diff --git a/.kotlin/sessions/kotlin-compiler-7816880656539169480.salive b/.kotlin/sessions/kotlin-compiler-7816880656539169480.salive
new file mode 100644
index 0000000..e69de29
diff --git a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
index 8b81c70..3c5942f 100644
--- a/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
+++ b/app/src/main/java/org/matrix/TEESimulator/interception/keystore/shim/KeyMintSecurityLevelInterceptor.kt
@@ -157,13 +157,15 @@ class KeyMintSecurityLevelInterceptor(
                 val keyDescriptor = data.readTypedObject(KeyDescriptor.CREATOR)!!
                 val key = metadata.key!!
                 val keyId = KeyIdentifier(callingUid, keyDescriptor.alias)
+                CertificateHelper.updateCertificateChain(metadata, newChain).getOrThrow()
+
+                // We must clean up cached generated keys before storing the patched chain
+                cleanupKeyData(keyId)
                 patchedChains[keyId] = newChain
                 SystemLogger.debug(
                     "Cached patched certificate chain for $keyId. (${key.alias} [${key.domain}, ${key.nspace}])"
                 )
 
-                CertificateHelper.updateCertificateChain(metadata, newChain).getOrThrow()
-
                 return InterceptorUtils.createTypedObjectReply(metadata)
             }
         }
@@ -258,10 +260,11 @@ class KeyMintSecurityLevelInterceptor(
                             securityLevel,
                         ) ?: throw Exception("CertificateGenerator failed to create key pair.")
 
+                    // It is unnecessary but a good practice to clean up possible caches
+                    cleanupKeyData(keyId)
                     // Store the generated key data.
                     val response =
                         buildKeyEntryResponse(keyData.second, parsedParams, keyDescriptor)
-
                     generatedKeys[keyId] =
                         GeneratedKeyInfo(keyData.first, keyDescriptor.nspace, response)
                     if (isAttestKeyRequest) attestationKeys.add(keyId)