diff --git a/src/image.c b/src/image.c
index 1af07da248..154671c044 100644
--- a/src/image.c
+++ b/src/image.c
@@ -818,17 +818,17 @@ static void wolfBoot_verify_signature_ml_dsa(uint8_t key_slot,
     ret = wc_MlDsaKey_Init(&ml_dsa, NULL, WOLFBOOT_DEVID_PUBKEY);
 
     if (ret != 0) {
+        /* Failed to initialize key, nothing to free */
         wolfBoot_printf("error: wc_MlDsaKey_Init returned %d\n", ret);
+        return;
     }
 
-    if (ret == 0) {
-        /* Set the ML-DSA security level. */
-        ret = wc_MlDsaKey_SetParams(&ml_dsa, ML_DSA_LEVEL);
+    /* Set the ML-DSA security level. */
+    ret = wc_MlDsaKey_SetParams(&ml_dsa, ML_DSA_LEVEL);
 
-        if (ret != 0) {
-            wolfBoot_printf("error: wc_MlDsaKey_SetParams(%d)" \
-                            " returned %d\n", ML_DSA_LEVEL, ret);
-        }
+    if (ret != 0) {
+        wolfBoot_printf("error: wc_MlDsaKey_SetParams(%d)" \
+                        " returned %d\n", ML_DSA_LEVEL, ret);
     }
 
 #if defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT) || \
@@ -836,32 +836,35 @@ static void wolfBoot_verify_signature_ml_dsa(uint8_t key_slot,
      defined(WOLFBOOT_CERT_CHAIN_VERIFY))
     /* Use the public key ID directly with wolfHSM (no local keystore) */
     (void)key_slot;
+    if (ret == 0) {
 #if defined(WOLFBOOT_CERT_CHAIN_VERIFY)
-    /* If using certificate chain verification and we have a verified leaf key
-     * ID */
-    if (g_leafKeyIdValid) {
-        /* Use the leaf key ID from certificate verification */
-    #if defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT)
-        ret = wh_Client_MlDsaSetKeyId(&ml_dsa, g_certLeafKeyId);
-    #elif defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
-        ret = wh_Server_MlDsaKeyCacheExport(&hsmServerCtx, g_certLeafKeyId,
-                                            &ml_dsa);
-    #endif
-        wolfBoot_printf(
-            "Using leaf cert public key (ID: %08x) for ML-DSA verification\n",
-            (unsigned int)g_certLeafKeyId);
-    }
-    else {
-        /* Default behavior: use the pre-configured public key ID */
-    #if defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT)
-        ret = wh_Client_MlDsaSetKeyId(&ml_dsa, hsmKeyIdPubKey);
-    #endif
-    }
+        /* If using certificate chain verification and we have a verified leaf
+         * key ID */
+        if (g_leafKeyIdValid) {
+            /* Use the leaf key ID from certificate verification */
+        #if defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT)
+            ret = wh_Client_MlDsaSetKeyId(&ml_dsa, g_certLeafKeyId);
+        #elif defined(WOLFBOOT_ENABLE_WOLFHSM_SERVER)
+            ret = wh_Server_MlDsaKeyCacheExport(&hsmServerCtx, g_certLeafKeyId,
+                                                &ml_dsa);
+        #endif
+            wolfBoot_printf(
+                "Using leaf cert public key (ID: %08x) for ML-DSA "
+                "verification\n",
+                (unsigned int)g_certLeafKeyId);
+        }
+        else {
+            /* Default behavior: use the pre-configured public key ID */
+        #if defined(WOLFBOOT_ENABLE_WOLFHSM_CLIENT)
+            ret = wh_Client_MlDsaSetKeyId(&ml_dsa, hsmKeyIdPubKey);
+        #endif
+        }
 #else
-    ret = wh_Client_MlDsaSetKeyId(&ml_dsa, hsmKeyIdPubKey);
+        ret = wh_Client_MlDsaSetKeyId(&ml_dsa, hsmKeyIdPubKey);
 #endif
-    if (ret != 0) {
-        wolfBoot_printf("error: ML-DSA set key ID returned %d\n", ret);
+        if (ret != 0) {
+            wolfBoot_printf("error: ML-DSA set key ID returned %d\n", ret);
+        }
     }
 #else
     /* Make sure pub key matches parameters and import it */