diff --git a/ChangeLog.d/unistd.txt b/ChangeLog.d/unistd.txt
new file mode 100644
index 0000000000..d2e4d4301a
--- /dev/null
+++ b/ChangeLog.d/unistd.txt
@@ -0,0 +1,3 @@
+Changes
+   * Tweak the detection of Unix-like platforms, which makes more system
+     interfaces (timing, threading) available on Haiku, QNX and Midipix.
diff --git a/library/mbedtls_common.h b/library/mbedtls_common.h
index 43dac8266b..188ae4692b 100644
--- a/library/mbedtls_common.h
+++ b/library/mbedtls_common.h
@@ -33,6 +33,14 @@
  */
 #include "mbedtls_platform_requirements.h"
 
+/* Mbed TLS is tightly coupled with TF-PSA-Crypto, and inherits all of
+ * its platform requirements because we don't have a clear separation of
+ * public vs private platform interfaces. So make sure we declare the
+ * TF-PSA-Crypto platform requirements. We need to do that before including
+ * any system headers, thus before including the user config file since it
+ * may include platform headers. */
+#include "tf_psa_crypto_platform_requirements.h"
+
 /* From this point onwards, ensure we have the library configuration and
  * the configuration-derived macros. */
 #include <mbedtls/build_info.h>
diff --git a/library/mbedtls_platform_requirements.h b/library/mbedtls_platform_requirements.h
index c86204e6fa..ad27fef450 100644
--- a/library/mbedtls_platform_requirements.h
+++ b/library/mbedtls_platform_requirements.h
@@ -15,6 +15,20 @@
 #ifndef MBEDTLS_MBEDTLS_PLATFORM_REQUIREMENTS_H
 #define MBEDTLS_MBEDTLS_PLATFORM_REQUIREMENTS_H
 
+#if !defined(_POSIX_C_SOURCE)
+/* For standards-compliant access to
+ * getaddrinfo(),
+ * ... */
+#define _POSIX_C_SOURCE 200112L
+#endif
+
+#if !defined(_XOPEN_SOURCE)
+/* For standards-compliant access to
+ * sockaddr_storage,
+ * ... */
+#define _XOPEN_SOURCE 600
+#endif
+
 /* On Mingw-w64, force the use of a C99-compliant printf() and friends.
  * This is necessary on older versions of Mingw and/or Windows runtimes
  * where snprintf does not always zero-terminate the buffer, and does
@@ -29,4 +43,13 @@
 #define __USE_MINGW_ANSI_STDIO 1
 #endif
 
+/* Tell MSVC that we're ok with using classic C functions even
+ * when an `_s` variant exist. For most functions, the improvements
+ * of the `_s` variants are of limited usefulness and not worth
+ * the portability headaches.
+ */
+#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
+#define _CRT_SECURE_NO_DEPRECATE 1
+#endif
+
 #endif /* MBEDTLS_MBEDTLS_PLATFORM_REQUIREMENTS_H */
diff --git a/library/net_sockets.c b/library/net_sockets.c
index ca70f3797b..404ef761ae 100644
--- a/library/net_sockets.c
+++ b/library/net_sockets.c
@@ -5,23 +5,11 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
-/* Enable definition of getaddrinfo() even when compiling with -std=c99. Must
- * be set before mbedtls_config.h, which pulls in glibc's features.h indirectly.
- * Harmless on other platforms. */
-#ifndef _POSIX_C_SOURCE
-#define _POSIX_C_SOURCE 200112L
-#endif
-#ifndef _XOPEN_SOURCE
-#define _XOPEN_SOURCE 600 /* sockaddr_storage */
-#endif
-
 #include "ssl_misc.h"
 
 #if defined(MBEDTLS_NET_C)
 
-#if !defined(unix) && !defined(__unix__) && !defined(__unix) && \
-    !defined(__APPLE__) && !defined(_WIN32) && !defined(__QNXNTO__) && \
-    !defined(__HAIKU__) && !defined(__midipix__)
+#if !defined(MBEDTLS_PLATFORM_IS_UNIXLIKE) && !defined(_WIN32)
 #error "This module only works on Unix and Windows, see MBEDTLS_NET_C in mbedtls_config.h"
 #endif
 
diff --git a/programs/ssl/ssl_test_lib.h b/programs/ssl/ssl_test_lib.h
index 491da1dd5f..a9384d16df 100644
--- a/programs/ssl/ssl_test_lib.h
+++ b/programs/ssl/ssl_test_lib.h
@@ -17,6 +17,15 @@
 #define __USE_MINGW_ANSI_STDIO 1
 #endif
 
+/* Tell MSVC that we're ok with using classic C functions even
+ * when an `_s` variant exist. For most functions, the improvements
+ * of the `_s` variants are of limited usefulness and not worth
+ * the portability headaches.
+ */
+#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
+#define _CRT_SECURE_NO_DEPRECATE 1
+#endif
+
 #define MBEDTLS_ALLOW_PRIVATE_ACCESS
 
 #include "mbedtls/private/pk_private.h"
diff --git a/programs/util/pem2der.c b/programs/util/pem2der.c
index 177365b87c..191988082f 100644
--- a/programs/util/pem2der.c
+++ b/programs/util/pem2der.c
@@ -5,6 +5,15 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
+/* Tell MSVC that we're ok with using classic C functions even
+ * when an `_s` variant exist. For most functions, the improvements
+ * of the `_s` variants are of limited usefulness and not worth
+ * the portability headaches.
+ */
+#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
+#define _CRT_SECURE_NO_DEPRECATE 1
+#endif
+
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 0d7b5a1e6e..d6e22aaf8c 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -5,6 +5,15 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
+/* Tell MSVC that we're ok with using classic C functions even
+ * when an `_s` variant exist. For most functions, the improvements
+ * of the `_s` variants are of limited usefulness and not worth
+ * the portability headaches.
+ */
+#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
+#define _CRT_SECURE_NO_DEPRECATE 1
+#endif
+
 #define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
 
 #include "mbedtls/build_info.h"
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index eb090fd051..8ff35f0c2f 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -5,6 +5,15 @@
  *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
  */
 
+/* Tell MSVC that we're ok with using classic C functions even
+ * when an `_s` variant exist. For most functions, the improvements
+ * of the `_s` variants are of limited usefulness and not worth
+ * the portability headaches.
+ */
+#if defined(_MSC_VER) && !defined(_CRT_SECURE_NO_DEPRECATE)
+#define _CRT_SECURE_NO_DEPRECATE 1
+#endif
+
 #define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
 
 #include "mbedtls/build_info.h"
diff --git a/tf-psa-crypto b/tf-psa-crypto
index 4587e3f861..293cfe5ece 160000
--- a/tf-psa-crypto
+++ b/tf-psa-crypto
@@ -1 +1 @@
-Subproject commit 4587e3f861c29a8aa1439078aef4ed593d07a34b
+Subproject commit 293cfe5eceed98a2ee75d5241a78657b466750c7