diff --git a/programs/.gitignore b/programs/.gitignore
index e0c49873ee..c3e61c16bd 100644
--- a/programs/.gitignore
+++ b/programs/.gitignore
@@ -33,12 +33,6 @@ pkey/rsa_sign
 pkey/rsa_sign_pss
 pkey/rsa_verify
 pkey/rsa_verify_pss
-psa/aead_demo
-psa/crypto_examples
-psa/hmac_demo
-psa/key_ladder_demo
-psa/psa_constant_names
-psa/psa_hash
 random/gen_entropy
 random/gen_random_ctr_drbg
 ssl/dtls_client
@@ -75,7 +69,6 @@ x509/req_app
 
 ###START_GENERATED_FILES###
 # Generated source files
-/psa/psa_constant_names_generated.c
 /test/query_config.c
 
 # Generated data files
diff --git a/programs/CMakeLists.txt b/programs/CMakeLists.txt
index aaf93ba38d..87b9a1b5a7 100644
--- a/programs/CMakeLists.txt
+++ b/programs/CMakeLists.txt
@@ -8,7 +8,7 @@ if (NOT WIN32)
 endif()
 add_subdirectory(hash)
 add_subdirectory(pkey)
-add_subdirectory(psa)
+add_subdirectory(../tf-psa-crypto/programs/psa ../tf-psa-crypto/programs/psa)
 add_subdirectory(random)
 add_subdirectory(ssl)
 add_subdirectory(test)
diff --git a/programs/Makefile b/programs/Makefile
index 13fb793102..0b3025dc96 100644
--- a/programs/Makefile
+++ b/programs/Makefile
@@ -29,6 +29,9 @@ endif
 ## be declared by appending with `APPS += ...` afterwards.
 ## See the get_app_list function in scripts/generate_visualc_files.pl and
 ## make sure to check that it still works if you tweak the format here.
+##
+## Note: Variables cannot be used to define an apps path. This cannot be
+## substituted by the script generate_visualc_files.pl.
 APPS = \
 	aes/crypt_and_hash \
 	cipher/cipher_aead_demo \
@@ -55,12 +58,12 @@ APPS = \
 	pkey/rsa_sign_pss \
 	pkey/rsa_verify \
 	pkey/rsa_verify_pss \
-	psa/aead_demo \
-	psa/crypto_examples \
-	psa/hmac_demo \
-	psa/key_ladder_demo \
-	psa/psa_constant_names \
-	psa/psa_hash \
+	../tf-psa-crypto/programs/psa/aead_demo \
+	../tf-psa-crypto/programs/psa/crypto_examples \
+	../tf-psa-crypto/programs/psa/hmac_demo \
+	../tf-psa-crypto/programs/psa/key_ladder_demo \
+	../tf-psa-crypto/programs/psa/psa_constant_names \
+	../tf-psa-crypto/programs/psa/psa_hash \
 	random/gen_entropy \
 	random/gen_random_ctr_drbg \
 	ssl/dtls_client \
@@ -132,13 +135,13 @@ ${MBEDTLS_TEST_OBJS}:
 GENERATED_FILES = psa/psa_constant_names_generated.c test/query_config.c
 generated_files: $(GENERATED_FILES)
 
-psa/psa_constant_names_generated.c: $(gen_file_dep) ../scripts/generate_psa_constants.py
+../tf-psa-crypto/psa/psa_constant_names_generated.c: $(gen_file_dep) ../tf-psa-crypto/scripts/generate_psa_constants.py
 psa/psa_constant_names_generated.c: $(gen_file_dep) ../tf-psa-crypto/include/psa/crypto_values.h
 psa/psa_constant_names_generated.c: $(gen_file_dep) ../tf-psa-crypto/include/psa/crypto_extra.h
 psa/psa_constant_names_generated.c: $(gen_file_dep) ../tf-psa-crypto/tests/suites/test_suite_psa_crypto_metadata.data
 psa/psa_constant_names_generated.c:
 	echo "  Gen   $@"
-	$(PYTHON) ../scripts/generate_psa_constants.py
+	cd ../tf-psa-crypto; $(PYTHON) ./scripts/generate_psa_constants.py
 
