diff --git a/components/esp_security/src/esp_key_mgr.c b/components/esp_security/src/esp_key_mgr.c
index 866dadae468..81d33bda3d1 100644
--- a/components/esp_security/src/esp_key_mgr.c
+++ b/components/esp_security/src/esp_key_mgr.c
@@ -21,6 +21,7 @@
 #include "hal/huk_types.h"
 #include "hal/huk_hal.h"
 #include "rom/key_mgr.h"
+#include "soc/soc_caps.h"
 
 #if SOC_KEY_MANAGER_SUPPORTED
 static const char *TAG = "esp_key_mgr";
@@ -100,6 +101,12 @@ static void esp_key_mgr_acquire_hardware(bool deployment_mode)
         esp_crypto_ecc_lock_acquire();
         esp_crypto_sha_aes_lock_acquire();
         esp_crypto_key_manager_lock_acquire();
+        // The KM peripheral uses the external ECC block for the ECDH0/ECDH1
+        // scalar multiplications; its bus clock must be on, otherwise the KM
+        // deploys an incorrect key.
+#if SOC_ECC_SUPPORTED
+        esp_crypto_ecc_enable_periph_clk(true);
+#endif
     }
     // Reset the Key Manager Clock
     esp_crypto_key_mgr_enable_periph_clk(true);
@@ -108,9 +115,12 @@ static void esp_key_mgr_acquire_hardware(bool deployment_mode)
 static void esp_key_mgr_release_hardware(bool deployment_mode)
 {
     if (deployment_mode) {
-        esp_crypto_ecc_lock_release();
-        esp_crypto_sha_aes_lock_release();
+#if SOC_ECC_SUPPORTED
+        esp_crypto_ecc_enable_periph_clk(false);
+#endif
         esp_crypto_key_manager_lock_release();
+        esp_crypto_sha_aes_lock_release();
+        esp_crypto_ecc_lock_release();
     }
 
     // Reset the Key Manager Clock