diff --git a/library/Makefile b/library/Makefile
index fc0cffb5c7..ce18353950 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -39,17 +39,12 @@ CFLAGS	?= -O2
 WARNING_CFLAGS ?=  -Wall -Wextra -Wformat=2 -Wno-format-nonliteral
 LDFLAGS ?=
 
-# Include ../include, ../tf-psa-crypto/include and
-# ../tf-psa-crypto/drivers/builtin/include for public headers and .,
-# ../tf-psa-crypto/core and ../tf-psa-crypto/drivers/builtin/src for
-# private headers.
+# For the time being, Mbed TLS uses non-public interfaces of TF-PSA-Crypto,
+# so we include both public and internal headers.
 LOCAL_CFLAGS = $(WARNING_CFLAGS) -I. \
-	       -I../tf-psa-crypto/core \
-               -I../tf-psa-crypto/drivers/builtin/src \
+	       $(TF_PSA_CRYPTO_LIBRARY_PRIVATE_INCLUDE) \
                -I../include \
-	       -I../tf-psa-crypto/include \
-               -I../tf-psa-crypto/drivers/builtin/include \
-	       $(THIRDPARTY_INCLUDES) \
+	       $(TF_PSA_CRYPTO_LIBRARY_PUBLIC_INCLUDE) \
 	       -D_FILE_OFFSET_BITS=64
 LOCAL_LDFLAGS =
 
diff --git a/scripts/common.make b/scripts/common.make
index f3754e587c..67ad341522 100644
--- a/scripts/common.make
+++ b/scripts/common.make
@@ -27,8 +27,8 @@ LDFLAGS ?=
 
 LOCAL_CFLAGS = $(WARNING_CFLAGS) -I$(MBEDTLS_TEST_PATH)/include \
                -I$(MBEDTLS_PATH)/framework/tests/include \
-               -I$(MBEDTLS_PATH)/include -I$(MBEDTLS_PATH)/tf-psa-crypto/include \
-               -I$(MBEDTLS_PATH)/tf-psa-crypto/drivers/builtin/include \
+               -I$(MBEDTLS_PATH)/include \
+               $(TF_PSA_CRYPTO_LIBRARY_PUBLIC_INCLUDE) \
                -D_FILE_OFFSET_BITS=64
 LOCAL_CXXFLAGS = $(WARNING_CXXFLAGS) $(LOCAL_CFLAGS)
 
diff --git a/scripts/crypto-common.make b/scripts/crypto-common.make
index 315f14df10..8d00bd8bed 100644
--- a/scripts/crypto-common.make
+++ b/scripts/crypto-common.make
@@ -32,3 +32,16 @@ THIRDPARTY_DIR := $(TF_PSA_CRYPTO_PATH)/drivers
 THIRDPARTY_INCLUDES =
 include $(TF_PSA_CRYPTO_PATH)/drivers/everest/Makefile.inc
 include $(TF_PSA_CRYPTO_PATH)/drivers/p256-m/Makefile.inc
+
+# Directories with headers of public interfaces of TF-PSA-Crypto
+TF_PSA_CRYPTO_LIBRARY_PUBLIC_INCLUDE = \
+	-I$(TF_PSA_CRYPTO_PATH)/include \
+	-I$(TF_PSA_CRYPTO_PATH)/drivers/builtin/include \
+	$(THIRDPARTY_INCLUDES)
+
+# Directories with headers of internal interfaces of TF-PSA-Crypto
+# (currently consumed by Mbed TLS, eventually not so when we've finished
+# cleaning up)
+TF_PSA_CRYPTO_LIBRARY_PRIVATE_INCLUDE = \
+	-I$(TF_PSA_CRYPTO_PATH)/core \
+	-I$(TF_PSA_CRYPTO_PATH)/drivers/builtin/src
diff --git a/tests/Makefile b/tests/Makefile
index 5c956149e0..7ebc10b6d0 100644
--- a/tests/Makefile
+++ b/tests/Makefile
@@ -5,7 +5,8 @@ include ../scripts/common.make
 TEST_FLAGS ?= $(if $(filter-out 0 OFF Off off NO No no FALSE False false N n,$(CTEST_OUTPUT_ON_FAILURE)),-v,)
 
 # Also include private headers, for the sake of invasive tests.
-LOCAL_CFLAGS += -I$(MBEDTLS_PATH)/library -I$(MBEDTLS_PATH)/tf-psa-crypto/core -I$(MBEDTLS_PATH)/tf-psa-crypto/drivers/builtin/src
+LOCAL_CFLAGS += -I$(MBEDTLS_PATH)/library
+LOCAL_CFLAGS += $(TF_PSA_CRYPTO_LIBRARY_PRIVATE_INCLUDE)
 
 # Enable definition of various functions used throughout the testsuite
 # (gethostname, strdup, fileno...) even when compiling with -std=c99. Harmless