diff --git a/certs/renewcerts.sh b/certs/renewcerts.sh
index 1d584cd91c..c6f172c5e6 100755
--- a/certs/renewcerts.sh
+++ b/certs/renewcerts.sh
@@ -1125,27 +1125,9 @@ run_renewcerts(){
     echo "End of section"
     echo "---------------------------------------------------------------------"
     ############################################################
-    ########## store DER files as buffers ######################
-    ############################################################
-    echo "Changing directory to wolfssl root..."
-    echo ""
-    cd ../ || exit 1
-    echo "Execute ./gencertbuf.pl..."
-    echo ""
-    ./gencertbuf.pl
-    check_result $? "gencertbuf.pl"
-    echo "End of section"
-    echo "---------------------------------------------------------------------"
-    ############################################################
     ########## generate the new crls ###########################
     ############################################################
 
-    echo "Change directory to wolfssl/certs"
-    echo ""
-    cd ./certs || { echo "Failed to switch to dir ./certs"; exit 1; }
-    echo "We are back in the certs directory"
-    echo ""
-
     echo "Updating the crls..."
     echo ""
     cd ./crl || { echo "Failed to switch to dir ./crl"; exit 1; }
@@ -1522,6 +1504,19 @@ EOF
     echo "certificates; they are generated by wolfSSL - see certs/frodokem/)"
     echo "---------------------------------------------------------------------"
 
+    ############################################################
+    ########## store DER files as buffers ######################
+    ############################################################
+    echo "Changing directory to wolfssl root..."
+    echo ""
+    cd ../ || exit 1
+    echo "Execute ./gencertbuf.pl..."
+    echo ""
+    ./gencertbuf.pl
+    check_result $? "gencertbuf.pl"
+    echo "End of section"
+    echo "---------------------------------------------------------------------"
+
     #cleanup the file system now that we're done
     echo "Performing final steps, cleaning up the file system..."
     echo ""
@@ -1550,7 +1545,6 @@ check_result $? "make clean"
 touch certs/.rnd || exit 1
 
 run_renewcerts
-cd ../ || exit 1
 rm -f ./certs/wolfssl.cnf
 rm -f certs/.rnd
 
diff --git a/gencertbuf.pl b/gencertbuf.pl
index 6b54e715b0..a3e42b42c1 100755
--- a/gencertbuf.pl
+++ b/gencertbuf.pl
@@ -407,9 +407,14 @@ for my $entry (@hbs_vectors) {
 }
 
 # ML-KEM end-entity certificates and expandedKey form private keys
-print OUT_FILE "#if defined(WOLFSSL_HAVE_MLKEM)\n\n";
+print OUT_FILE "#if defined(WOLFSSL_HAVE_MLKEM) && " .
+    "!defined(WOLFSSL_NO_ML_KEM)\n\n";
 
 for my $n (512, 768, 1024) {
+    my $noLevel = "WOLFSSL_NO_ML_KEM_${n}";
+
+    print OUT_FILE "#if !defined($noLevel)\n\n";
+
     for my $kind ("cert", "key") {
         my $fname = "./certs/mlkem/mlkem${n}-${kind}.der";
         my $sname = "mlkem${n}_${kind}_der";
@@ -420,9 +425,11 @@ for my $n (512, 768, 1024) {
         print OUT_FILE "};\n";
         print OUT_FILE "#define sizeof_$sname (sizeof($sname))\n\n";
     }
+
+    print OUT_FILE "#endif /* !$noLevel */\n\n";
 }
 
-print OUT_FILE "#endif /* WOLFSSL_HAVE_MLKEM */\n\n";
+print OUT_FILE "#endif /* WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM */\n\n";
 
 # convert and print 256-bit cert/keys
 print OUT_FILE "#if defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)\n\n";
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index e3397becc2..a24bac87a9 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -69344,16 +69344,12 @@ free_level:
     #define MLKEM_CERT_TEST_KEM
 #endif
 
-/* Parse the ML-KEM end-entity certificates, confirm the subject public key
- * carries the expected ML-KEM parameter set, and confirm the matching private
- * key reproduces that same public key. */
-static wc_test_ret_t mlkem_cert_test(void)
+/* Check each ML-KEM cert's parameter set, that its private key matches the
+ * public key and, when available, an encapsulate/decapsulate round trip. */
+static wc_test_ret_t mlkem_cert_test(WC_RNG* rng)
 {
     wc_test_ret_t ret = 0;
     int i;
-#ifdef MLKEM_CERT_TEST_KEM
-    WC_RNG rng;
-#endif
     static const struct {
         const byte* cert;
         word32      certSz;
@@ -69361,30 +69357,27 @@ static wc_test_ret_t mlkem_cert_test(void)
         word32      keySz;
         int         level;
     } vectors[] = {
-#if defined(WOLFSSL_WC_ML_KEM_512) && !defined(WOLFSSL_NO_ML_KEM)
+#if !defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_512)
         { mlkem512_cert_der, sizeof_mlkem512_cert_der,
           mlkem512_key_der, sizeof_mlkem512_key_der, WC_ML_KEM_512 },
 #endif
-#if defined(WOLFSSL_WC_ML_KEM_768) && !defined(WOLFSSL_NO_ML_KEM)
+#if !defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_768)
         { mlkem768_cert_der, sizeof_mlkem768_cert_der,
           mlkem768_key_der, sizeof_mlkem768_key_der, WC_ML_KEM_768 },
 #endif
-#if defined(WOLFSSL_WC_ML_KEM_1024) && !defined(WOLFSSL_NO_ML_KEM)
+#if !defined(WOLFSSL_NO_ML_KEM) && !defined(WOLFSSL_NO_ML_KEM_1024)
         { mlkem1024_cert_der, sizeof_mlkem1024_cert_der,
           mlkem1024_key_der, sizeof_mlkem1024_key_der, WC_ML_KEM_1024 },
 #endif
         { NULL, 0, NULL, 0, 0 }
     };
 
