diff --git a/src/core/meshcop/joiner.cpp b/src/core/meshcop/joiner.cpp
index 3455bb683..61a1fe119 100644
--- a/src/core/meshcop/joiner.cpp
+++ b/src/core/meshcop/joiner.cpp
@@ -184,6 +184,7 @@ void Joiner::Finish(Error aError)
     case kStateJoined:
         Get<Tmf::SecureAgent>().Disconnect();
         mTimer.Stop();
+        Get<KeyManager>().ClearKek();
 
         OT_FALL_THROUGH;
 
diff --git a/src/core/meshcop/joiner_router.cpp b/src/core/meshcop/joiner_router.cpp
index 21060bb48..243635826 100644
--- a/src/core/meshcop/joiner_router.cpp
+++ b/src/core/meshcop/joiner_router.cpp
@@ -302,6 +302,8 @@ exit:
 
 void JoinerRouter::HandleJoinerEntrustResponse(Coap::Msg *aMsg, Error aResult)
 {
+    Get<KeyManager>().ClearKek();
+
     SendDelayedJoinerEntrust();
 
     VerifyOrExit(aResult == kErrorNone && aMsg != nullptr);
diff --git a/src/core/thread/key_manager.cpp b/src/core/thread/key_manager.cpp
index e7b70dedf..d5e995309 100644
--- a/src/core/thread/key_manager.cpp
+++ b/src/core/thread/key_manager.cpp
@@ -516,6 +516,12 @@ void KeyManager::SetKek(const Kek &aKek)
     mIsKekSet        = true;
 }
 
+void KeyManager::ClearKek(void)
+{
+    mKek.Clear();
+    mIsKekSet = false;
+}
+
 void KeyManager::SetSecurityPolicy(const SecurityPolicy &aSecurityPolicy)
 {
     SecurityPolicy newPolicy = aSecurityPolicy;
diff --git a/src/core/thread/key_manager.hpp b/src/core/thread/key_manager.hpp
index f3b4fe396..763d77109 100644
--- a/src/core/thread/key_manager.hpp
+++ b/src/core/thread/key_manager.hpp
@@ -485,6 +485,11 @@ public:
      */
     void SetKek(const uint8_t *aKekBytes) { SetKek(*reinterpret_cast<const Kek *>(aKekBytes)); }
 
+    /**
+     * Clears the KEK.
+     */
+    void ClearKek(void);
+
     /**
      * Returns the current KEK Frame Counter value.
      *