diff --git a/framework b/framework
index 3f2ef1ecf6..6cb0bcb7d8 160000
--- a/framework
+++ b/framework
@@ -1 +1 @@
-Subproject commit 3f2ef1ecf6d70b1e6bb7ad587f9a5bd6eaf65a2a
+Subproject commit 6cb0bcb7d8dad05e29f611117b69accc4626a62f
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index 755efedd1c..9ea17af8b8 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -7,6 +7,12 @@ if(INSTALL_MBEDTLS_HEADERS)
     install(FILES ${headers}
         DESTINATION include/mbedtls
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
+
+    file(GLOB private_headers "mbedtls/private/*.h")
+
+    install(FILES ${private_headers}
+        DESTINATION include/mbedtls/private
+        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 endif(INSTALL_MBEDTLS_HEADERS)
 
 # Make mbedtls_config.h available in an out-of-source build. ssl-opt.sh requires it.
diff --git a/include/mbedtls/build_info.h b/include/mbedtls/build_info.h
index c6e89db677..b46db36d1f 100644
--- a/include/mbedtls/build_info.h
+++ b/include/mbedtls/build_info.h
@@ -74,9 +74,9 @@
  */
 #define MBEDTLS_CONFIG_FILES_READ
 
-#include "mbedtls/config_adjust_x509.h"
+#include "mbedtls/private/config_adjust_x509.h"
 
-#include "mbedtls/config_adjust_ssl.h"
+#include "mbedtls/private/config_adjust_ssl.h"
 
 /* Indicate that all configuration symbols are set,
  * even the ones that are calculated programmatically.
diff --git a/include/mbedtls/debug.h b/include/mbedtls/debug.h
index b6d4e27052..c293e87315 100644
--- a/include/mbedtls/debug.h
+++ b/include/mbedtls/debug.h
@@ -15,7 +15,7 @@
 #include "mbedtls/ssl.h"
 
 #if defined(MBEDTLS_ECP_C)
-#include "mbedtls/ecp.h"
+#include "mbedtls/private/ecp.h"
 #endif
 
 #if defined(MBEDTLS_DEBUG_C)
diff --git a/include/mbedtls/error.h b/include/mbedtls/error.h
index 7abb00fd03..ee3d093c93 100644
--- a/include/mbedtls/error.h
+++ b/include/mbedtls/error.h
@@ -11,7 +11,7 @@
 #define MBEDTLS_ERROR_H
 
 #include "mbedtls/build_info.h"
-#include "mbedtls/error_common.h"
+#include "mbedtls/private/error_common.h"
 
 #include <stddef.h>
 
diff --git a/include/mbedtls/config_adjust_ssl.h b/include/mbedtls/private/config_adjust_ssl.h
similarity index 98%
rename from include/mbedtls/config_adjust_ssl.h
rename to include/mbedtls/private/config_adjust_ssl.h
index 36641e18b6..4e006f86da 100644
--- a/include/mbedtls/config_adjust_ssl.h
+++ b/include/mbedtls/private/config_adjust_ssl.h
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls/config_adjust_ssl.h
+ * \file mbedtls/private/config_adjust_ssl.h
  * \brief Adjust TLS configuration
  *
  * This is an internal header. Do not include it directly.
diff --git a/include/mbedtls/config_adjust_x509.h b/include/mbedtls/private/config_adjust_x509.h
similarity index 96%
rename from include/mbedtls/config_adjust_x509.h
rename to include/mbedtls/private/config_adjust_x509.h
index cfb2d88916..4af976666b 100644
--- a/include/mbedtls/config_adjust_x509.h
+++ b/include/mbedtls/private/config_adjust_x509.h
@@ -1,5 +1,5 @@
 /**
- * \file mbedtls/config_adjust_x509.h
+ * \file mbedtls/private/config_adjust_x509.h
  * \brief Adjust X.509 configuration
  *
  * This is an internal header. Do not include it directly.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index 628d5c7e71..36132c34e3 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -14,8 +14,8 @@
 
 #include "mbedtls/build_info.h"
 
-#include "mbedtls/bignum.h"
-#include "mbedtls/ecp.h"
+#include "mbedtls/private/bignum.h"
+#include "mbedtls/private/ecp.h"
 
 #include "mbedtls/ssl_ciphersuites.h"
 
@@ -27,7 +27,7 @@
 #include "mbedtls/md.h"
 
 #if defined(MBEDTLS_KEY_EXCHANGE_SOME_ECDH_OR_ECDHE_ANY_ENABLED)
-#include "mbedtls/ecdh.h"
+#include "mbedtls/private/ecdh.h"
 #endif
 
