diff --git a/ChangeLog.d/gnuinstalldirs_include.txt b/ChangeLog.d/gnuinstalldirs_include.txt
new file mode 100644
index 0000000000..7e0782d1e1
--- /dev/null
+++ b/ChangeLog.d/gnuinstalldirs_include.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * CMake now installs headers to `CMAKE_INSTALL_INCLUDEDIR` instead of the
+     hard-coded `include` directory.
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 9ea17af8b8..f76977fbab 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -5,13 +5,13 @@ if(INSTALL_MBEDTLS_HEADERS)
     file(GLOB headers "mbedtls/*.h")
 
     install(FILES ${headers}
-        DESTINATION include/mbedtls
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 
     file(GLOB private_headers "mbedtls/private/*.h")
 
     install(FILES ${private_headers}
-        DESTINATION include/mbedtls/private
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls/private
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 endif(INSTALL_MBEDTLS_HEADERS)
 
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index 6d8c78807a..5474e2cacf 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -241,7 +241,7 @@ foreach(target IN LISTS target_libraries)
         PUBLIC $<BUILD_INTERFACE:${MBEDTLS_DIR}/include/>
                $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/include/>
                $<BUILD_INTERFACE:${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/include/>
-               $<INSTALL_INTERFACE:include/>
+               $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
         PRIVATE ${MBEDTLS_DIR}/library/
                 ${MBEDTLS_DIR}/tf-psa-crypto/core
                 ${MBEDTLS_DIR}/tf-psa-crypto/drivers/builtin/src