-#ifdef MLKEM_CERT_TEST_KEM
-    ret = wc_InitRng_ex(&rng, HEAP_HINT, devId);
-    if (ret != 0)
-        return WC_TEST_RET_ENC_EC(ret);
+#ifndef MLKEM_CERT_TEST_KEM
+    (void)rng;
 #endif
 
     for (i = 0; vectors[i].cert != NULL; i++) {
-        /* One key object at a time: a static memory pool has no room for
-         * both halves of the comparison at once. */
+        /* One key at a time: a static memory pool has no room for two. */
         MlKemKey* key = NULL;
         byte* spki = NULL;
         byte* pubA = NULL;
@@ -69443,7 +69436,7 @@ static wc_test_ret_t mlkem_cert_test(void)
                 ret = WC_TEST_RET_ENC_ERRNO;
         }
         if (ret == 0)
-            ret = wc_MlKemKey_Encapsulate(key, ct, ssA, &rng);
+            ret = wc_MlKemKey_Encapsulate(key, ct, ssA, rng);
 #endif
         if (keyInit) {
             wc_MlKemKey_Free(key);
@@ -69490,9 +69483,6 @@ free_vector:
         if (ret != 0)
             break;
     }
-#ifdef MLKEM_CERT_TEST_KEM
-    wc_FreeRng(&rng);
-#endif
     return ret;
 }
 #undef MLKEM_CERT_TEST_KEM
@@ -70148,7 +70138,11 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t mlkem_test(void)
 #if !defined(WOLFSSL_MLKEM_NO_ASN1) && !defined(WOLFSSL_NO_MALLOC) && \
     !defined(NO_ASN) && !defined(NO_CERTS) && \
     defined(WC_ENABLE_ASYM_KEY_IMPORT) && defined(WC_ENABLE_ASYM_KEY_EXPORT)
-    ret = mlkem_cert_test();
+#ifndef WC_NO_RNG
+    ret = mlkem_cert_test(&rng);
+#else
+    ret = mlkem_cert_test(NULL);
+#endif
     if (ret != 0)
         goto out;
 #endif
diff --git a/wolfssl/certs_test.h b/wolfssl/certs_test.h
index 4684ea57fe..257462ee64 100644
--- a/wolfssl/certs_test.h
+++ b/wolfssl/certs_test.h
@@ -11928,7 +11928,9 @@ static const unsigned char bench_slhdsa_sha2_128s_msg[] =
 
 #endif /* WOLFSSL_HAVE_SLHDSA */
 
-#if defined(WOLFSSL_HAVE_MLKEM)
+#if defined(WOLFSSL_HAVE_MLKEM) && !defined(WOLFSSL_NO_ML_KEM)
+
+#if !defined(WOLFSSL_NO_ML_KEM_512)
 
 /* ./certs/mlkem/mlkem512-cert.der */
 static const unsigned char mlkem512_cert_der[] =
@@ -12688,6 +12690,10 @@ static const unsigned char mlkem512_key_der[] =
 };
 #define sizeof_mlkem512_key_der (sizeof(mlkem512_key_der))
 
+#endif /* !WOLFSSL_NO_ML_KEM_512 */
+
+#if !defined(WOLFSSL_NO_ML_KEM_768)
+
 /* ./certs/mlkem/mlkem768-cert.der */
 static const unsigned char mlkem768_cert_der[] =
 {
@@ -13561,6 +13567,10 @@ static const unsigned char mlkem768_key_der[] =
 };
 #define sizeof_mlkem768_key_der (sizeof(mlkem768_key_der))
 
+#endif /* !WOLFSSL_NO_ML_KEM_768 */
+
+#if !defined(WOLFSSL_NO_ML_KEM_1024)
+
 /* ./certs/mlkem/mlkem1024-cert.der */
 static const unsigned char mlkem1024_cert_der[] =
 {
@@ -14549,7 +14559,9 @@ static const unsigned char mlkem1024_key_der[] =
 };
 #define sizeof_mlkem1024_key_der (sizeof(mlkem1024_key_der))
 
-#endif /* WOLFSSL_HAVE_MLKEM */
+#endif /* !WOLFSSL_NO_ML_KEM_1024 */
+
+#endif /* WOLFSSL_HAVE_MLKEM && !WOLFSSL_NO_ML_KEM */
 
 #if defined(HAVE_ECC) && defined(USE_CERT_BUFFERS_256)