diff --git a/library/mbedtls_common.h b/library/mbedtls_common.h
new file mode 100644
index 0000000000..11d7c8249f
--- /dev/null
+++ b/library/mbedtls_common.h
@@ -0,0 +1,17 @@
+/**
+ * \file mbedtls_common.h
+ *
+ * \brief Utility macros for internal use in the library
+ */
+/*
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#ifndef MBEDTLS_MBEDTLS_COMMON_H
+#define MBEDTLS_MBEDTLS_COMMON_H
+
+/* Mbed TLS requires TF-PSA-Crypto internals. */
+#include "tf_psa_crypto_common.h"
+
+#endif /* MBEDTLS_MBEDTLS_COMMON_H */
diff --git a/library/mbedtls_config.c b/library/mbedtls_config.c
index a3deae3152..48be660015 100644
--- a/library/mbedtls_config.c
+++ b/library/mbedtls_config.c
@@ -6,6 +6,10 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
+/* We are a special snowflake: we don't include "mbedtls_common.h",
+ * because that would pull <mbedtls/build_info.h> and we need to
+ * tune the way it works. */
+
 /* Apply the TF-PSA-Crypto configuration first. We need to do this
  * before <mbedtls/build_info.h>, because "mbedtls_config_check_before.h"
  * needs to run after the crypto config (including derived macros) is
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index f8c03dfa2f..5f8980a20e 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -10,7 +10,7 @@
 #ifndef MBEDTLS_SSL_MISC_H
 #define MBEDTLS_SSL_MISC_H
 
-#include "tf_psa_crypto_common.h"
+#include "mbedtls_common.h"
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/error.h"
diff --git a/library/x509_internal.h b/library/x509_internal.h
index ea3aeb6351..fcb996b19d 100644
--- a/library/x509_internal.h
+++ b/library/x509_internal.h
@@ -10,7 +10,7 @@
 #ifndef MBEDTLS_X509_INTERNAL_H
 #define MBEDTLS_X509_INTERNAL_H
 
-#include "tf_psa_crypto_common.h"
+#include "mbedtls_common.h"
 #include "mbedtls/build_info.h"
 #include "mbedtls/private_access.h"