diff --git a/crypto/cipher/e_tls.cc b/crypto/cipher/e_tls.cc
index ccb677b..d803ea6 100644
--- a/crypto/cipher/e_tls.cc
+++ b/crypto/cipher/e_tls.cc
@@ -31,7 +31,7 @@
 
 typedef struct {
   EVP_CIPHER_CTX cipher_ctx;
-  HMAC_CTX hmac_ctx;
+  HMAC_CTX *hmac_ctx;
   // mac_key is the portion of the key used for the MAC. It is retained
   // separately for the constant-time CBC code.
   uint8_t mac_key[EVP_MAX_MD_SIZE];
@@ -51,15 +51,14 @@
 static void aead_tls_cleanup(EVP_AEAD_CTX *ctx) {
   AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)&ctx->state;
   EVP_CIPHER_CTX_cleanup(&tls_ctx->cipher_ctx);
-  HMAC_CTX_cleanup(&tls_ctx->hmac_ctx);
+  HMAC_CTX_free(tls_ctx->hmac_ctx);
 }
 
 static int aead_tls_init(EVP_AEAD_CTX *ctx, const uint8_t *key, size_t key_len,
                          size_t tag_len, enum evp_aead_direction_t dir,
                          const EVP_CIPHER *cipher, const EVP_MD *md,
                          char implicit_iv) {
-  if (tag_len != EVP_AEAD_DEFAULT_TAG_LENGTH &&
-      tag_len != EVP_MD_size(md)) {
+  if (tag_len != EVP_AEAD_DEFAULT_TAG_LENGTH && tag_len != EVP_MD_size(md)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_UNSUPPORTED_TAG_SIZE);
     return 0;
   }
@@ -72,11 +71,15 @@
   size_t mac_key_len = EVP_MD_size(md);
   size_t enc_key_len = EVP_CIPHER_key_length(cipher);
   assert(mac_key_len + enc_key_len +
-         (implicit_iv ? EVP_CIPHER_iv_length(cipher) : 0) == key_len);
+             (implicit_iv ? EVP_CIPHER_iv_length(cipher) : 0) ==
+         key_len);
 
   AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)&ctx->state;
+  tls_ctx->hmac_ctx = HMAC_CTX_new();
+  if (!tls_ctx->hmac_ctx) {
+    return 0;
+  }
   EVP_CIPHER_CTX_init(&tls_ctx->cipher_ctx);
-  HMAC_CTX_init(&tls_ctx->hmac_ctx);
   assert(mac_key_len <= EVP_MAX_MD_SIZE);
   OPENSSL_memcpy(tls_ctx->mac_key, key, mac_key_len);
   tls_ctx->mac_key_len = (uint8_t)mac_key_len;
@@ -85,7 +88,7 @@
   if (!EVP_CipherInit_ex(&tls_ctx->cipher_ctx, cipher, NULL, &key[mac_key_len],
                          implicit_iv ? &key[mac_key_len + enc_key_len] : NULL,
                          dir == evp_aead_seal) ||
-      !HMAC_Init_ex(&tls_ctx->hmac_ctx, key, mac_key_len, md, NULL)) {
+      !HMAC_Init_ex(tls_ctx->hmac_ctx, key, mac_key_len, md, NULL)) {
     aead_tls_cleanup(ctx);
     return 0;
   }
@@ -99,7 +102,7 @@
   assert(extra_in_len == 0);
   const AEAD_TLS_CTX *tls_ctx = (AEAD_TLS_CTX *)&ctx->state;
 
-  const size_t hmac_len = HMAC_size(&tls_ctx->hmac_ctx);
+  const size_t hmac_len = HMAC_size(tls_ctx->hmac_ctx);
   if (EVP_CIPHER_CTX_mode(&tls_ctx->cipher_ctx) != EVP_CIPH_CBC_MODE) {
     // The NULL cipher.
     return hmac_len;
@@ -160,11 +163,11 @@
   // in-place.
   uint8_t mac[EVP_MAX_MD_SIZE];
   unsigned mac_len;
-  if (!HMAC_Init_ex(&tls_ctx->hmac_ctx, NULL, 0, NULL, NULL) ||
-      !HMAC_Update(&tls_ctx->hmac_ctx, ad, ad_len) ||
-      !HMAC_Update(&tls_ctx->hmac_ctx, ad_extra, sizeof(ad_extra)) ||
-      !HMAC_Update(&tls_ctx->hmac_ctx, in, in_len) ||
-      !HMAC_Final(&tls_ctx->hmac_ctx, mac, &mac_len)) {
+  if (!HMAC_Init_ex(tls_ctx->hmac_ctx, NULL, 0, NULL, NULL) ||
+      !HMAC_Update(tls_ctx->hmac_ctx, ad, ad_len) ||
+      !HMAC_Update(tls_ctx->hmac_ctx, ad_extra, sizeof(ad_extra)) ||
+      !HMAC_Update(tls_ctx->hmac_ctx, in, in_len) ||
+      !HMAC_Final(tls_ctx->hmac_ctx, mac, &mac_len)) {
     return 0;
   }
 
