diff --git a/ChangeLog b/ChangeLog
index 829de3656..573968886 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,6 @@
+20140904
+ - (djm) [openbsd-compat/arc4random.c] Zero seed after keying PRNG
+
 20140903
  - (djm) [defines.h sshbuf.c] Move __predict_true|false to defines.h and
    conditionalise to avoid duplicate definition.
diff --git a/openbsd-compat/arc4random.c b/openbsd-compat/arc4random.c
index fa0d6301a..09dbfda16 100644
--- a/openbsd-compat/arc4random.c
+++ b/openbsd-compat/arc4random.c
@@ -87,7 +87,7 @@ _rs_stir(void)
 		_rs_init(rnd, sizeof(rnd));
 	} else
 		_rs_rekey(rnd, sizeof(rnd));
-	memset(rnd, 0, sizeof(rnd));
+	explicit_bzero(rnd, sizeof(rnd));
 
 	/* invalidate rs_buf */
 	rs_have = 0;