diff --git a/scripts/data_files/query_config.fmt b/scripts/data_files/query_config.fmt
index 559734a6af..c60458b61b 100644
--- a/scripts/data_files/query_config.fmt
+++ b/scripts/data_files/query_config.fmt
@@ -12,6 +12,11 @@
 #include "mbedtls/platform.h"
 #include <string.h>
 
+/* Work around https://github.com/Mbed-TLS/TF-PSA-Crypto/issues/393 */
+#if defined(MBEDTLS_HAVE_TIME)
+#include <mbedtls/platform_time.h>
+#endif
+
 INCLUDE_HEADERS
 
 /*
diff --git a/scripts/generate_query_config.pl b/scripts/generate_query_config.pl
index e99d633de6..49e363de54 100755
--- a/scripts/generate_query_config.pl
+++ b/scripts/generate_query_config.pl
@@ -121,7 +121,11 @@ for my $root (@header_roots) {
     map {s!^\Q$root/!!} @paths;
     # Exclude some headers that are included by build_info.h and cannot
     # be included directly.
-    push @header_files, grep {!m!_config\.h|[/_]adjust[/_]!} @paths;
+    push @header_files, grep {!m[
+            ^mbedtls/platform_time\.h$ | # errors without time.h
+            _config\.h |
+            [/_]adjust[/_]
+        ]x} @paths;
 }
 my $include_headers = join('', map {"#include <$_>\n"} @header_files);