diff --git a/CMakeLists.txt b/CMakeLists.txt
index bc122f5167..42e4ccb34d 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -373,6 +373,20 @@ foreach(target IN LISTS tf_psa_crypto_library_targets)
     endif()
 endforeach(target)
 
+#
+# TF-PSA-Crypto directories with internal headers that are currently still
+# consumed by Mbed TLS. When we have finished cleaning up this list should be
+# empty.
+#
+set(TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS
+        ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/core
+        ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/dispatch
+        ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/drivers/builtin/src
+        ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/extras
+        ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/platform
+        ${CMAKE_CURRENT_SOURCE_DIR}/tf-psa-crypto/utilities
+)
+
 add_subdirectory(library)
 
 add_subdirectory(pkgconfig)
@@ -416,16 +430,16 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS)
     endif()
     target_include_directories(mbedtls_test
         PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/tests/include
-        PRIVATE ${MBEDTLS_FRAMEWORK_DIR}/tests/include
-        PRIVATE tests/include
-        PRIVATE include
-        PRIVATE tf-psa-crypto/include
-        PRIVATE tf-psa-crypto/drivers/builtin/include
-        PRIVATE tf-psa-crypto/drivers/everest/include
-        PRIVATE tf-psa-crypto/drivers/pqcp/include
-        PRIVATE library
-        PRIVATE tf-psa-crypto/core
-        PRIVATE tf-psa-crypto/drivers/builtin/src)
+                ${MBEDTLS_FRAMEWORK_DIR}/tests/include
+                tests/include
+                include
+                tf-psa-crypto/include
+                tf-psa-crypto/drivers/builtin/include
+                tf-psa-crypto/drivers/everest/include
+                tf-psa-crypto/drivers/pqcp/include
+                library
+                ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}
+    )
     # Request C11, needed for memory poisoning tests
     set_target_properties(mbedtls_test PROPERTIES C_STANDARD 11)
     set_config_files_compile_definitions(mbedtls_test)
@@ -453,16 +467,15 @@ if(ENABLE_TESTING OR ENABLE_PROGRAMS)
     endif()
     target_include_directories(mbedtls_test_helpers
         PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/tests/include
-        PRIVATE ${MBEDTLS_FRAMEWORK_DIR}/tests/include
-        PRIVATE tests/include
-        PRIVATE include
-        PRIVATE tf-psa-crypto/include
-        PRIVATE tf-psa-crypto/drivers/builtin/include
-        PRIVATE library
-        PRIVATE tf-psa-crypto/core
-        PRIVATE tf-psa-crypto/drivers/builtin/src
-        PRIVATE tf-psa-crypto/drivers/everest/include
-        PRIVATE tf-psa-crypto/drivers/pqcp/include
+                ${MBEDTLS_FRAMEWORK_DIR}/tests/include
+                tests/include
+                include
+                tf-psa-crypto/include
+                tf-psa-crypto/drivers/builtin/include
+                library
+                tf-psa-crypto/drivers/everest/include
+                tf-psa-crypto/drivers/pqcp/include
+                ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}
     )
 
     set_config_files_compile_definitions(mbedtls_test_helpers)
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index 5474e2cacf..f1b7c74aba 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -236,15 +236,14 @@ foreach(target IN LISTS target_libraries)
     add_library(MbedTLS::${target} ALIAS ${target})  # add_subdirectory support
     # Include public header files from /include, /tf-psa-crypto/include/ and
     # tf-psa-crypto/drivers/builtin/include/. Include private header files
-    # from /library, tf-psa-crypto/core/ and tf-psa-crypto/drivers/builtin/src/.
+    # from /library and ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}.
     target_include_directories(${target}
         PUBLIC $<BUILD_INTERFACE:${MBEDTLS_DIR}/include/>
                $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/include/>
                $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/include/>
                $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
         PRIVATE ${MBEDTLS_DIR}/library/
-                ${MBEDTLS_DIR}/tf-psa-crypto/core
-                ${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/src
+                ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}
                 # needed for generated headers
                 ${CMAKE_CURRENT_BINARY_DIR})
     set_config_files_compile_definitions(${target})
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index ec625234dc..09913b56e7 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -177,11 +177,11 @@ function(add_test_suite suite_name)
     # them as PUBLIC.
     target_include_directories(test_suite_${data_name}
         PRIVATE ${CMAKE_CURRENT_BINARY_DIR}/include
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/include
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../framework/tests/include
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../library
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../tf-psa-crypto/core
-        PRIVATE ${CMAKE_CURRENT_SOURCE_DIR}/../tf-psa-crypto/drivers/builtin/src)
+                ${CMAKE_CURRENT_SOURCE_DIR}/include
+                ${PROJECT_SOURCE_DIR}/framework/tests/include
+                ${PROJECT_SOURCE_DIR}/library
+                ${TF_PSA_CRYPTO_PRIVATE_INCLUDE_DIRS}
+    )
     # Request C11, which is needed for memory poisoning tests
     set_target_properties(test_suite_${data_name} PROPERTIES C_STANDARD 11)