoUserAuthRequestRsa(WOLFSSH* ssh, WS_UserAuthData_PublicKey* pk,
         WFREE(key, ssh->ctx->heap, DYNTYPE_PUBKEY);
     }
     if (encDigest) {
+        WS_FORCEZERO(encDigest, MAX_ENCODED_SIG_SZ);
         WFREE(encDigest, ssh->ctx->heap, DYNTYPE_BUFFER);
     }
+#else
+    WS_FORCEZERO(encDigest, sizeof(encDigest));
 #endif
 
     WLOG(WS_LOG_DEBUG, "Leaving DoUserAuthRequestRsa(), ret = %d", ret);
@@ -8463,8 +8475,11 @@ static int DoUserAuthRequestRsaCert(WOLFSSH* ssh, WS_UserAuthData_PublicKey* pk,
         WFREE(key, ssh->ctx->heap, DYNTYPE_PUBKEY);
     }
     if (encDigest) {
+        WS_FORCEZERO(encDigest, MAX_ENCODED_SIG_SZ);
         WFREE(encDigest, ssh->ctx->heap, DYNTYPE_BUFFER);
     }
+#else
+    WS_FORCEZERO(encDigest, sizeof(encDigest));
 #endif
 
     WLOG(WS_LOG_DEBUG, "Leaving DoUserAuthRequestRsaCert(), ret = %d", ret);
@@ -9505,6 +9520,8 @@ static int DoUserAuthRequestPublicKey(WOLFSSH* ssh, WS_UserAuthData* authData,
                             ret = WS_INVALID_ALGO_ID;
                     }
                 }
+
+                WS_FORCEZERO(digest, sizeof(digest));
             }
 
             if (ret != WS_SUCCESS) {
@@ -14198,9 +14215,14 @@ static int SignHRsa(WOLFSSH* ssh, byte* sig, word32* sigSz,
                 &sigKey->sk.rsa.key, heap, "SignHRsa");
     }
 
+    WS_FORCEZERO(digest, sizeof(digest));
     #ifdef WOLFSSH_SMALL_STACK
-    if (encSig != NULL)
+    if (encSig != NULL) {
+        WS_FORCEZERO(encSig, MAX_ENCODED_SIG_SZ);
         WFREE(encSig, heap, DYNTYPE_TEMP);
+    }
+    #else
+    WS_FORCEZERO(encSig, MAX_ENCODED_SIG_SZ);
     #endif
     WLOG(WS_LOG_DEBUG, "Leaving SignHRsa(), ret = %d", ret);
     return ret;
@@ -14342,6 +14364,7 @@ static int SignHEcdsa(WOLFSSH* ssh, byte* sig, word32* sigSz,
         WMEMCPY(sig + idx, s, sSz);
     }
 
+    WS_FORCEZERO(digest, sizeof(digest));
 #ifdef WOLFSSH_SMALL_STACK
     if (r)
         WFREE(r, heap, DYNTYPE_BUFFER);
@@ -16417,6 +16440,8 @@ static int BuildUserAuthRequestRsa(WOLFSSH* ssh,
 
             if (ret == WS_SUCCESS)
                 begin += keySig->sigSz;
+
+            WS_FORCEZERO(encDigest, sizeof(encDigest));
         }
     }
 
@@ -16428,6 +16453,7 @@ static int BuildUserAuthRequestRsa(WOLFSSH* ssh,
         WFREE(checkData, ssh->ctx->heap, DYNTYPE_TEMP);
     }
 
+    WS_FORCEZERO(digest, sizeof(digest));
     return ret;
 } /* END BuildUserAuthRequestRsa */
 
@@ -16597,6 +16623,8 @@ static int BuildUserAuthRequestRsaCert(WOLFSSH* ssh,
 
             if (ret == WS_SUCCESS)
                 begin += keySig->sigSz;
+
+            WS_FORCEZERO(encDigest, sizeof(encDigest));
         }
     }
 
