diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
index 4a202d7..ea241c1 100644
--- a/ssl/tls13_client.c
+++ b/ssl/tls13_client.c
@@ -311,7 +311,11 @@
     return ssl_hs_error;
   }
 
-  if (!tls13_set_handshake_traffic(hs)) {
+  if (!tls13_derive_handshake_secrets(hs) ||
+      !tls13_set_traffic_key(ssl, evp_aead_open, hs->server_handshake_secret,
+                             hs->hash_len) ||
+      !tls13_set_traffic_key(ssl, evp_aead_seal, hs->client_handshake_secret,
+                             hs->hash_len)) {
     return ssl_hs_error;
   }