diff --git a/zephyr/Kconfig b/zephyr/Kconfig
index 49537d972..19c2243b1 100644
--- a/zephyr/Kconfig
+++ b/zephyr/Kconfig
@@ -115,4 +115,11 @@ config WPA_SUPP_DEBUG_LEVEL
       available levels and functions for emitting the messages. Note that
       runtime filtering can also be configured in addition to the compile-time
       filtering.
+
+config WPA_SUPP_DEBUG_SHOW_KEYS
+    bool "Show keys in debug output"
+    help
+      This option can be used to show keys (e.g., PSK, EAP session keys) in
+      debug log messages. This can be used to debug key derivation and
+      authentication issues. Please do not enable this option in production.
 endif
diff --git a/zephyr/src/supp_main.c b/zephyr/src/supp_main.c
index 15c915682..983601f24 100644
--- a/zephyr/src/supp_main.c
+++ b/zephyr/src/supp_main.c
@@ -404,6 +404,14 @@ static void z_wpas_start(void)
 		goto out;
 	}
 
+#if defined (CONFIG_WPA_SUPP_LOG_LEVEL_DBG) && defined (CONFIG_WPA_SUPP_DEBUG_SHOW_KEYS)
+	wpa_supplicant_set_debug_params(global, MSG_DEBUG, 1, 1);
+#elif defined (CONFIG_WPA_SUPP_LOG_LEVEL_DBG)
+	wpa_supplicant_set_debug_params(global, MSG_DEBUG, 1, 0);
+#else
+	wpa_supplicant_set_debug_params(global, MSG_INFO, 0, 0);
+#endif
+
 #if defined(CONFIG_FST) && defined(CONFIG_CTRL_IFACE)
 	if (!fst_global_add_ctrl(fst_ctrl_cli)) {
 		wpa_printf(MSG_WARNING, "Failed to add CLI FST ctrl");