@@ -16608,6 +16636,7 @@ static int BuildUserAuthRequestRsaCert(WOLFSSH* ssh,
         WFREE(checkData, ssh->ctx->heap, DYNTYPE_TEMP);
     }
 
+    WS_FORCEZERO(digest, sizeof(digest));
     WLOG(WS_LOG_DEBUG, "Leaving BuildUserAuthRequestRsaCert(), ret = %d",
             ret);
     return ret;
@@ -16875,6 +16904,7 @@ static int BuildUserAuthRequestEcc(WOLFSSH* ssh,
         WFREE(checkData, ssh->ctx->heap, DYNTYPE_TEMP);
     }
 
+    WS_FORCEZERO(digest, sizeof(digest));
 #ifdef WOLFSSH_SMALL_STACK
     if (r_ptr)
         WFREE(r_ptr, ssh->ctx->heap, DYNTYPE_BUFFER);
@@ -17135,6 +17165,7 @@ static int BuildUserAuthRequestEccCert(WOLFSSH* ssh,
         WFREE(checkData, ssh->ctx->heap, DYNTYPE_TEMP);
     }
 
+    WS_FORCEZERO(digest, sizeof(digest));
     return ret;
 }
 
diff --git a/src/wolfsftp.c b/src/wolfsftp.c
index 84c40f7b4..fc15f9fd2 100644
--- a/src/wolfsftp.c
+++ b/src/wolfsftp.c
@@ -850,7 +850,7 @@ static void wolfSSH_SFTP_ClearState(WOLFSSH* ssh, enum WS_SFTP_STATE_ID state)
 
         if (state & STATE_ID_GET) {
             if (ssh->getState) {
-                WS_FORCEZERO(ssh->getState->r, WOLFSSH_MAX_SFTP_RW);
+                WS_FORCEZERO(ssh->getState, sizeof(WS_SFTP_GET_STATE));
                 WFREE(ssh->getState, ssh->ctx->heap, DYNTYPE_SFTP_STATE);
                 ssh->getState = NULL;
             }
@@ -929,7 +929,7 @@ static void wolfSSH_SFTP_ClearState(WOLFSSH* ssh, enum WS_SFTP_STATE_ID state)
 
         if (state & STATE_ID_PUT) {
             if (ssh->putState) {
-                WS_FORCEZERO(ssh->putState->r, WOLFSSH_MAX_SFTP_RW);
+                WS_FORCEZERO(ssh->putState, sizeof(WS_SFTP_PUT_STATE));
                 WFREE(ssh->putState, ssh->ctx->heap, DYNTYPE_SFTP_STATE);
                 ssh->putState = NULL;
             }
@@ -9795,7 +9795,7 @@ int wolfSSH_SFTP_Get(WOLFSSH* ssh, char* from,
             case STATE_GET_CLEANUP:
                 WLOG(WS_LOG_SFTP, "SFTP GET STATE: CLEANUP");
                 if (ssh->getState != NULL) {
-                    WS_FORCEZERO(ssh->getState->r, WOLFSSH_MAX_SFTP_RW);
+                    WS_FORCEZERO(ssh->getState, sizeof(WS_SFTP_GET_STATE));
                     WFREE(ssh->getState, ssh->ctx->heap, DYNTYPE_SFTP_STATE);
                     ssh->getState = NULL;
                 }
@@ -10019,7 +10019,7 @@ int wolfSSH_SFTP_Put(WOLFSSH* ssh, char* from, char* to, byte resume,
             case STATE_PUT_CLEANUP:
                 WLOG(WS_LOG_SFTP, "SFTP PUT STATE: CLEANUP");
                 if (ssh->putState != NULL) {
-                    WS_FORCEZERO(ssh->putState->r, WOLFSSH_MAX_SFTP_RW);
+                    WS_FORCEZERO(ssh->putState, sizeof(WS_SFTP_PUT_STATE));
                     WFREE(ssh->putState, ssh->ctx->heap, DYNTYPE_SFTP_STATE);
                     ssh->putState = NULL;
                 }