 #if defined(MBEDTLS_HAVE_TIME)
diff --git a/include/mbedtls/ssl_ciphersuites.h b/include/mbedtls/ssl_ciphersuites.h
index b03123107c..c97f6abeee 100644
--- a/include/mbedtls/ssl_ciphersuites.h
+++ b/include/mbedtls/ssl_ciphersuites.h
@@ -14,7 +14,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/pk.h"
-#include "mbedtls/cipher.h"
+#include "mbedtls/private/cipher.h"
 #include "mbedtls/md.h"
 
 #ifdef __cplusplus
diff --git a/include/mbedtls/x509.h b/include/mbedtls/x509.h
index b1a80e3011..f0742a8a87 100644
--- a/include/mbedtls/x509.h
+++ b/include/mbedtls/x509.h
@@ -17,7 +17,7 @@
 #include "mbedtls/pk.h"
 
 #if defined(MBEDTLS_RSA_C)
-#include "mbedtls/rsa.h"
+#include "mbedtls/private/rsa.h"
 #endif
 
 /**
diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index bbe5fc45cf..a7bf0291aa 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -15,7 +15,7 @@
 
 #include "mbedtls/x509.h"
 #include "mbedtls/x509_crl.h"
-#include "mbedtls/bignum.h"
+#include "mbedtls/private/bignum.h"
 
 /**
  * \addtogroup x509_module
diff --git a/library/ssl_misc.h b/library/ssl_misc.h
index 981ac0ecf1..ed3c4a776f 100644
--- a/library/ssl_misc.h
+++ b/library/ssl_misc.h
@@ -19,26 +19,26 @@
 #include "mbedtls/debug.h"
 #include "debug_internal.h"
 
-#include "mbedtls/cipher.h"
+#include "mbedtls/private/cipher.h"
 
 #include "psa/crypto.h"
 #include "psa_util_internal.h"
 extern const mbedtls_error_pair_t psa_to_ssl_errors[7];
 
 #if defined(PSA_WANT_ALG_MD5)
-#include "mbedtls/md5.h"
+#include "mbedtls/private/md5.h"
 #endif
 
 #if defined(PSA_WANT_ALG_SHA_1)
-#include "mbedtls/sha1.h"
+#include "mbedtls/private/sha1.h"
 #endif
 
 #if defined(PSA_WANT_ALG_SHA_256)
-#include "mbedtls/sha256.h"
+#include "mbedtls/private/sha256.h"
 #endif
 
 #if defined(PSA_WANT_ALG_SHA_512)
-#include "mbedtls/sha512.h"
+#include "mbedtls/private/sha512.h"
 #endif
 
 #include "mbedtls/pk.h"
diff --git a/library/ssl_tls12_server.c b/library/ssl_tls12_server.c
index b2b5e33c0b..181c6de3a0 100644
--- a/library/ssl_tls12_server.c
+++ b/library/ssl_tls12_server.c
@@ -34,7 +34,7 @@ static int local_err_translation(psa_status_t status)
 #endif
 
 #if defined(MBEDTLS_ECP_C)
-#include "mbedtls/ecp.h"
+#include "mbedtls/private/ecp.h"
 #endif
 
 #if defined(MBEDTLS_HAVE_TIME)
diff --git a/library/x509_internal.h b/library/x509_internal.h
index b44b957f9b..5505b9778c 100644
--- a/library/x509_internal.h
+++ b/library/x509_internal.h
@@ -19,7 +19,7 @@
 #include "pk_internal.h"
 
 #if defined(MBEDTLS_RSA_C)
-#include "mbedtls/rsa.h"
+#include "mbedtls/private/rsa.h"
 #endif
 
 int mbedtls_x509_get_name(unsigned char **p, const unsigned char *end,
diff --git a/programs/fuzz/fuzz_client.c b/programs/fuzz/fuzz_client.c
index 0878480ea7..70eb656487 100644
--- a/programs/fuzz/fuzz_client.c
+++ b/programs/fuzz/fuzz_client.c
@@ -1,8 +1,8 @@
 #define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
 