 test/query_config.c: $(gen_file_dep) ../scripts/generate_query_config.pl
 ## The generated file only depends on the options that are present in mbedtls_config.h,
@@ -252,29 +255,29 @@ pkey/rsa_encrypt$(EXEXT): pkey/rsa_encrypt.c $(DEP)
 	echo "  CC    pkey/rsa_encrypt.c"
 	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) pkey/rsa_encrypt.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
-psa/aead_demo$(EXEXT): psa/aead_demo.c $(DEP)
+../tf-psa-crypto/programs/psa/aead_demo$(EXEXT): ../tf-psa-crypto/programs/psa/aead_demo.c $(DEP)
 	echo "  CC    psa/aead_demo.c"
-	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) psa/aead_demo.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) ../tf-psa-crypto/programs/psa/aead_demo.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
-psa/crypto_examples$(EXEXT): psa/crypto_examples.c $(DEP)
+../tf-psa-crypto/programs/psa/crypto_examples$(EXEXT): ../tf-psa-crypto/programs/psa/crypto_examples.c $(DEP)
 	echo "  CC    psa/crypto_examples.c"
-	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) psa/crypto_examples.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) ../tf-psa-crypto/programs/psa/crypto_examples.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
-psa/hmac_demo$(EXEXT): psa/hmac_demo.c $(DEP)
+../tf-psa-crypto/programs/psa/hmac_demo$(EXEXT): ../tf-psa-crypto/programs/psa/hmac_demo.c $(DEP)
 	echo "  CC    psa/hmac_demo.c"
-	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) psa/hmac_demo.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) ../tf-psa-crypto/programs/psa/hmac_demo.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
-psa/key_ladder_demo$(EXEXT): psa/key_ladder_demo.c $(DEP)
+../tf-psa-crypto/programs/psa/key_ladder_demo$(EXEXT): ../tf-psa-crypto/programs/psa/key_ladder_demo.c $(DEP)
 	echo "  CC    psa/key_ladder_demo.c"
-	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) psa/key_ladder_demo.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) ../tf-psa-crypto/programs/psa/key_ladder_demo.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
-psa/psa_constant_names$(EXEXT): psa/psa_constant_names.c psa/psa_constant_names_generated.c $(DEP)
+../tf-psa-crypto/programs/psa/psa_constant_names$(EXEXT): ../tf-psa-crypto/programs/psa/psa_constant_names.c psa/psa_constant_names_generated.c $(DEP)
 	echo "  CC    psa/psa_constant_names.c"
-	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) psa/psa_constant_names.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) ../tf-psa-crypto/programs/psa/psa_constant_names.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
-psa/psa_hash$(EXEXT): psa/psa_hash.c $(DEP)
+../tf-psa-crypto/programs/psa/psa_hash$(EXEXT): ../tf-psa-crypto/programs/psa/psa_hash.c $(DEP)
 	echo "  CC    psa/psa_hash.c"
-	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) psa/psa_hash.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
+	$(CC) $(LOCAL_CFLAGS) $(CFLAGS) ../tf-psa-crypto/programs/psa/psa_hash.c    $(LOCAL_LDFLAGS) $(LDFLAGS) -o $@
 
 random/gen_entropy$(EXEXT): random/gen_entropy.c $(DEP)
 	echo "  CC    random/gen_entropy.c"
diff --git a/scripts/generate_visualc_files.pl b/scripts/generate_visualc_files.pl
index 76a6c32406..d0fcb7d60f 100755
--- a/scripts/generate_visualc_files.pl
+++ b/scripts/generate_visualc_files.pl
@@ -21,7 +21,9 @@ my $vsx_main_file = "$vsx_dir/mbedTLS.$vsx_ext";
 my $vsx_sln_tpl_file = "scripts/data_files/vs2017-sln-template.sln";
 my $vsx_sln_file = "$vsx_dir/mbedTLS.sln";
 
-my $programs_dir = 'programs';
+my $mbedtls_programs_dir = "programs";
+my $tfpsacrypto_programs_dir = "tf-psa-crypto/programs";
+
 my $mbedtls_header_dir = 'include/mbedtls';
 my $drivers_builtin_header_dir = 'tf-psa-crypto/drivers/builtin/include/mbedtls';
 my $psa_header_dir = 'tf-psa-crypto/include/psa';
@@ -122,7 +124,8 @@ sub check_dirs {
         && -d $test_header_dir
         && -d $tls_test_header_dir
         && -d $test_drivers_header_dir
-        && -d $programs_dir;
+        && -d $mbedtls_programs_dir
+        && -d $tfpsacrypto_programs_dir;
 }
 
 sub slurp_file {
diff --git a/scripts/make_generated_files.bat b/scripts/make_generated_files.bat
index 0d2c0718f3..fb4a2253f4 100644
--- a/scripts/make_generated_files.bat
+++ b/scripts/make_generated_files.bat
@@ -19,7 +19,9 @@ python framework\scripts\generate_ssl_debug_helpers.py || exit /b 1
 perl scripts\generate_visualc_files.pl || exit /b 1
 
 @rem @@@@ programs\** @@@@
+cd tf-psa-crypto
 python scripts\generate_psa_constants.py || exit /b 1
+cd ..
 
