diff --git a/tests/include/test/ssl_helpers.h b/tests/include/test/ssl_helpers.h
index 31103ece19..33ed2a883d 100644
--- a/tests/include/test/ssl_helpers.h
+++ b/tests/include/test/ssl_helpers.h
@@ -600,6 +600,7 @@ int mbedtls_test_ssl_exchange_data(
 int mbedtls_test_ssl_do_handshake_with_endpoints(
     mbedtls_test_ssl_endpoint *server_ep,
     mbedtls_test_ssl_endpoint *client_ep,
+    mbedtls_test_handshake_test_options *options,
     mbedtls_ssl_protocol_version proto);
 #endif /* defined(MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED) */
 
diff --git a/tests/src/test_helpers/ssl_helpers.c b/tests/src/test_helpers/ssl_helpers.c
index 770b0cbcd7..e7b80b1dba 100644
--- a/tests/src/test_helpers/ssl_helpers.c
+++ b/tests/src/test_helpers/ssl_helpers.c
@@ -2041,25 +2041,25 @@ exit:
 int mbedtls_test_ssl_do_handshake_with_endpoints(
     mbedtls_test_ssl_endpoint *server_ep,
     mbedtls_test_ssl_endpoint *client_ep,
+    mbedtls_test_handshake_test_options *options,
     mbedtls_ssl_protocol_version proto)
 {
     enum { BUFFSIZE = 1024 };
 
     int ret = -1;
-    mbedtls_test_handshake_test_options options;
 
-    mbedtls_test_init_handshake_options(&options);
-    options.server_min_version = proto;
-    options.client_min_version = proto;
-    options.server_max_version = proto;
-    options.client_max_version = proto;
+    mbedtls_test_init_handshake_options(options);
+    options->server_min_version = proto;
+    options->client_min_version = proto;
+    options->server_max_version = proto;
+    options->client_max_version = proto;
 
-    ret = mbedtls_test_ssl_endpoint_init(client_ep, MBEDTLS_SSL_IS_CLIENT, &options,
+    ret = mbedtls_test_ssl_endpoint_init(client_ep, MBEDTLS_SSL_IS_CLIENT, options,
                                          NULL, NULL, NULL);
     if (ret != 0) {
         return ret;
     }
-    ret = mbedtls_test_ssl_endpoint_init(server_ep, MBEDTLS_SSL_IS_SERVER, &options,
+    ret = mbedtls_test_ssl_endpoint_init(server_ep, MBEDTLS_SSL_IS_SERVER, options,
                                          NULL, NULL, NULL);
     if (ret != 0) {
         return ret;
diff --git a/tests/suites/test_suite_ssl.function b/tests/suites/test_suite_ssl.function
index 332e16ac6c..0925a06137 100644
--- a/tests/suites/test_suite_ssl.function
+++ b/tests/suites/test_suite_ssl.function
@@ -5736,10 +5736,11 @@ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int
     uint8_t *key_buffer_server = NULL;
     uint8_t *key_buffer_client = NULL;
     mbedtls_test_ssl_endpoint client_ep, server_ep;
+    mbedtls_test_handshake_test_options options;
 
     MD_OR_USE_PSA_INIT();
 
-    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, proto);
+    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, &options, proto);
     TEST_ASSERT(ret == 0);
 
     TEST_ASSERT(exported_key_length > 0);
@@ -5762,6 +5763,9 @@ void ssl_tls_exporter_consistent_result(int proto, int exported_key_length, int
 
 exit:
     MD_OR_USE_PSA_DONE();
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
     mbedtls_free(key_buffer_server);
     mbedtls_free(key_buffer_client);
 }
@@ -5774,10 +5778,11 @@ void ssl_tls_exporter_uses_label(int proto)
 
     int ret = -1;
     mbedtls_test_ssl_endpoint client_ep, server_ep;
+    mbedtls_test_handshake_test_options options;
 
     MD_OR_USE_PSA_INIT();
 
-    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, proto);
+    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, &options, proto);
     TEST_ASSERT(ret == 0);
 
     char label_server[] = "test-label-server";
@@ -5798,6 +5803,9 @@ void ssl_tls_exporter_uses_label(int proto)
     TEST_ASSERT(memcmp(key_buffer_server, key_buffer_client, sizeof(key_buffer_server)) != 0);
 
 exit:
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
     MD_OR_USE_PSA_DONE();
 }
 /* END_CASE */
@@ -5809,10 +5817,11 @@ void ssl_tls_exporter_uses_context(int proto)
 
     int ret = -1;
     mbedtls_test_ssl_endpoint client_ep, server_ep;
+    mbedtls_test_handshake_test_options options;
 
     MD_OR_USE_PSA_INIT();
 
-    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, proto);
+    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, &options, proto);
     TEST_ASSERT(ret == 0);
 
     char label[] = "test-label";
@@ -5833,6 +5842,9 @@ void ssl_tls_exporter_uses_context(int proto)
     TEST_ASSERT(memcmp(key_buffer_server, key_buffer_client, sizeof(key_buffer_server)) != 0);
 
 exit:
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
     MD_OR_USE_PSA_DONE();
 }
 /* END_CASE */
@@ -5845,10 +5857,11 @@ void ssl_tls13_exporter_uses_length(void)
 
     int ret = -1;
     mbedtls_test_ssl_endpoint client_ep, server_ep;
+    mbedtls_test_handshake_test_options options;
 
     MD_OR_USE_PSA_INIT();
 
-    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, MBEDTLS_SSL_VERSION_TLS1_3);
+    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, &options, MBEDTLS_SSL_VERSION_TLS1_3);
     TEST_ASSERT(ret == 0);
 
     char label[] = "test-label";
@@ -5868,6 +5881,9 @@ void ssl_tls13_exporter_uses_length(void)
     TEST_ASSERT(memcmp(key_buffer_server, key_buffer_client, sizeof(key_buffer_server)) != 0);
 
 exit:
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
     MD_OR_USE_PSA_DONE();
 }
 /* END_CASE */
@@ -5883,6 +5899,7 @@ void ssl_tls_exporter_rejects_bad_parameters(
     char *label = NULL;
     uint8_t *context = NULL;
     mbedtls_test_ssl_endpoint client_ep, server_ep;
+    mbedtls_test_handshake_test_options options;
 
     TEST_ASSERT(exported_key_length > 0);
     TEST_ASSERT(label_length > 0);
@@ -5891,7 +5908,7 @@ void ssl_tls_exporter_rejects_bad_parameters(
     TEST_CALLOC(label, label_length);
     TEST_CALLOC(context, context_length);
 
-    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, proto);
+    ret = mbedtls_test_ssl_do_handshake_with_endpoints(&server_ep, &client_ep, &options, proto);
     TEST_ASSERT(ret == 0);
 
     ret = mbedtls_ssl_export_keying_material(&client_ep.ssl,
@@ -5902,6 +5919,9 @@ void ssl_tls_exporter_rejects_bad_parameters(
 
 exit:
     MD_OR_USE_PSA_DONE();
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
     mbedtls_free(key_buffer);
     mbedtls_free(label);
     mbedtls_free(context);
@@ -5954,5 +5974,8 @@ void ssl_tls_exporter_too_early(int proto, int check_server, int state)
 
 exit:
     MD_OR_USE_PSA_DONE();
+    mbedtls_test_ssl_endpoint_free(&server_ep, NULL);
+    mbedtls_test_ssl_endpoint_free(&client_ep, NULL);
+    mbedtls_test_free_handshake_options(&options);
 }
 /* END_CASE */