diff --git a/src/ssl_api_dtls.c b/src/ssl_api_dtls.c
index c308bdb2e5..2d467b5fdf 100644
--- a/src/ssl_api_dtls.c
+++ b/src/ssl_api_dtls.c
@@ -1976,7 +1976,7 @@ int wolfSSL_DTLS_SetCookieSecretSecondary(WOLFSSL* ssl,
 #endif /* WOLFSSL_DTLS && !NO_WOLFSSL_SERVER */
 
 #if (defined(WOLFSSL_DTLS) || defined(WOLFSSL_SEND_HRR_COOKIE)) && \
-    !defined(NO_WOLFSSL_SERVER)
+    !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)
 static int CheckCookieSide(WOLFSSL* ssl)
 {
     if (ssl == NULL)
@@ -2183,7 +2183,8 @@ int wolfSSL_enable_cookie(WOLFSSL* ssl)
 
     return CookiePolicyEnable(ssl);
 }
-#endif /* (WOLFSSL_DTLS || WOLFSSL_SEND_HRR_COOKIE) && !NO_WOLFSSL_SERVER */
+#endif /* (WOLFSSL_DTLS || WOLFSSL_SEND_HRR_COOKIE) && !NO_WOLFSSL_SERVER && */
+       /* !NO_TLS                                                            */
 
 #endif /* !WOLFCRYPT_ONLY */
 
diff --git a/wolfcrypt/test/test.c b/wolfcrypt/test/test.c
index 807a7728ee..24f6212872 100644
--- a/wolfcrypt/test/test.c
+++ b/wolfcrypt/test/test.c
@@ -58740,7 +58740,9 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t curve448_test(void)
 {
     WC_RNG  rng;
     wc_test_ret_t ret;
-    curve448_key userA, userB, pubKey;
+    WC_DECLARE_VAR(userA, curve448_key, 1, HEAP_HINT);
+    WC_DECLARE_VAR(userB, curve448_key, 1, HEAP_HINT);
+    WC_DECLARE_VAR(pubKey, curve448_key, 1, HEAP_HINT);
 
     WOLFSSL_ENTER("curve448_test");
 
@@ -58752,36 +58754,62 @@ WOLFSSL_TEST_SUBROUTINE wc_test_ret_t curve448_test(void)
     if (ret != 0)
         return WC_TEST_RET_ENC_EC(ret);
 
-    wc_curve448_init_ex(&userA, HEAP_HINT, devId);
-    wc_curve448_init_ex(&userB, HEAP_HINT, devId);
-    wc_curve448_init_ex(&pubKey, HEAP_HINT, devId);
+    WC_ALLOC_VAR(userA, curve448_key, 1, HEAP_HINT);
+    WC_ALLOC_VAR(userB, curve448_key, 1, HEAP_HINT);
+    WC_ALLOC_VAR(pubKey, curve448_key, 1, HEAP_HINT);
 
-    ret = curve448_keyagree_test(&rng, &userA, &userB, &pubKey);
+#ifdef WC_DECLARE_VAR_IS_HEAP_ALLOC
+    if ((userA == NULL) ||
+        (userB == NULL) ||
+        (pubKey == NULL))
+    {
+        ERROR_OUT(WC_TEST_RET_ENC_EC(MEMORY_E), out);
+        goto out;
+    }
+#endif
+
+    ret = wc_curve448_init_ex(userA, HEAP_HINT, devId);
     if (ret != 0)
-        return ret;
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
+
+    ret = wc_curve448_init_ex(userB, HEAP_HINT, devId);
+    if (ret != 0)
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
+
+    ret = wc_curve448_init_ex(pubKey, HEAP_HINT, devId);
+    if (ret != 0)
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
+
+    ret = curve448_keyagree_test(&rng, userA, userB, pubKey);
+    if (ret != 0)
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
 
 #if defined(HAVE_CURVE448_SHARED_SECRET) && \
                                              defined(HAVE_CURVE448_KEY_IMPORT)
-    ret = curve448_kat_test(&rng, &userA, &userB);
+    ret = curve448_kat_test(&rng, userA, userB);
     if (ret != 0)
-        return ret;
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
 
     ret = curve448_check_public_test();
     if (ret != 0)
-        return ret;
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
+
     ret = curve448_noncanonical_test();
     if (ret != 0)
-        return ret;
+        ERROR_OUT(WC_TEST_RET_ENC_EC(ret), out);
 #endif /* HAVE_CURVE448_SHARED_SECRET && HAVE_CURVE448_KEY_IMPORT */
 
-    /* clean up keys when done */
-    wc_curve448_free(&pubKey);
-    wc_curve448_free(&userB);
-    wc_curve448_free(&userA);
+out:
 
     wc_FreeRng(&rng);
+    wc_curve448_free(pubKey);
+    wc_curve448_free(userB);
+    wc_curve448_free(userA);
+    WC_FREE_VAR(pubKey, HEAP_HINT);
+    WC_FREE_VAR(userB, HEAP_HINT);
+    WC_FREE_VAR(userA, HEAP_HINT);
 
-    return 0;
+    return ret;
 }
 #endif /* HAVE_CURVE448 */
 
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index 4bc5cbd82d..1eec79aaa3 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -5387,7 +5387,7 @@ WOLFSSL_API int wolfSSL_CTX_RequireExtendedMasterSecret(WOLFSSL_CTX* ctx);
 
 
 #if (defined(WOLFSSL_DTLS) || defined(WOLFSSL_SEND_HRR_COOKIE)) && \
-    !defined(NO_WOLFSSL_SERVER)
+    !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)
 WOLFSSL_API int wolfSSL_disable_cookie(WOLFSSL* ssl);
 WOLFSSL_API int wolfSSL_enable_cookie(WOLFSSL* ssl);
 #endif