diff --git a/core/crypto/pbkdf2/pbkdf2.odin b/core/crypto/pbkdf2/pbkdf2.odin
index c27ec4aa2..ef7fda0d5 100644
--- a/core/crypto/pbkdf2/pbkdf2.odin
+++ b/core/crypto/pbkdf2/pbkdf2.odin
@@ -19,6 +19,8 @@ derive :: proc(
 	iterations: u32,
 	dst: []byte,
 ) {
+	ensure(iterations > 0, "crypto/pbkdf2: non-zero iterations required")
+	
 	h_len := hash.DIGEST_SIZES[hmac_hash]
 
 	// 1. If dkLen > (2^32 - 1) * hLen, output "derived key too long"