 @rem @@@@ tests\** @@@@
 python framework\scripts\generate_bignum_tests.py --directory tf-psa-crypto\tests\suites || exit /b 1
diff --git a/tests/scripts/check-generated-files.sh b/tests/scripts/check-generated-files.sh
index edac387f6f..a66c37013b 100755
--- a/tests/scripts/check-generated-files.sh
+++ b/tests/scripts/check-generated-files.sh
@@ -140,6 +140,7 @@ check()
 # directory in Mbed TLS that is not just a TF-PSA-Crypto submodule.
 if [ -d tf-psa-crypto ]; then
     cd tf-psa-crypto
+    check scripts/generate_psa_constants.py ./programs/psa/psa_constant_names_generated.c
     check ../framework/scripts/generate_bignum_tests.py $(../framework/scripts/generate_bignum_tests.py --list)
     check ../framework/scripts/generate_config_tests.py tests/suites/test_suite_config.psa_boolean.data
     check ../framework/scripts/generate_ecp_tests.py $(../framework/scripts/generate_ecp_tests.py --list)
@@ -161,7 +162,6 @@ else
                                               ${crypto_core_dir}/psa_crypto_driver_wrappers_no_static.c
 fi
 
-check scripts/generate_psa_constants.py programs/psa/psa_constant_names_generated.c
 check framework/scripts/generate_test_keys.py framework/tests/src/test_keys.h
 
 # Additional checks for Mbed TLS only
diff --git a/tests/scripts/psa_collect_statuses.py b/tests/scripts/psa_collect_statuses.py
index 11bbebcc1f..d835ba7c9a 100755
--- a/tests/scripts/psa_collect_statuses.py
+++ b/tests/scripts/psa_collect_statuses.py
@@ -21,7 +21,7 @@ import subprocess
 import sys
 
 DEFAULT_STATUS_LOG_FILE = 'tests/statuses.log'
-DEFAULT_PSA_CONSTANT_NAMES = 'programs/psa/psa_constant_names'
+DEFAULT_PSA_CONSTANT_NAMES = 'tf-psa-crypto/programs/psa/psa_constant_names'
 
 class Statuses:
     """Information about observed return statues of API functions."""
diff --git a/tests/scripts/run_demos.py b/tests/scripts/run_demos.py
index 6a63d232fe..f9a8100141 100755
--- a/tests/scripts/run_demos.py
+++ b/tests/scripts/run_demos.py
@@ -44,7 +44,9 @@ def run_all_demos(quiet=False):
 
     Return True if all demos passed and False if a demo fails.
     """
-    all_demos = glob.glob('programs/*/*_demo.sh')
+    mbedtls_demos = glob.glob('programs/*/*_demo.sh')
+    tf_psa_crypto_demos = glob.glob('tf-psa-crypto/programs/*/*_demo.sh')
+    all_demos = mbedtls_demos + tf_psa_crypto_demos
     if not all_demos:
         # Keep the message on one line. pylint: disable=line-too-long
         raise Exception('No demos found. run_demos needs to operate from the Mbed TLS toplevel directory.')
diff --git a/tests/scripts/test_psa_constant_names.py b/tests/scripts/test_psa_constant_names.py
index 8ed0fee4b6..e697d1755c 100755
--- a/tests/scripts/test_psa_constant_names.py
+++ b/tests/scripts/test_psa_constant_names.py
@@ -173,7 +173,7 @@ def main():
                         action='store_false', dest='keep_c',
                         help='Don\'t keep the intermediate C file (default)')
     parser.add_argument('--program',
-                        default='programs/psa/psa_constant_names',
+                        default='tf-psa-crypto/programs/psa/psa_constant_names',
                         help='Program to test')
     parser.add_argument('--show',
                         action='store_true',
diff --git a/tf-psa-crypto/programs/.gitignore b/tf-psa-crypto/programs/.gitignore
index e69de29bb2..55c6e56a11 100644
--- a/tf-psa-crypto/programs/.gitignore
+++ b/tf-psa-crypto/programs/.gitignore
@@ -0,0 +1,10 @@
+psa/aead_demo
+psa/crypto_examples
+psa/hmac_demo
+psa/key_ladder_demo
+psa/psa_constant_names
+psa/psa_hash
+
+###START_GENERATED_FILES###
+# Generated source files
+psa/psa_constant_names_generated.c
diff --git a/programs/psa/CMakeLists.txt b/tf-psa-crypto/programs/psa/CMakeLists.txt
similarity index 90%
rename from programs/psa/CMakeLists.txt
rename to tf-psa-crypto/programs/psa/CMakeLists.txt
index 3c20a70993..2356c81fc1 100644
--- a/programs/psa/CMakeLists.txt
+++ b/tf-psa-crypto/programs/psa/CMakeLists.txt
@@ -20,8 +20,8 @@ if(GEN_FILES)
             ${CMAKE_CURRENT_SOURCE_DIR}/../..
         DEPENDS
             ${CMAKE_CURRENT_SOURCE_DIR}/../../scripts/generate_psa_constants.py
-            ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include/psa/crypto_values.h
-            ${CMAKE_CURRENT_SOURCE_DIR}/../../tf-psa-crypto/include/psa/crypto_extra.h
+            ${CMAKE_CURRENT_SOURCE_DIR}/../../include/psa/crypto_values.h
+            ${CMAKE_CURRENT_SOURCE_DIR}/../../include/psa/crypto_extra.h
     )
 else()
     link_to_source(psa_constant_names_generated.c)
diff --git a/programs/psa/aead_demo.c b/tf-psa-crypto/programs/psa/aead_demo.c
similarity index 100%
rename from programs/psa/aead_demo.c
rename to tf-psa-crypto/programs/psa/aead_demo.c
diff --git a/programs/psa/crypto_examples.c b/tf-psa-crypto/programs/psa/crypto_examples.c
similarity index 100%
rename from programs/psa/crypto_examples.c
rename to tf-psa-crypto/programs/psa/crypto_examples.c
diff --git a/programs/psa/hmac_demo.c b/tf-psa-crypto/programs/psa/hmac_demo.c
similarity index 100%
rename from programs/psa/hmac_demo.c
rename to tf-psa-crypto/programs/psa/hmac_demo.c
diff --git a/programs/psa/key_ladder_demo.c b/tf-psa-crypto/programs/psa/key_ladder_demo.c
similarity index 100%
rename from programs/psa/key_ladder_demo.c
rename to tf-psa-crypto/programs/psa/key_ladder_demo.c
diff --git a/programs/psa/key_ladder_demo.sh b/tf-psa-crypto/programs/psa/key_ladder_demo.sh
similarity index 97%
rename from programs/psa/key_ladder_demo.sh
rename to tf-psa-crypto/programs/psa/key_ladder_demo.sh
index e55da7ead8..526fde55a0 100755
--- a/programs/psa/key_ladder_demo.sh
+++ b/tf-psa-crypto/programs/psa/key_ladder_demo.sh
@@ -3,7 +3,7 @@
 # Copyright The Mbed TLS Contributors
 # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
 
