diff --git a/ChangeLog.d/runtime-version-interface.txt b/ChangeLog.d/runtime-version-interface.txt
new file mode 100644
index 0000000000..1cf42665ca
--- /dev/null
+++ b/ChangeLog.d/runtime-version-interface.txt
@@ -0,0 +1,9 @@
+API changes
+   * Change the signature of the runtime version information methods that took
+     a char* as an argument to take zero arguments and return a const char*
+     instead. This aligns us with the interface used in TF PSA Crypto 1.0.
+     If you need to support linking against both Mbed TLS 3.x and 4.x, please
+     use the build-time version macros or mbedtls_version_get_number() to
+     determine the correct signature for mbedtls_version_get_string() and
+     mbedtls_version_get_string_full() before calling them.
+     Fixes issue #10308.
diff --git a/include/mbedtls/version.h b/include/mbedtls/version.h
index 837787bc7f..4a0b216e3b 100644
--- a/include/mbedtls/version.h
+++ b/include/mbedtls/version.h
@@ -32,23 +32,14 @@ extern "C" {
 unsigned int mbedtls_version_get_number(void);
 
 /**
- * Get the version string ("x.y.z").
- *
- * \param string    The string that will receive the value.
- *                  (Should be at least 9 bytes in size)
+ * Get a pointer to the version string ("x.y.z").
  */
-void mbedtls_version_get_string(char *string);
+const char *mbedtls_version_get_string(void);
 
 /**
- * Get the full version string ("Mbed TLS x.y.z").
- *
- * \param string    The string that will receive the value. The Mbed TLS version
- *                  string will use 18 bytes AT MOST including a terminating
- *                  null byte.
- *                  (So the buffer should be at least 18 bytes to receive this
- *                  version string).
+ * Get a pointer to the full version string ("Mbed TLS x.y.z").
  */
-void mbedtls_version_get_string_full(char *string);
+const char *mbedtls_version_get_string_full(void);
 
 /**
  * \brief           Check if support for a feature was compiled into this
diff --git a/library/version.c b/library/version.c
index 2cd947da72..e828673c0d 100644
--- a/library/version.c
+++ b/library/version.c
@@ -17,16 +17,14 @@ unsigned int mbedtls_version_get_number(void)
     return MBEDTLS_VERSION_NUMBER;
 }
 
-void mbedtls_version_get_string(char *string)
+const char *mbedtls_version_get_string(void)
 {
-    memcpy(string, MBEDTLS_VERSION_STRING,
-           sizeof(MBEDTLS_VERSION_STRING));
+    return MBEDTLS_VERSION_STRING;
 }
 
-void mbedtls_version_get_string_full(char *string)
+const char *mbedtls_version_get_string_full(void)
 {
-    memcpy(string, MBEDTLS_VERSION_STRING_FULL,
-           sizeof(MBEDTLS_VERSION_STRING_FULL));
+    return MBEDTLS_VERSION_STRING_FULL;
 }
 
 #endif /* MBEDTLS_VERSION_C */
diff --git a/programs/test/cmake_package/cmake_package.c b/programs/test/cmake_package/cmake_package.c
index f7d5230f46..cd050e97bc 100644
--- a/programs/test/cmake_package/cmake_package.c
+++ b/programs/test/cmake_package/cmake_package.c
@@ -18,10 +18,7 @@
  * linkage works, but that is all. */
 int main()
 {
-    /* This version string is 18 bytes long, as advised by version.h. */
-    char version[18];
-
-    mbedtls_version_get_string_full(version);
+    const char *version = mbedtls_version_get_string_full();
 
     mbedtls_printf("Built against %s\n", version);
 
diff --git a/programs/test/cmake_package_install/cmake_package_install.c b/programs/test/cmake_package_install/cmake_package_install.c
index fb68883fee..a63f7dbb0f 100644
--- a/programs/test/cmake_package_install/cmake_package_install.c
+++ b/programs/test/cmake_package_install/cmake_package_install.c
@@ -19,10 +19,7 @@
  * linkage works, but that is all. */
 int main()
 {
-    /* This version string is 18 bytes long, as advised by version.h. */
-    char version[18];
-
-    mbedtls_version_get_string_full(version);
+    const char *version = mbedtls_version_get_string_full();
 
     mbedtls_printf("Built against %s\n", version);
 
