diff --git a/components/nvs_flash/src/nvs_encrypted_partition.cpp b/components/nvs_flash/src/nvs_encrypted_partition.cpp
index c108fe30ad3..053a3ee1f0b 100644
--- a/components/nvs_flash/src/nvs_encrypted_partition.cpp
+++ b/components/nvs_flash/src/nvs_encrypted_partition.cpp
@@ -13,12 +13,28 @@ namespace nvs {
 
 #ifdef CONFIG_NVS_BDL_STACK
 NVSEncryptedPartition::NVSEncryptedPartition(const char* label, const esp_blockdev_handle_t bdl, const bool managed_bdl)
-    : NVSPartition(label, bdl, managed_bdl) { }
+    : NVSPartition(label, bdl, managed_bdl)
+{
+    XTS_FUNC(xts_init)(&mEctxt);
+    XTS_FUNC(xts_init)(&mDctxt);
+}
 #else
 NVSEncryptedPartition::NVSEncryptedPartition(const esp_partition_t *partition)
-    : NVSPartition(partition) { }
+    : NVSPartition(partition)
+{
+    XTS_FUNC(xts_init)(&mEctxt);
+    XTS_FUNC(xts_init)(&mDctxt);
+}
 #endif // CONFIG_NVS_BDL_STACK
 
+NVSEncryptedPartition::~NVSEncryptedPartition()
+{
+    /* Wipe AES round keys derived from the NVS encryption key so they are not
+     * left in DRAM after the partition object is destroyed. */
+    XTS_FUNC(xts_free)(&mEctxt);
+    XTS_FUNC(xts_free)(&mDctxt);
+}
+
 esp_err_t NVSEncryptedPartition::init(nvs_sec_cfg_t* cfg)
 {
     uint8_t* eky = reinterpret_cast<uint8_t*>(cfg);
diff --git a/components/nvs_flash/src/nvs_encrypted_partition.hpp b/components/nvs_flash/src/nvs_encrypted_partition.hpp
index ffdea250aea..24c98d5359a 100644
--- a/components/nvs_flash/src/nvs_encrypted_partition.hpp
+++ b/components/nvs_flash/src/nvs_encrypted_partition.hpp
@@ -23,7 +23,7 @@ public:
     NVSEncryptedPartition(const esp_partition_t *partition);
 #endif
 
-    virtual ~NVSEncryptedPartition() { }
+    virtual ~NVSEncryptedPartition();
 
     /**
      * Initializes the AES encryption components with the provided configuration.