-. "${0%/*}/../demo_common.sh"
+. "${0%/*}/../../../programs/demo_common.sh"
 
 msg <<'EOF'
 This script demonstrates the use of the PSA cryptography interface to
diff --git a/programs/psa/psa_constant_names.c b/tf-psa-crypto/programs/psa/psa_constant_names.c
similarity index 100%
rename from programs/psa/psa_constant_names.c
rename to tf-psa-crypto/programs/psa/psa_constant_names.c
diff --git a/programs/psa/psa_hash.c b/tf-psa-crypto/programs/psa/psa_hash.c
similarity index 100%
rename from programs/psa/psa_hash.c
rename to tf-psa-crypto/programs/psa/psa_hash.c
diff --git a/programs/psa/psa_hash_demo.sh b/tf-psa-crypto/programs/psa/psa_hash_demo.sh
similarity index 90%
rename from programs/psa/psa_hash_demo.sh
rename to tf-psa-crypto/programs/psa/psa_hash_demo.sh
index a26697cfe6..5e257d75cc 100755
--- a/programs/psa/psa_hash_demo.sh
+++ b/tf-psa-crypto/programs/psa/psa_hash_demo.sh
@@ -3,7 +3,7 @@
 # Copyright The Mbed TLS Contributors
 # SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
 
-. "${0%/*}/../demo_common.sh"
+. "${0%/*}/../../../programs/demo_common.sh"
 
 msg <<'EOF'
 This program demonstrates the use of the PSA cryptography interface to
diff --git a/scripts/generate_psa_constants.py b/tf-psa-crypto/scripts/generate_psa_constants.py
similarity index 98%
rename from scripts/generate_psa_constants.py
rename to tf-psa-crypto/scripts/generate_psa_constants.py
index d472c6dc51..a22e406e6f 100755
--- a/scripts/generate_psa_constants.py
+++ b/tf-psa-crypto/scripts/generate_psa_constants.py
@@ -329,6 +329,6 @@ if __name__ == '__main__':
     # Allow to change the directory where psa_constant_names_generated.c is written to.
     OUTPUT_FILE_DIR = sys.argv[1] if len(sys.argv) == 2 else "programs/psa"
 
-    generate_psa_constants(['tf-psa-crypto/include/psa/crypto_values.h',
-                            'tf-psa-crypto/include/psa/crypto_extra.h'],
+    generate_psa_constants(['include/psa/crypto_values.h',
+                            'include/psa/crypto_extra.h'],
                            OUTPUT_FILE_DIR + '/psa_constant_names_generated.c')