 #include "mbedtls/ssl.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "test/certs.h"
 #include "fuzz_common.h"
 #include <string.h>
diff --git a/programs/fuzz/fuzz_dtlsclient.c b/programs/fuzz/fuzz_dtlsclient.c
index ca7626d5ba..c83f314138 100644
--- a/programs/fuzz/fuzz_dtlsclient.c
+++ b/programs/fuzz/fuzz_dtlsclient.c
@@ -6,8 +6,8 @@
 #include "fuzz_common.h"
 #include "mbedtls/ssl.h"
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/timing.h"
 #include "test/certs.h"
 
diff --git a/programs/fuzz/fuzz_dtlsserver.c b/programs/fuzz/fuzz_dtlsserver.c
index 4f159fbefe..dd2a8b644b 100644
--- a/programs/fuzz/fuzz_dtlsserver.c
+++ b/programs/fuzz/fuzz_dtlsserver.c
@@ -7,8 +7,8 @@
 #include "mbedtls/ssl.h"
 #include "test/certs.h"
 #if defined(MBEDTLS_SSL_PROTO_DTLS)
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/timing.h"
 #include "mbedtls/ssl_cookie.h"
 
diff --git a/programs/fuzz/fuzz_server.c b/programs/fuzz/fuzz_server.c
index 3a5e502fe5..3b1054e16a 100644
--- a/programs/fuzz/fuzz_server.c
+++ b/programs/fuzz/fuzz_server.c
@@ -1,8 +1,8 @@
 #define MBEDTLS_DECLARE_PRIVATE_IDENTIFIERS
 
 #include "mbedtls/ssl.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/ssl_ticket.h"
 #include "test/certs.h"
 #include "fuzz_common.h"
diff --git a/programs/ssl/dtls_client.c b/programs/ssl/dtls_client.c
index 26eb20d49f..bb1d5af2e3 100644
--- a/programs/ssl/dtls_client.c
+++ b/programs/ssl/dtls_client.c
@@ -31,8 +31,8 @@ int main(void)
 #include "mbedtls/net_sockets.h"
 #include "mbedtls/debug.h"
 #include "mbedtls/ssl.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/error.h"
 #include "mbedtls/timing.h"
 #include "test/certs.h"
diff --git a/programs/ssl/dtls_server.c b/programs/ssl/dtls_server.c
index 0e155fd0d2..479b5430f9 100644
--- a/programs/ssl/dtls_server.c
+++ b/programs/ssl/dtls_server.c
@@ -45,8 +45,8 @@ int main(void)
 #include <stdlib.h>
 #include <stdio.h>
 
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/ssl.h"
 #include "mbedtls/ssl_cookie.h"
diff --git a/programs/ssl/mini_client.c b/programs/ssl/mini_client.c
index e3adb3cf8a..96d41b35ba 100644
--- a/programs/ssl/mini_client.c
+++ b/programs/ssl/mini_client.c
@@ -43,8 +43,8 @@ int main(void)
 
 #include "mbedtls/net_sockets.h"
 #include "mbedtls/ssl.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 
 #include <sys/socket.h>
 #include <netinet/in.h>
diff --git a/programs/ssl/ssl_client1.c b/programs/ssl/ssl_client1.c
index dba8aab658..c56ff0702f 100644
--- a/programs/ssl/ssl_client1.c
+++ b/programs/ssl/ssl_client1.c
@@ -27,8 +27,8 @@ int main(void)
 #include "mbedtls/net_sockets.h"
 #include "mbedtls/debug.h"
 #include "mbedtls/ssl.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/error.h"
 #include "test/certs.h"
 
diff --git a/programs/ssl/ssl_fork_server.c b/programs/ssl/ssl_fork_server.c
index f8752bb604..ff1c877ee2 100644
--- a/programs/ssl/ssl_fork_server.c
+++ b/programs/ssl/ssl_fork_server.c
@@ -31,8 +31,8 @@ int main(void)
 }
 #else
 
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "test/certs.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/ssl.h"
diff --git a/programs/ssl/ssl_mail_client.c b/programs/ssl/ssl_mail_client.c
index 521bc5418a..0c2822cb30 100644
--- a/programs/ssl/ssl_mail_client.c
+++ b/programs/ssl/ssl_mail_client.c
@@ -38,8 +38,8 @@ int main(void)
 #include "mbedtls/error.h"
 #include "mbedtls/net_sockets.h"
 #include "mbedtls/ssl.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "test/certs.h"
 #include "mbedtls/x509.h"
 
diff --git a/programs/ssl/ssl_pthread_server.c b/programs/ssl/ssl_pthread_server.c
index 5701a7b838..867926d98c 100644
--- a/programs/ssl/ssl_pthread_server.c
+++ b/programs/ssl/ssl_pthread_server.c
@@ -38,8 +38,8 @@ int main(void)
 #include <windows.h>
 #endif
 
