diff --git a/ChangeLog.d/runtime-version-interface.txt b/ChangeLog.d/runtime-version-interface.txt
new file mode 100644
index 0000000000..1cf42665ca
--- /dev/null
+++ b/ChangeLog.d/runtime-version-interface.txt
@@ -0,0 +1,9 @@
+API changes
+   * Change the signature of the runtime version information methods that took
+     a char* as an argument to take zero arguments and return a const char*
+     instead. This aligns us with the interface used in TF PSA Crypto 1.0.
+     If you need to support linking against both Mbed TLS 3.x and 4.x, please
+     use the build-time version macros or mbedtls_version_get_number() to
+     determine the correct signature for mbedtls_version_get_string() and
+     mbedtls_version_get_string_full() before calling them.
+     Fixes issue #10308.
diff --git a/include/mbedtls/version.h b/include/mbedtls/version.h
index 837787bc7f..4a0b216e3b 100644
--- a/include/mbedtls/version.h
+++ b/include/mbedtls/version.h
@@ -32,23 +32,14 @@ extern "C" {
 unsigned int mbedtls_version_get_number(void);
 
 /**
- * Get the version string ("x.y.z").
- *
- * \param string    The string that will receive the value.
- *                  (Should be at least 9 bytes in size)
+ * Get a pointer to the version string ("x.y.z").
  */
-void mbedtls_version_get_string(char *string);
+const char *mbedtls_version_get_string(void);
 
 /**
- * Get the full version string ("Mbed TLS x.y.z").
- *
- * \param string    The string that will receive the value. The Mbed TLS version
- *                  string will use 18 bytes AT MOST including a terminating
- *                  null byte.
- *                  (So the buffer should be at least 18 bytes to receive this
- *                  version string).
+ * Get a pointer to the full version string ("Mbed TLS x.y.z").
  */
-void mbedtls_version_get_string_full(char *string);
+const char *mbedtls_version_get_string_full(void);
 
 /**
  * \brief           Check if support for a feature was compiled into this
diff --git a/library/version.c b/library/version.c
index 2cd947da72..e828673c0d 100644
--- a/library/version.c
+++ b/library/version.c
@@ -17,16 +17,14 @@ unsigned int mbedtls_version_get_number(void)
     return MBEDTLS_VERSION_NUMBER;
 }
 
-void mbedtls_version_get_string(char *string)
+const char *mbedtls_version_get_string(void)
 {
-    memcpy(string, MBEDTLS_VERSION_STRING,
-           sizeof(MBEDTLS_VERSION_STRING));
+    return MBEDTLS_VERSION_STRING;
 }
 
-void mbedtls_version_get_string_full(char *string)
+const char *mbedtls_version_get_string_full(void)
 {
-    memcpy(string, MBEDTLS_VERSION_STRING_FULL,
-           sizeof(MBEDTLS_VERSION_STRING_FULL));
+    return MBEDTLS_VERSION_STRING_FULL;
 }
 
 #endif /* MBEDTLS_VERSION_C */
diff --git a/tests/suites/test_suite_version.function b/tests/suites/test_suite_version.function
index eeae512626..af0eb86d23 100644
--- a/tests/suites/test_suite_version.function
+++ b/tests/suites/test_suite_version.function
@@ -38,19 +38,17 @@ void check_compiletime_version(char *version_str)
 void check_runtime_version(char *version_str)
 {
     char build_str[100];
-    char get_str[100];
+    const char *get_str;
     char build_str_full[100];
-    char get_str_full[100];
+    const char *get_str_full;
     unsigned int get_int;
 
     memset(build_str, 0, 100);
-    memset(get_str, 0, 100);
     memset(build_str_full, 0, 100);
-    memset(get_str_full, 0, 100);
 
     get_int = mbedtls_version_get_number();
-    mbedtls_version_get_string(get_str);
-    mbedtls_version_get_string_full(get_str_full);
+    get_str = mbedtls_version_get_string();
+    get_str_full = mbedtls_version_get_string_full();
 
     mbedtls_snprintf(build_str, 100, "%u.%u.%u",
                      (get_int >> 24) & 0xFF,