@@ -187,7 +190,8 @@
   // block from encrypting the input and split the result between |out| and
   // |out_tag|. Then feed the rest.
 
-  const size_t early_mac_len = (block_size - (in_len % block_size)) % block_size;
+  const size_t early_mac_len =
+      (block_size - (in_len % block_size)) % block_size;
   if (early_mac_len != 0) {
     assert(len + block_size - early_mac_len == in_len);
     uint8_t buf[EVP_MAX_BLOCK_LENGTH];
@@ -245,7 +249,7 @@
     return 0;
   }
 
-  if (in_len < HMAC_size(&tls_ctx->hmac_ctx)) {
+  if (in_len < HMAC_size(tls_ctx->hmac_ctx)) {
     OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
     return 0;
   }
@@ -303,7 +307,7 @@
     if (!EVP_tls_cbc_remove_padding(
             &padding_ok, &data_plus_mac_len, out, total,
             EVP_CIPHER_CTX_block_size(&tls_ctx->cipher_ctx),
-            HMAC_size(&tls_ctx->hmac_ctx))) {
+            HMAC_size(tls_ctx->hmac_ctx))) {
       // Publicly invalid. This can be rejected in non-constant time.
       OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
       return 0;
@@ -313,9 +317,9 @@
     data_plus_mac_len = total;
     // |data_plus_mac_len| = |total| = |in_len| at this point. |in_len| has
     // already been checked against the MAC size at the top of the function.
-    assert(data_plus_mac_len >= HMAC_size(&tls_ctx->hmac_ctx));
+    assert(data_plus_mac_len >= HMAC_size(tls_ctx->hmac_ctx));
   }
-  size_t data_len = data_plus_mac_len - HMAC_size(&tls_ctx->hmac_ctx);
+  size_t data_len = data_plus_mac_len - HMAC_size(tls_ctx->hmac_ctx);
 
   // At this point, if the padding is valid, the first |data_plus_mac_len| bytes
   // after |out| are the plaintext and MAC. Otherwise, |data_plus_mac_len| is
@@ -335,14 +339,14 @@
   uint8_t record_mac_tmp[EVP_MAX_MD_SIZE];
   uint8_t *record_mac;
   if (EVP_CIPHER_CTX_mode(&tls_ctx->cipher_ctx) == EVP_CIPH_CBC_MODE &&
-      EVP_tls_cbc_record_digest_supported(tls_ctx->hmac_ctx.md)) {
-    if (!EVP_tls_cbc_digest_record(tls_ctx->hmac_ctx.md, mac, &mac_len,
+      EVP_tls_cbc_record_digest_supported(tls_ctx->hmac_ctx->md)) {
+    if (!EVP_tls_cbc_digest_record(tls_ctx->hmac_ctx->md, mac, &mac_len,
                                    ad_fixed, out, data_len, total,
                                    tls_ctx->mac_key, tls_ctx->mac_key_len)) {
       OPENSSL_PUT_ERROR(CIPHER, CIPHER_R_BAD_DECRYPT);
       return 0;
     }
-    assert(mac_len == HMAC_size(&tls_ctx->hmac_ctx));
+    assert(mac_len == HMAC_size(tls_ctx->hmac_ctx));
 
     record_mac = record_mac_tmp;
     EVP_tls_cbc_copy_mac(record_mac, mac_len, out, data_plus_mac_len, total);
@@ -352,15 +356,15 @@
     assert(EVP_CIPHER_CTX_mode(&tls_ctx->cipher_ctx) != EVP_CIPH_CBC_MODE);
 
