diff --git a/src/knot/dnssec/zone-sign.c b/src/knot/dnssec/zone-sign.c
index ec9946bc0..90405bc96 100644
--- a/src/knot/dnssec/zone-sign.c
+++ b/src/knot/dnssec/zone-sign.c
@@ -921,7 +921,7 @@ bool knot_zone_sign_use_key(const zone_key_t *key, const knot_rrset_t *covered)
 	}
 
 	bool active_ksk = ((key->is_active || key->is_ksk_active_plus) && key->is_ksk);
-	bool active_zsk = ((key->is_active || key->is_zsk_active_plus) && key->is_zsk);;
+	bool active_zsk = ((key->is_active || key->is_zsk_active_plus) && key->is_zsk);
 
 	// this may be a problem with offline KSK
 	bool cds_sign_by_ksk = true;