diff --git a/hw/ip/prim/rtl/prim_sha2.sv b/hw/ip/prim/rtl/prim_sha2.sv
index 27cf8d298800a..ec9ac5ccab77d 100644
--- a/hw/ip/prim/rtl/prim_sha2.sv
+++ b/hw/ip/prim/rtl/prim_sha2.sv
@@ -332,6 +332,10 @@ module prim_sha2 import prim_sha2_pkg::*;
           // Wait until it is filled
           fifo_st_d          = FifoLoadFromFifo;
           update_w_from_fifo = 1'b0;
+          if (msg_feed_complete) begin
+            fifo_st_d       = FifoIdle;
+            hash_done_next  = 1'b1;
+          end
         end else if (w_index_q == 4'd 15) begin
           fifo_st_d = FifoWait;
           // To increment w_index and it rolls over to 0
@@ -443,13 +447,26 @@ module prim_sha2 import prim_sha2_pkg::*;
     if (!sha_en_i || hash_go) sha_st_d  = ShaIdle;
   end
 
+  logic update_digest_q, update_digest_d;
+
   // Determine whether a digest is being computed for a complete block: when `update_digest` is set,
   // this module is not waiting for more data from the FIFO, and `message_length_i` is zero modulo a
   // complete block (512 bit for SHA2_256 and 1024 bit for SHA2_384 and SHA2_512).
-  assign digest_on_blk_o = update_digest && (fifo_st_q == FifoIdle) && (
+  assign digest_on_blk_o = (update_digest || update_digest_q) && (fifo_st_q == FifoIdle) && (
       (digest_mode_flag_q == SHA2_256                 && message_length_i[8:0] == '0) ||
       (digest_mode_flag_q inside {SHA2_384, SHA2_512} && message_length_i[9:0] == '0));
 
+  assign update_digest_d = digest_on_blk_o ? 1'b0 :
+                           update_digest   ? 1'b1 : update_digest_q;
+
+  always_ff @(posedge clk_i or negedge rst_ni) begin
+    if (!rst_ni) begin
+      update_digest_q <= 1'b0;
+    end else begin
+      update_digest_q <= update_digest_d;
+    end
+  end
+
   assign one_chunk_done = ((digest_mode_flag_q == SHA2_256 || ~MultimodeEn)
                           && (round_q == 7'd63)) ? 1'b1 :
                           (((digest_mode_flag_q == SHA2_384) || (digest_mode_flag_q == SHA2_512))