diff --git a/src/cryptenroll/cryptenroll-tpm2.c b/src/cryptenroll/cryptenroll-tpm2.c
index fab6fed0971..4b8f3cc4f8a 100644
--- a/src/cryptenroll/cryptenroll-tpm2.c
+++ b/src/cryptenroll/cryptenroll-tpm2.c
@@ -64,9 +64,9 @@ static int search_policy_hash(
 }
 
 static int get_pin(char **ret_pin_str, TPM2Flags *ret_flags) {
-        _cleanup_free_ char *pin_str = NULL;
-        int r;
+        _cleanup_(erase_and_freep) char *pin_str = NULL;
         TPM2Flags flags = 0;
+        int r;
 
         assert(ret_pin_str);
         assert(ret_flags);
diff --git a/src/cryptsetup/cryptsetup-tpm2.c b/src/cryptsetup/cryptsetup-tpm2.c
index 036f3d3a006..41dca776d11 100644
--- a/src/cryptsetup/cryptsetup-tpm2.c
+++ b/src/cryptsetup/cryptsetup-tpm2.c
@@ -13,7 +13,7 @@
 #include "tpm2-util.h"
 
 static int get_pin(usec_t until, AskPasswordFlags ask_password_flags, bool headless, char **ret_pin_str) {
-        _cleanup_free_ char *pin_str = NULL;
+        _cleanup_(erase_and_freep) char *pin_str = NULL;
         _cleanup_strv_free_erase_ char **pin = NULL;
         int r;