diff --git a/library/psa_crypto_rsa.c b/library/psa_crypto_rsa.c
index 5413e9893c..170774ee1a 100644
--- a/library/psa_crypto_rsa.c
+++ b/library/psa_crypto_rsa.c
@@ -25,6 +25,7 @@
 #include <mbedtls/rsa.h>
 #include <mbedtls/error.h>
 #include "rsa_internal.h"
+#include "constant_time_internal.h"
 
 #if defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT) || \
     defined(MBEDTLS_PSA_BUILTIN_ALG_RSA_OAEP) || \
@@ -655,7 +656,17 @@ psa_status_t mbedtls_psa_asymmetric_decrypt(const psa_key_attributes_t *attribut
             int ret = mbedtls_rsa_rsaes_pkcs1_v15_decrypt(
                 rsa, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE,
                 output_length, input, output, output_size);
+
+            /* We want to convert ret into a psa status without allowing an
+             * attacker to distinguish between 0 and invalid padding. Since
+             * mbedtls_psa_error() is leaky, hide the difference from it. */
+            mbedtls_ct_condition_t bad_padding = mbedtls_ct_uint_eq(
+                (mbedtls_ct_uint_t) ret,
+                (mbedtls_ct_uint_t) MBEDTLS_ERR_RSA_INVALID_PADDING);
+            ret = mbedtls_ct_error_if(bad_padding, 0, ret);
             status = mbedtls_to_psa_error(ret);
+            status = mbedtls_ct_error_if(bad_padding,
+                                         PSA_ERROR_INVALID_PADDING, status);
 #else
             status = PSA_ERROR_NOT_SUPPORTED;
 #endif /* MBEDTLS_PSA_BUILTIN_ALG_RSA_PKCS1V15_CRYPT */