     unsigned mac_len_u;
-    if (!HMAC_Init_ex(&tls_ctx->hmac_ctx, NULL, 0, NULL, NULL) ||
-        !HMAC_Update(&tls_ctx->hmac_ctx, ad_fixed, ad_len) ||
-        !HMAC_Update(&tls_ctx->hmac_ctx, out, data_len) ||
-        !HMAC_Final(&tls_ctx->hmac_ctx, mac, &mac_len_u)) {
+    if (!HMAC_Init_ex(tls_ctx->hmac_ctx, NULL, 0, NULL, NULL) ||
+        !HMAC_Update(tls_ctx->hmac_ctx, ad_fixed, ad_len) ||
+        !HMAC_Update(tls_ctx->hmac_ctx, out, data_len) ||
+        !HMAC_Final(tls_ctx->hmac_ctx, mac, &mac_len_u)) {
       return 0;
     }
     mac_len = mac_len_u;
 
-    assert(mac_len == HMAC_size(&tls_ctx->hmac_ctx));
+    assert(mac_len == HMAC_size(tls_ctx->hmac_ctx));
     record_mac = &out[data_len];
   }
 
diff --git a/crypto/digest/digest_extra.cc b/crypto/digest/digest_extra.cc
index 4cbfa1f..309b61c 100644
--- a/crypto/digest/digest_extra.cc
+++ b/crypto/digest/digest_extra.cc
@@ -230,6 +230,8 @@
 
 const EVP_MD *EVP_blake2b256(void) { return &evp_md_blake2b256; }
 
+static_assert(sizeof(BLAKE2B_CTX) <= EVP_MAX_MD_DATA_SIZE);
+
 
 static void md4_init(EVP_MD_CTX *ctx) {
   BSSL_CHECK(MD4_Init(reinterpret_cast<MD4_CTX *>(ctx->md_data)));
@@ -257,6 +259,9 @@
 
 const EVP_MD *EVP_md4(void) { return &evp_md_md4; }
 
+static_assert(sizeof(MD4_CTX) <= EVP_MAX_MD_DATA_SIZE);
+
+
 static void md5_init(EVP_MD_CTX *ctx) {
   BSSL_CHECK(MD5_Init(reinterpret_cast<MD5_CTX *>(ctx->md_data)));
 }
@@ -277,6 +282,9 @@
 
 const EVP_MD *EVP_md5(void) { return &evp_md_md5; }
 
+static_assert(sizeof(MD5_CTX) <= EVP_MAX_MD_DATA_SIZE);
+
+
 typedef struct {
   MD5_CTX md5;
   SHA_CTX sha1;
@@ -312,3 +320,5 @@
 };
 
 const EVP_MD *EVP_md5_sha1(void) { return &evp_md_md5_sha1; }
+
+static_assert(sizeof(MD5_SHA1_CTX) <= EVP_MAX_MD_DATA_SIZE);
diff --git a/crypto/fipsmodule/digest/digest.cc.inc b/crypto/fipsmodule/digest/digest.cc.inc
index 2edef42..82cc00a 100644
--- a/crypto/fipsmodule/digest/digest.cc.inc
+++ b/crypto/fipsmodule/digest/digest.cc.inc
@@ -36,7 +36,9 @@
 
 
 void EVP_MD_CTX_init(EVP_MD_CTX *ctx) {
-  OPENSSL_memset(ctx, 0, sizeof(EVP_MD_CTX));
+  ctx->digest = nullptr;
+  ctx->pctx = nullptr;
+  ctx->pctx_ops = nullptr;
 }
 
 EVP_MD_CTX *EVP_MD_CTX_new(void) {
@@ -53,8 +55,6 @@
 EVP_MD_CTX *EVP_MD_CTX_create(void) { return EVP_MD_CTX_new(); }
 
 int EVP_MD_CTX_cleanup(EVP_MD_CTX *ctx) {
-  OPENSSL_free(ctx->md_data);
-
   assert(ctx->pctx == NULL || ctx->pctx_ops != NULL);
   if (ctx->pctx_ops) {
     ctx->pctx_ops->free(ctx->pctx);
@@ -66,7 +66,7 @@
 }
 
 void EVP_MD_CTX_cleanse(EVP_MD_CTX *ctx) {
-  OPENSSL_cleanse(ctx->md_data, ctx->digest->ctx_size);
+  OPENSSL_cleanse(ctx->md_data, sizeof(ctx->md_data));
   EVP_MD_CTX_cleanup(ctx);
 }
 
