diff --git a/ChangeLog.d/fix-client-fuzzing.txt b/ChangeLog.d/fix-client-fuzzing.txt
new file mode 100644
index 0000000000..8265c58105
--- /dev/null
+++ b/ChangeLog.d/fix-client-fuzzing.txt
@@ -0,0 +1,3 @@
+Bugfix
+	* Call to `psa_crypto_init()` before parsing the test CA certificate in the
+	  fuzzing programs for TLS and DTLS clients.
diff --git a/programs/fuzz/fuzz_client.c b/programs/fuzz/fuzz_client.c
index 8c99f2dddd..c55b3bfaf4 100644
--- a/programs/fuzz/fuzz_client.c
+++ b/programs/fuzz/fuzz_client.c
@@ -37,6 +37,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
     fuzzBufferOffset_t biomemfuzz;
     uint16_t options;
 
+    psa_status_t status = psa_crypto_init();
+    if (status != PSA_SUCCESS) {
+        goto exit;
+    }
+
     if (initialized == 0) {
 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
         mbedtls_x509_crt_init(&cacert);
@@ -66,11 +71,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
     mbedtls_ssl_init(&ssl);
     mbedtls_ssl_config_init(&conf);
 
-    psa_status_t status = psa_crypto_init();
-    if (status != PSA_SUCCESS) {
-        goto exit;
-    }
-
     if (mbedtls_ssl_config_defaults(&conf,
                                     MBEDTLS_SSL_IS_CLIENT,
                                     MBEDTLS_SSL_TRANSPORT_STREAM,
diff --git a/programs/fuzz/fuzz_dtlsclient.c b/programs/fuzz/fuzz_dtlsclient.c
index 508b796e8b..01fac617b9 100644
--- a/programs/fuzz/fuzz_dtlsclient.c
+++ b/programs/fuzz/fuzz_dtlsclient.c
@@ -33,6 +33,11 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
     unsigned char buf[4096];
     fuzzBufferOffset_t biomemfuzz;
 
+    psa_status_t status = psa_crypto_init();
+    if (status != PSA_SUCCESS) {
+        goto exit;
+    }
+
     if (initialized == 0) {
 #if defined(MBEDTLS_X509_CRT_PARSE_C) && defined(MBEDTLS_PEM_PARSE_C)
         mbedtls_x509_crt_init(&cacert);
@@ -49,11 +54,6 @@ int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size)
     mbedtls_ssl_init(&ssl);
     mbedtls_ssl_config_init(&conf);
 
-    psa_status_t status = psa_crypto_init();
-    if (status != PSA_SUCCESS) {
-        goto exit;
-    }
-
     if (mbedtls_ssl_config_defaults(&conf,
                                     MBEDTLS_SSL_IS_CLIENT,
                                     MBEDTLS_SSL_TRANSPORT_DATAGRAM,