diff --git a/src/core/crypto/pbkdf2_cmac.cpp b/src/core/crypto/pbkdf2_cmac.cpp
index e46dc14e1..c2ad91b20 100644
--- a/src/core/crypto/pbkdf2_cmac.cpp
+++ b/src/core/crypto/pbkdf2_cmac.cpp
@@ -63,6 +63,11 @@ void otPbkdf2Cmac(const uint8_t *aPassword,
     OT_ASSERT(aIterationCounter % 2 == 0);
     aIterationCounter /= 2;
 
+#if FUZZING_BUILD_MODE_UNSAFE_FOR_PRODUCTION
+    // limit iterations to avoid OSS-Fuzz timeouts
+    aIterationCounter = 2;
+#endif
+
     while (keyLen)
     {
         ++blockCounter;