diff --git a/IDE/XilinxSDK/vitis_sdt/lib/sw_services/wolfssl/src/user_settings_template.h b/IDE/XilinxSDK/vitis_sdt/lib/sw_services/wolfssl/src/user_settings_template.h
index 8e4f601efe..3fbf9ae6b2 100644
--- a/IDE/XilinxSDK/vitis_sdt/lib/sw_services/wolfssl/src/user_settings_template.h
+++ b/IDE/XilinxSDK/vitis_sdt/lib/sw_services/wolfssl/src/user_settings_template.h
@@ -49,14 +49,49 @@
 #define WC_RSA_BLINDING
 #define WC_RSA_PSS /* required for TLS 1.3 with RSA */
 
-/* Algorithms */
-#define HAVE_ECC
-#define HAVE_AESGCM
-#define WOLFSSL_SHA384
-#define WOLFSSL_SHA512
+/* Algorithms. This is everything the Versal Gen 2 ASU can offload; see
+ * wolfcrypt/src/port/xilinx/versal_gen2_asu/README.md for what each covers. */
 #define HAVE_HKDF
 #define HAVE_HASHDRBG
 
+/* Hashes */
+#define WOLFSSL_SHA384
+#define WOLFSSL_SHA512
+#define WOLFSSL_SHA3
+#define WOLFSSL_SHAKE256
+
+/* AES. CBC comes with the library; these add the other offloaded modes.
+ * Key wrap has no engine of its own, the ASU composes it from AES-ECB. */
+#define HAVE_AESGCM
+#define HAVE_AESCCM
+#define HAVE_AES_ECB
+#define WOLFSSL_AES_DIRECT
+#define WOLFSSL_AES_COUNTER
+#define WOLFSSL_AES_CFB
+#define WOLFSSL_AES_OFB
+#define WOLFSSL_CMAC
+#define HAVE_AES_KEYWRAP
+#define WOLFSSL_AES_KEYWRAP_PADDING
+
+/* RSA up to 4096 bits: raw modexp, and PSS and OAEP padding. */
+#define WC_RSA_NO_PADDING
+#define WOLFSSL_SP_4096
+
+/* ECC: NIST P-192 to P-521, the Brainpool curves, and ECIES over them. */
+#define HAVE_ECC
+#define HAVE_ECC192
+#define HAVE_ALL_CURVES
+#define HAVE_ECC_BRAINPOOL
+#define WOLFSSL_CUSTOM_CURVES
+#define HAVE_ECC_ENCRYPT
+#define WOLFSSL_ECIES_GEN_IV
+
+/* Ed25519 and Ed448 signing, X25519 and X448 key agreement. */
+#define HAVE_CURVE25519
+#define HAVE_ED25519
+#define HAVE_CURVE448
+#define HAVE_ED448
+
 /* TLS 1.3 */
 #define WOLFSSL_TLS13
 #define HAVE_TLS_EXTENSIONS
@@ -76,23 +111,8 @@
 /* #define WOLFSSL_ARMASM */
 /* #define WOLFSSL_ARMASM_INLINE */
 
-/* Uncomment for Versal Gen 2 ASU hardware crypto offload. Also enable the
- * xilasu and xilmailbox libraries in this BSP. wolfCrypt_Init registers the
- * device, so the app needs no ASU calls of its own. */
-/* #define WOLFSSL_VERSAL_GEN2_ASU */
-
-/* Change the 1 below to 0, or delete this block, once you have picked where
- * the random seed comes from. Some choices:
- *   CUSTOM_RAND_GENERATE_SEED  you supply a seed function
- *   WOLF_CRYPTO_CB             a crypto callback answers the seed request
- *   WOLFSSL_GENSEED_FORTEST    fake seed, test builds only
- *   WC_NO_RNG                  this build needs no random numbers
- * On Xilinx parts a port can seed wolfSSL for you, so no define above is
- * needed: WOLFSSL_VERSAL_GEN2_ASU on Versal Gen 2, or
- * WOLFSSL_XILINX_CRYPT_VERSAL on Versal. See wolfcrypt/src/port/xilinx/ for
- * what each port covers. */
-#if 1
-    #error "Pick a random seed source in user_settings.h, then clear this"
-#endif
+/* Versal Gen 2 ASU hardware crypto offload, every engine, on by default. It
+ * seeds wolfSSL from the TRNG too. Enable xilasu and xilmailbox in this BSP. */
+#define WOLFSSL_VERSAL_GEN2_ASU
 
 #endif /* USER_SETTINGS_H */
diff --git a/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_ecies.c b/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_ecies.c
index d9b75239fa..2487f2f512 100644
--- a/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_ecies.c
+++ b/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_ecies.c
@@ -38,11 +38,11 @@
 #include <wolfssl/wolfcrypt/wolfmath.h>
 #include <wolfssl/wolfcrypt/random.h>
 
-/* The ASU takes raw x and y only, so a compressed key always runs in software.
- * Define WOLFSSL_VERSAL_GEN2_ASU_NO_COMP_KEY_WARN to silence this. */
+/* The ASU takes raw x and y only, so ECIES refuses a compressed key. Define
+ * WOLFSSL_VERSAL_GEN2_ASU_NO_COMP_KEY_WARN to silence this. */
 #if defined(HAVE_COMP_KEY) && \
     !defined(WOLFSSL_VERSAL_GEN2_ASU_NO_COMP_KEY_WARN)
-    #warning "ASU ECIES cannot offload compressed keys, software handles them"
+    #warning "ASU ECIES refuses compressed keys, it cannot offload them"
 #endif
 
 #ifdef NO_INLINE
@@ -292,11 +292,12 @@ static int wc_AsuEciesEncrypt(wc_CryptoInfo* info)
         info->pk.eciesencrypt.outSz == NULL || ctx == NULL) {
         return CRYPTOCB_UNAVAILABLE;
     }
-    /* The ASU only writes uncompressed keys, so turn down compressed. */
+    /* The ASU only writes uncompressed keys. Fail rather than fall back, so
+     * the hardening the caller offloaded for is not lost without a word. */
     if (info->pk.eciesencrypt.compressed != 0) {
         WC_ASU_PRINTF("[ASU] ecies enc: compressed key asked for, "
-            "software will do it\r\n");
-        return CRYPTOCB_UNAVAILABLE;
+            "the ASU cannot write one\r\n");
+        return BAD_FUNC_ARG;
     }
     ret = wc_AsuEciesCurve(pubKey, &curveType, &keyLen);
     if (ret != 0) {
@@ -521,11 +522,12 @@ static int wc_AsuEciesDecrypt(wc_CryptoInfo* info)
         }
     }
 
-    /* The sender key must be uncompressed, so turn down compressed. */
+    /* The sender key has to be uncompressed. Fail rather than hand the work
+     * to software, for the same reason as the encrypt path above. */
     if (msgSz < 1U || msg[0] != (byte)ECC_POINT_UNCOMP) {
         WC_ASU_PRINTF("[ASU] ecies dec: sender key is not uncompressed, "
-            "software will do it\r\n");
-        return CRYPTOCB_UNAVAILABLE;
+            "the ASU cannot read one\r\n");
+        return BAD_FUNC_ARG;
     }
     pubKeySz = 1U + (2U * (word32)keyLen);
     if (msgSz < pubKeySz + (word32)WC_ASU_ECIES_NONCE_SZ +