diff --git a/programs/test/cmake_subproject/cmake_subproject.c b/programs/test/cmake_subproject/cmake_subproject.c
index efab789553..69b5d0b819 100644
--- a/programs/test/cmake_subproject/cmake_subproject.c
+++ b/programs/test/cmake_subproject/cmake_subproject.c
@@ -19,10 +19,7 @@
  * linkage works, but that is all. */
 int main()
 {
-    /* This version string is 18 bytes long, as advised by version.h. */
-    char version[18];
-
-    mbedtls_version_get_string_full(version);
+    const char *version = mbedtls_version_get_string_full();
 
     mbedtls_printf("Built against %s\n", version);
 
diff --git a/tests/psa-client-server/psasim/src/psa_sim_crypto_client.c b/tests/psa-client-server/psasim/src/psa_sim_crypto_client.c
index 635a70545a..9051f20535 100644
--- a/tests/psa-client-server/psasim/src/psa_sim_crypto_client.c
+++ b/tests/psa-client-server/psasim/src/psa_sim_crypto_client.c
@@ -73,12 +73,12 @@ int psa_crypto_call(int function,
 
 psa_status_t psa_crypto_init(void)
 {
-    char mbedtls_version[18];
+    const char *mbedtls_version;
     uint8_t *result = NULL;
     size_t result_length;
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
-    mbedtls_version_get_string_full(mbedtls_version);
+    mbedtls_version = mbedtls_version_get_string_full();
     CLIENT_PRINT("%s", mbedtls_version);
 
     CLIENT_PRINT("My PID: %d", getpid());
diff --git a/tests/psa-client-server/psasim/src/psa_sim_generate.pl b/tests/psa-client-server/psasim/src/psa_sim_generate.pl
index 3eec226e16..0f4c86f817 100755
--- a/tests/psa-client-server/psasim/src/psa_sim_generate.pl
+++ b/tests/psa-client-server/psasim/src/psa_sim_generate.pl
@@ -390,12 +390,12 @@ int psa_crypto_call(int function,
 
 psa_status_t psa_crypto_init(void)
 {
-    char mbedtls_version[18];
+    const char *mbedtls_version;
     uint8_t *result = NULL;
     size_t result_length;
     psa_status_t status = PSA_ERROR_CORRUPTION_DETECTED;
 
-    mbedtls_version_get_string_full(mbedtls_version);
+    mbedtls_version = mbedtls_version_get_string_full();
     CLIENT_PRINT("%s", mbedtls_version);
 
     CLIENT_PRINT("My PID: %d", getpid());
diff --git a/tests/psa-client-server/psasim/src/server.c b/tests/psa-client-server/psasim/src/server.c
index 44939f1c2a..aa0c75a488 100644
--- a/tests/psa-client-server/psasim/src/server.c
+++ b/tests/psa-client-server/psasim/src/server.c
@@ -56,8 +56,7 @@ int psa_server_main(int argc, char *argv[])
     extern psa_status_t psa_crypto_close(void);
 
 #if defined(MBEDTLS_VERSION_C)
-    char mbedtls_version[18];
-    mbedtls_version_get_string_full(mbedtls_version);
+    const char *mbedtls_version = mbedtls_version_get_string_full();
     SERVER_PRINT("%s", mbedtls_version);
 #endif
 
diff --git a/tests/suites/test_suite_version.function b/tests/suites/test_suite_version.function
index eeae512626..af0eb86d23 100644
--- a/tests/suites/test_suite_version.function
+++ b/tests/suites/test_suite_version.function
@@ -38,19 +38,17 @@ void check_compiletime_version(char *version_str)
 void check_runtime_version(char *version_str)
 {
     char build_str[100];
-    char get_str[100];
+    const char *get_str;
     char build_str_full[100];
-    char get_str_full[100];
+    const char *get_str_full;
     unsigned int get_int;
 
     memset(build_str, 0, 100);
-    memset(get_str, 0, 100);
     memset(build_str_full, 0, 100);
-    memset(get_str_full, 0, 100);
 
     get_int = mbedtls_version_get_number();
-    mbedtls_version_get_string(get_str);
-    mbedtls_version_get_string_full(get_str_full);
+    get_str = mbedtls_version_get_string();
+    get_str_full = mbedtls_version_get_string_full();
 
     mbedtls_snprintf(build_str, 100, "%u.%u.%u",
                      (get_int >> 24) & 0xFF,