@@ -107,31 +107,9 @@
     }
   }
 
-  uint8_t *tmp_buf = NULL;
-  if (in->digest != NULL) {
-    if (out->digest != in->digest) {
-      assert(in->digest->ctx_size != 0);
-      tmp_buf =
-          reinterpret_cast<uint8_t *>(OPENSSL_malloc(in->digest->ctx_size));
-      if (tmp_buf == NULL) {
-        if (pctx) {
-          in->pctx_ops->free(pctx);
-        }
-        return 0;
-      }
-    } else {
-      // |md_data| will be the correct size in this case. It's removed from
-      // |out| so that |EVP_MD_CTX_cleanup| doesn't free it, and then it's
-      // reused.
-      tmp_buf = reinterpret_cast<uint8_t *>(out->md_data);
-      out->md_data = NULL;
-    }
-  }
-
   EVP_MD_CTX_cleanup(out);
 
   out->digest = in->digest;
-  out->md_data = tmp_buf;
   if (in->digest != NULL) {
     OPENSSL_memcpy(out->md_data, in->md_data, in->digest->ctx_size);
   }
@@ -167,14 +145,7 @@
 int EVP_DigestInit_ex(EVP_MD_CTX *ctx, const EVP_MD *type, ENGINE *engine) {
   if (ctx->digest != type) {
     assert(type->ctx_size != 0);
-    uint8_t *md_data =
-        reinterpret_cast<uint8_t *>(OPENSSL_malloc(type->ctx_size));
-    if (md_data == NULL) {
-      return 0;
-    }
-
-    OPENSSL_free(ctx->md_data);
-    ctx->md_data = md_data;
+    assert(type->ctx_size <= sizeof(ctx->md_data));
     ctx->digest = type;
   }
 
diff --git a/crypto/fipsmodule/digest/digests.cc.inc b/crypto/fipsmodule/digest/digests.cc.inc
index 3c1bfac..99e3a66 100644
--- a/crypto/fipsmodule/digest/digests.cc.inc
+++ b/crypto/fipsmodule/digest/digests.cc.inc
@@ -54,6 +54,8 @@
   out->ctx_size = sizeof(SHA_CTX);
 }
 
+static_assert(sizeof(SHA_CTX) <= EVP_MAX_MD_DATA_SIZE);
+
 
 static void sha224_init(EVP_MD_CTX *ctx) {
   BCM_sha224_init(reinterpret_cast<SHA256_CTX *>(ctx->md_data));
@@ -78,6 +80,7 @@
   out->ctx_size = sizeof(SHA256_CTX);
 }
 
+static_assert(sizeof(SHA256_CTX) <= EVP_MAX_MD_DATA_SIZE);
 
 static void sha256_init(EVP_MD_CTX *ctx) {
   BCM_sha256_init(reinterpret_cast<SHA256_CTX *>(ctx->md_data));
@@ -126,6 +129,7 @@
   out->ctx_size = sizeof(SHA512_CTX);
 }
 
+static_assert(sizeof(SHA512_CTX) <= EVP_MAX_MD_DATA_SIZE);
 
 static void sha512_init(EVP_MD_CTX *ctx) {
   BCM_sha512_init(reinterpret_cast<SHA512_CTX *>(ctx->md_data));
diff --git a/include/openssl/digest.h b/include/openssl/digest.h
index b5f76c3..2db31de 100644
--- a/include/openssl/digest.h
+++ b/include/openssl/digest.h
@@ -283,17 +283,27 @@
 OPENSSL_EXPORT int EVP_MD_nid(const EVP_MD *md);
 
 
+// Internal constants and structures (hidden).
+
 struct evp_md_pctx_ops;
 
+// EVP_MAX_MD_DATA_SIZE is a private constant which specifies the size of the
+// largest digest state. SHA-512 and BLAKE2b are joint-largest. Consuming code
+// only uses this via the `EVP_MD_CTX` type.
+#define EVP_MAX_MD_DATA_SIZE 216
+
 // env_md_ctx_st is typoed ("evp" -> "env"), but the typo comes from OpenSSL
 // and some consumers forward-declare these structures so we're leaving it
 // alone.
 struct env_md_ctx_st {
+  // md_data contains the hash-specific context.
+  union {
+    uint8_t md_data[EVP_MAX_MD_DATA_SIZE];
+    uint64_t alignment;
+  };
+
   // digest is the underlying digest function, or NULL if not set.
   const EVP_MD *digest;
-  // md_data points to a block of memory that contains the hash-specific
-  // context.
-  void *md_data;
 
   // pctx is an opaque (at this layer) pointer to additional context that
   // EVP_PKEY functions may store in this object.