diff --git a/src/mlkem_gcrypt.c b/src/mlkem_gcrypt.c
index 9e5eec3a..1898becb 100644
--- a/src/mlkem_gcrypt.c
+++ b/src/mlkem_gcrypt.c
@@ -175,6 +175,11 @@ int ssh_mlkem_decapsulate(const ssh_session session,
         return SSH_ERROR;
     }
 
+    if (crypto->mlkem_privkey == NULL) {
+        SSH_LOG(SSH_LOG_WARNING, "Missing ML-KEM private key in session");
+        return SSH_ERROR;
+    }
+
     mlkem_info = kex_type_to_mlkem_info(crypto->kex_type);
     if (mlkem_info == NULL) {
         SSH_LOG(SSH_LOG_WARNING, "Unknown ML-KEM type");