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/ssl.h"
 #include "mbedtls/net_sockets.h"
diff --git a/programs/ssl/ssl_server.c b/programs/ssl/ssl_server.c
index 2f26ca4801..fd9da18490 100644
--- a/programs/ssl/ssl_server.c
+++ b/programs/ssl/ssl_server.c
@@ -31,8 +31,8 @@ int main(void)
 #include <windows.h>
 #endif
 
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/ssl.h"
 #include "mbedtls/net_sockets.h"
diff --git a/programs/ssl/ssl_test_lib.h b/programs/ssl/ssl_test_lib.h
index 20dbe61dfe..1dda8d62ac 100644
--- a/programs/ssl/ssl_test_lib.h
+++ b/programs/ssl/ssl_test_lib.h
@@ -43,9 +43,9 @@
 #include "mbedtls/net_sockets.h"
 #include "mbedtls/ssl.h"
 #include "mbedtls/ssl_ciphersuites.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
-#include "mbedtls/hmac_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
+#include "mbedtls/private/hmac_drbg.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/error.h"
 #include "mbedtls/debug.h"
diff --git a/programs/test/selftest.c b/programs/test/selftest.c
index 372a84dc79..2c2b48ed82 100644
--- a/programs/test/selftest.c
+++ b/programs/test/selftest.c
@@ -9,31 +9,31 @@
 
 #include "mbedtls/build_info.h"
 
-#include "mbedtls/entropy.h"
-#include "mbedtls/hmac_drbg.h"
-#include "mbedtls/ctr_drbg.h"
-#include "mbedtls/gcm.h"
-#include "mbedtls/ccm.h"
-#include "mbedtls/cmac.h"
-#include "mbedtls/md5.h"
-#include "mbedtls/ripemd160.h"
-#include "mbedtls/sha1.h"
-#include "mbedtls/sha256.h"
-#include "mbedtls/sha512.h"
-#include "mbedtls/sha3.h"
-#include "mbedtls/aes.h"
-#include "mbedtls/camellia.h"
-#include "mbedtls/aria.h"
-#include "mbedtls/chacha20.h"
-#include "mbedtls/poly1305.h"
-#include "mbedtls/chachapoly.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/hmac_drbg.h"
+#include "mbedtls/private/ctr_drbg.h"
+#include "mbedtls/private/gcm.h"
+#include "mbedtls/private/ccm.h"
+#include "mbedtls/private/cmac.h"
+#include "mbedtls/private/md5.h"
+#include "mbedtls/private/ripemd160.h"
+#include "mbedtls/private/sha1.h"
+#include "mbedtls/private/sha256.h"
+#include "mbedtls/private/sha512.h"
+#include "mbedtls/private/sha3.h"
+#include "mbedtls/private/aes.h"
+#include "mbedtls/private/camellia.h"
+#include "mbedtls/private/aria.h"
+#include "mbedtls/private/chacha20.h"
+#include "mbedtls/private/poly1305.h"
+#include "mbedtls/private/chachapoly.h"
 #include "mbedtls/base64.h"
-#include "mbedtls/bignum.h"
-#include "mbedtls/rsa.h"
+#include "mbedtls/private/bignum.h"
+#include "mbedtls/private/rsa.h"
 #include "mbedtls/x509.h"
-#include "mbedtls/pkcs5.h"
-#include "mbedtls/ecp.h"
-#include "mbedtls/ecjpake.h"
+#include "mbedtls/private/pkcs5.h"
+#include "mbedtls/private/ecp.h"
+#include "mbedtls/private/ecjpake.h"
 #include "mbedtls/timing.h"
 #include "mbedtls/nist_kw.h"
 #include "mbedtls/debug.h"
diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index c747505519..2f31a8e3ae 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -27,8 +27,8 @@ int main(void)
 }
 #else
 
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/net_sockets.h"
 #include "mbedtls/ssl.h"
 #include "mbedtls/x509.h"
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index 02fd567841..c20f08d569 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -29,8 +29,8 @@ int main(void)
 #else
 
 #include "mbedtls/x509_csr.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/error.h"
 
 #include <stdio.h>
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index fb55c3f291..2ed63f08de 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -31,8 +31,8 @@ int main(void)
 #include "mbedtls/x509_crt.h"
 #include "mbedtls/x509_csr.h"
 #include "mbedtls/oid.h"
-#include "mbedtls/entropy.h"
-#include "mbedtls/ctr_drbg.h"
+#include "mbedtls/private/entropy.h"
+#include "mbedtls/private/ctr_drbg.h"
 #include "mbedtls/error.h"
 #include "test/helpers.h"
 
diff --git a/tests/psa-client-server/psasim/src/aut_psa_random.c b/tests/psa-client-server/psasim/src/aut_psa_random.c
index 5880c4deb9..203f4d44ba 100644
--- a/tests/psa-client-server/psasim/src/aut_psa_random.c
+++ b/tests/psa-client-server/psasim/src/aut_psa_random.c
@@ -10,7 +10,7 @@
 #include <stdio.h>
 #include <stdlib.h>
 
