diff --git a/cpu/esp32/include/syscalls.h b/cpu/esp32/include/syscalls.h
index fa4182efcf..0151453b70 100644
--- a/cpu/esp32/include/syscalls.h
+++ b/cpu/esp32/include/syscalls.h
@@ -23,6 +23,7 @@
 
 #include <stdarg.h>
 #include <stdbool.h>
+#include <stdint.h>
 #include <stdlib.h>
 
 #include "esp_common.h"
@@ -61,6 +62,9 @@ void system_wdt_stop (void);
 /** reset the system watchdog timer */
 void system_wdt_feed (void);
 
+/** memset version that the compiler should not be allowed to optimize this */
+void *system_secure_memset(void *s, int c, size_t n);
+
 #ifdef __cplusplus
 }
 #endif
diff --git a/cpu/esp32/syscalls.c b/cpu/esp32/syscalls.c
index 6d3cc6da67..674441e6d8 100644
--- a/cpu/esp32/syscalls.c
+++ b/cpu/esp32/syscalls.c
@@ -595,3 +595,18 @@ void system_wdt_start (void)
     TIMERG0.wdt_wprotect = 0;     /* enable write protection */
     xt_ints_on(BIT(CPU_INUM_WDT));
 }
+
+__attribute__((weak)) void
+_system_prevent_memset_lto(void *const  s, int c, const size_t n)
+{
+    (void) s;
+    (void) c;
+    (void) n;
+}
+
+void *system_secure_memset(void *s, int c, size_t n)
+{
+    memset(s, c, n);
+    _system_prevent_memset_lto(s, c, n);
+    return s;
+}
diff --git a/cpu/esp32/vendor/esp-idf/wpa_supplicant/port/include/os.h b/cpu/esp32/vendor/esp-idf/wpa_supplicant/port/include/os.h
index 3db4416edc..441e117ebb 100644
--- a/cpu/esp32/vendor/esp-idf/wpa_supplicant/port/include/os.h
+++ b/cpu/esp32/vendor/esp-idf/wpa_supplicant/port/include/os.h
@@ -19,6 +19,11 @@
 extern "C" {
 #endif
 
+#ifdef RIOT_VERSION
+#include "syscalls.h"
+#define os_memset   system_secure_memset
+#endif
+
 #include "esp_types.h"
 #include <string.h>
 #include <stdio.h>