diff --git a/Cargo.lock b/Cargo.lock
index c4ce420cc9..2bbedc4d15 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -6434,6 +6434,7 @@ dependencies = [
  "tokio",
  "tokio-util",
  "tracing",
+ "zeroize",
 ]
 
 [[package]]
diff --git a/common/nymnoise/Cargo.toml b/common/nymnoise/Cargo.toml
index 07893e59b1..0b437eb5b2 100644
--- a/common/nymnoise/Cargo.toml
+++ b/common/nymnoise/Cargo.toml
@@ -16,6 +16,7 @@ snow = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true, features = ["net", "io-util", "time"] }
 tokio-util = { workspace = true, features = ["codec"] }
+zeroize = { workspace = true }
 
 # internal
 nym-crypto = { path = "../crypto" }
diff --git a/common/nymnoise/src/config.rs b/common/nymnoise/src/config.rs
index fa862a404f..18e4da3bbd 100644
--- a/common/nymnoise/src/config.rs
+++ b/common/nymnoise/src/config.rs
@@ -115,19 +115,11 @@ impl NoiseConfig {
     // Only for phased update
     //SW This can lead to some troubles if two nodes shares the same IP and one support Noise but not the other. This in only for the progressive update though and there is no workaround
     pub(crate) fn get_noise_support(&self, ip_addr: IpAddr) -> Option<NoiseVersion> {
-        self.network
-            .support
-            .inner
-            .load()
-            .get(&ip_addr)
-            .copied()
-            .or_else(|| {
-                self.network
-                    .support
-                    .inner
-                    .load()
-                    .get(&ip_addr.to_canonical()) // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
-                    .copied()
-            })
+        let plain_ip_support = self.network.support.inner.load().get(&ip_addr).copied();
+
+        // SW default bind address being [::]:1789, it can happen that a responder sees the ipv6-mapped address of the initiator, this check for that
+        let canonical_ip = &ip_addr.to_canonical();
+        let canonical_ip_support = self.network.support.inner.load().get(canonical_ip).copied();
+        plain_ip_support.or(canonical_ip_support)
     }
 }
diff --git a/common/nymnoise/src/lib.rs b/common/nymnoise/src/lib.rs
index b55958e27e..0728ac3afa 100644
--- a/common/nymnoise/src/lib.rs
+++ b/common/nymnoise/src/lib.rs
@@ -11,6 +11,7 @@ use sha2::{Digest, Sha256};
 use snow::{error::Prerequisite, Builder, Error};
 use tokio::net::TcpStream;
 use tracing::*;
+use zeroize::Zeroizing;
 
 pub mod config;
 pub mod connection;
@@ -21,6 +22,13 @@ const NOISE_PSK_PREFIX: &[u8] = b"NYMTECH_NOISE_dQw4w9WgXcQ";
 
 pub const LATEST_NOISE_VERSION: NoiseVersion = NoiseVersion::V1;
 
+fn generate_psk_v1(responder_pub_key: &x25519::PublicKey) -> [u8; 32] {
+    let mut hasher = Sha256::new();
+    hasher.update(NOISE_PSK_PREFIX);
+    hasher.update(responder_pub_key.to_bytes());
+    hasher.finalize().into()
+}
+
 async fn upgrade_noise_initiator_v1(
     conn: TcpStream,
     config: &NoiseConfig,
@@ -28,15 +36,10 @@ async fn upgrade_noise_initiator_v1(
 ) -> Result<Connection, NoiseError> {
     trace!("Perform Noise Handshake, initiator side");
 
-    let secret = [
-        NOISE_PSK_PREFIX.to_vec(),
-        remote_pub_key.to_bytes().to_vec(),
-    ]
-    .concat();
-    let secret_hash = Sha256::digest(secret);
+    let secret_hash = generate_psk_v1(remote_pub_key);
 
     let handshake = Builder::new(config.pattern.as_str().parse()?)
-        .local_private_key(&config.local_key.private_key().to_bytes())
+        .local_private_key(Zeroizing::new(config.local_key.private_key().to_bytes()).as_ref())
         .remote_public_key(&remote_pub_key.to_bytes())
         .psk(config.pattern.psk_position(), &secret_hash)
         .build_initiator()?;
@@ -86,12 +89,7 @@ async fn upgrade_noise_responder_v1(
 ) -> Result<Connection, NoiseError> {
     trace!("Perform Noise Handshake, responder side");
 
-    let secret = [
-        NOISE_PSK_PREFIX.to_vec(),
-        config.local_key.public_key().to_bytes().to_vec(),
-    ]
-    .concat();
-    let secret_hash = Sha256::digest(secret);
+    let secret_hash = generate_psk_v1(config.local_key.public_key());
 
     let handshake = Builder::new(config.pattern.as_str().parse()?)
         .local_private_key(&config.local_key.private_key().to_bytes())