diff --git a/src/crypto/PSASpake2p.cpp b/src/crypto/PSASpake2p.cpp
index ee47c76d88719a..e366057658093f 100644
--- a/src/crypto/PSASpake2p.cpp
+++ b/src/crypto/PSASpake2p.cpp
@@ -1,5 +1,5 @@
 /*
- *    Copyright (c) 2023 Project CHIP Authors
+ *    Copyright (c) 2024 Project CHIP Authors
  *    All rights reserved.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
@@ -181,7 +181,7 @@ CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::KeyConfirm(const uint8_t * in, size
     return CHIP_NO_ERROR;
 }
 
-CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::GetKeys(uint8_t * out, size_t * out_len)
+CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::GetKeys(SessionKeystore & keystore, HkdfKeyHandle & key) const
 {
     auto & keyId = key.AsMutable<psa_key_id_t>();
 
@@ -191,7 +191,7 @@ CHIP_ERROR PSASpake2p_P256_SHA256_HKDF_HMAC::GetKeys(uint8_t * out, size_t * out
     psa_set_key_usage_flags(&attributes, PSA_KEY_USAGE_DERIVE);
     psa_set_key_algorithm(&attributes, PSA_ALG_HKDF(PSA_ALG_SHA_256));
 
-    psa_status_t status = psa_pake_get_shared_key(&mOperation, &attributes, &keyId);
+    psa_status_t status = psa_pake_get_shared_key(const_cast<psa_pake_operation_t *>(&(mOperation)), &attributes, &keyId);
     VerifyOrReturnError(status == PSA_SUCCESS, CHIP_ERROR_INTERNAL);
 
     return CHIP_NO_ERROR;
diff --git a/src/crypto/PSASpake2p.h b/src/crypto/PSASpake2p.h
index b416fa002bb28c..63bec92258efce 100644
--- a/src/crypto/PSASpake2p.h
+++ b/src/crypto/PSASpake2p.h
@@ -1,5 +1,5 @@
 /*
- *    Copyright (c) 2023 Project CHIP Authors
+ *    Copyright (c) 2024 Project CHIP Authors
  *    All rights reserved.
  *
  *    Licensed under the Apache License, Version 2.0 (the "License");
@@ -151,7 +151,7 @@ class PSASpake2p_P256_SHA256_HKDF_HMAC
      *
      * @return Returns a CHIP_ERROR on error, CHIP_NO_ERROR otherwise
      **/
-    CHIP_ERROR GetKeys(uint8_t * out, size_t * out_len);
+    CHIP_ERROR GetKeys(SessionKeystore & keystore, HkdfKeyHandle & key) const;
 
 private:
     psa_pake_operation_t mOperation = PSA_PAKE_OPERATION_INIT;
diff --git a/src/protocols/secure_channel/PASESession.h b/src/protocols/secure_channel/PASESession.h
index 4f134a6b6144fd..df95149362c868 100644
--- a/src/protocols/secure_channel/PASESession.h
+++ b/src/protocols/secure_channel/PASESession.h
@@ -202,7 +202,7 @@ class DLL_EXPORT PASESession : public Messaging::UnsolicitedMessageHandler,
     Optional<Protocols::SecureChannel::MsgType> mNextExpectedMsg;
 
 #if CHIP_CRYPTO_PSA_SPAKE2P
-    Spake2p_P256_SHA256_HKDF_HMAC mSpake2p;
+    Crypto::PSASpake2p_P256_SHA256_HKDF_HMAC mSpake2p;
 #else
     Crypto::Spake2p_P256_SHA256_HKDF_HMAC mSpake2p;
 #endif