diff --git a/library/mbedtls_common.h b/library/mbedtls_common.h
index 11d7c8249f..2aacfcbc22 100644
--- a/library/mbedtls_common.h
+++ b/library/mbedtls_common.h
@@ -11,6 +11,16 @@
 #ifndef MBEDTLS_MBEDTLS_COMMON_H
 #define MBEDTLS_MBEDTLS_COMMON_H
 
+/* Before including any system header, declare some macros to tell system
+ * headers what we expect of them.
+ *
+ * Do this before including any header from TF-PSA-Crypto, since the
+ * convention is first-come-first-served (so that users can
+ * override some macros on the command line, and individual users can
+ * override some macros before including the common header).
+ */
+#include "mbedtls_platform_requirements.h"
+
 /* Mbed TLS requires TF-PSA-Crypto internals. */
 #include "tf_psa_crypto_common.h"
 
diff --git a/library/mbedtls_platform_requirements.h b/library/mbedtls_platform_requirements.h
new file mode 100644
index 0000000000..f6dd4ce4aa
--- /dev/null
+++ b/library/mbedtls_platform_requirements.h
@@ -0,0 +1,18 @@
+/**
+ * \file mbedtls_platform_requirements.h
+ *
+ * \brief Declare macros that tell system headers what we expect of them.
+ *
+ * This file must be included before any system header, and so in particular
+ * before build_info.h (which includes the user config, which may include
+ * system headers).
+ */
+/*
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#ifndef MBEDTLS_MBEDTLS_PLATFORM_REQUIREMENTS_H
+#define MBEDTLS_MBEDTLS_PLATFORM_REQUIREMENTS_H
+
+#endif /* MBEDTLS_MBEDTLS_PLATFORM_REQUIREMENTS_H */