-#include "mbedtls/entropy.h"
+#include "mbedtls/private/entropy.h"
 
 #define BUFFER_SIZE 100
 
diff --git a/tests/scripts/libtestdriver1_rewrite.pl b/tests/scripts/libtestdriver1_rewrite.pl
index f96ff5e05c..36143b0caf 100755
--- a/tests/scripts/libtestdriver1_rewrite.pl
+++ b/tests/scripts/libtestdriver1_rewrite.pl
@@ -22,8 +22,8 @@ my $private_files_regex = join('|', map { quotemeta($_) } @private_files);
 while (<>) {
     s!^(\s*#\s*include\s*[\"<])mbedtls/build_info.h!${1}libtestdriver1/include/mbedtls/build_info.h!;
     s!^(\s*#\s*include\s*[\"<])mbedtls/mbedtls_config.h!${1}libtestdriver1/include/mbedtls/mbedtls_config.h!;
-    s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_x509.h!${1}libtestdriver1/include/mbedtls/config_adjust_x509.h!;
-    s!^(\s*#\s*include\s*[\"<])mbedtls/config_adjust_ssl.h!${1}libtestdriver1/include/mbedtls/config_adjust_ssl.h!;
+    s!^(\s*#\s*include\s*[\"<])mbedtls/private/config_adjust_x509.h!${1}libtestdriver1/include/mbedtls/private/config_adjust_x509.h!;
+    s!^(\s*#\s*include\s*[\"<])mbedtls/private/config_adjust_ssl.h!${1}libtestdriver1/include/mbedtls/private/config_adjust_ssl.h!;
     s!^(\s*#\s*include\s*[\"<])mbedtls/check_config.h!${1}libtestdriver1/include/mbedtls/check_config.h!;
     # Files in include/mbedtls and drivers/builtin/include/mbedtls are both
     # included in files via #include mbedtls/<file>.h, so when expanding to the
diff --git a/tests/suites/test_suite_pkcs7.function b/tests/suites/test_suite_pkcs7.function
index 0c4a00b9e3..91e0e46ae3 100644
--- a/tests/suites/test_suite_pkcs7.function
+++ b/tests/suites/test_suite_pkcs7.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "mbedtls/bignum.h"
+#include "mbedtls/private/bignum.h"
 #include "mbedtls/pkcs7.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/x509_crt.h"
@@ -8,7 +8,7 @@
 #include "mbedtls/oid.h"
 #include "sys/types.h"
 #include "sys/stat.h"
-#include "mbedtls/rsa.h"
+#include "mbedtls/private/rsa.h"
 #include "mbedtls/error.h"
 /* END_HEADER */
 
diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function
index 079dca48c9..f813cc1ac3 100644
--- a/tests/suites/test_suite_x509parse.function
+++ b/tests/suites/test_suite_x509parse.function
@@ -1,5 +1,5 @@
 /* BEGIN_HEADER */
-#include "mbedtls/bignum.h"
+#include "mbedtls/private/bignum.h"
 #include "mbedtls/x509.h"
 #include "mbedtls/x509_crt.h"
 #include "mbedtls/x509_crl.h"
diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function
index 000c09a950..40677f2338 100644
--- a/tests/suites/test_suite_x509write.function
+++ b/tests/suites/test_suite_x509write.function
@@ -1,12 +1,12 @@
 /* BEGIN_HEADER */
-#include "mbedtls/bignum.h"
+#include "mbedtls/private/bignum.h"
 #include "mbedtls/x509_crt.h"
 #include "mbedtls/x509_csr.h"
 #include "x509_internal.h"
 #include "mbedtls/pem.h"
 #include "mbedtls/oid.h"
 #include "x509_oid.h"
-#include "mbedtls/rsa.h"
+#include "mbedtls/private/rsa.h"
 #include "mbedtls/asn1.h"
 #include "mbedtls/asn1write.h"
 #include "mbedtls/pk.h"
diff --git a/tf-psa-crypto b/tf-psa-crypto
index 3fd4e754b2..20524a8972 160000
--- a/tf-psa-crypto
+++ b/tf-psa-crypto
@@ -1 +1 @@
-Subproject commit 3fd4e754b283d7b766d8f3798fe07d42b3bcf961
+Subproject commit 20524a89722972a7dbf06a32ab7bb225053713f6