diff --git a/lib/utils/mlock/mlock_linux.go b/lib/utils/mlock/mlock_linux.go
new file mode 100644
index 0000000000000..ecdd6bd40c1e5
--- /dev/null
+++ b/lib/utils/mlock/mlock_linux.go
@@ -0,0 +1,27 @@
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mlock
+
+import (
+	"golang.org/x/sys/unix"
+)
+
+// LockMemory locks the process memory to prevent secrets from being exposed in a swap.
+// This is a noop on unsupported systems (non-linux).
+func LockMemory() error {
+	return unix.Mlockall(unix.MCL_CURRENT | unix.MCL_FUTURE)
+}
diff --git a/lib/utils/mlock/mlock_unsupported.go b/lib/utils/mlock/mlock_unsupported.go
new file mode 100644
index 0000000000000..092bd83152a43
--- /dev/null
+++ b/lib/utils/mlock/mlock_unsupported.go
@@ -0,0 +1,25 @@
+//go:build !linux
+
+/*
+Copyright 2023 Gravitational, Inc.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package mlock
+
+// LockMemory locks the process memory to prevent secrets from being exposed in a swap.
+// This is a noop on unsupported systems (non-linux).
+func LockMemory() error {
+	return nil
+}
diff --git a/tool/tsh/tsh.go b/tool/tsh/tsh.go
index 25b1792c3b0c8..95b8759c27ac8 100644
--- a/tool/tsh/tsh.go
+++ b/tool/tsh/tsh.go
@@ -78,6 +78,7 @@ import (
 	"github.com/gravitational/teleport/lib/sshutils/x11"
 	"github.com/gravitational/teleport/lib/tlsca"
 	"github.com/gravitational/teleport/lib/utils"
+	"github.com/gravitational/teleport/lib/utils/mlock"
 	"github.com/gravitational/teleport/lib/utils/prompt"
 	"github.com/gravitational/teleport/tool/common"
 )
@@ -3289,6 +3290,13 @@ func makeClientForProxy(cf *CLIConf, proxy string, useProfileLogin bool) (*clien
 		cf.AuthConnector = constants.HeadlessConnector
 	}
 
+	if cf.AuthConnector == constants.HeadlessConnector {
+		// Lock the process memory to prevent rsa keys and certificates from being exposed in a swap.
+		if err := mlock.LockMemory(); err != nil {
+			return nil, trace.Wrap(err, "failed to lock system memory for headless login")
+		}
+	}
+
 	c.ClientStore, err = initClientStore(cf, proxy)
 	if err != nil {
 		return nil, trace.Wrap(err)