diff --git a/Makefile b/Makefile
index b10ef6256e..67ad0b7b10 100644
--- a/Makefile
+++ b/Makefile
@@ -95,6 +95,7 @@ ifndef WINDOWS
 install: no_test
 	mkdir -p $(DESTDIR)/include/mbedtls
 	cp -rp include/mbedtls $(DESTDIR)/include
+	cp -rp tf-psa-crypto/drivers/builtin/include/mbedtls $(DESTDIR)/include
 	mkdir -p $(DESTDIR)/include/psa
 	cp -rp tf-psa-crypto/include/psa $(DESTDIR)/include
 
diff --git a/tf-psa-crypto/include/CMakeLists.txt b/tf-psa-crypto/include/CMakeLists.txt
index dea92fe6ef..bca86ff4ee 100644
--- a/tf-psa-crypto/include/CMakeLists.txt
+++ b/tf-psa-crypto/include/CMakeLists.txt
@@ -1,14 +1,17 @@
-option(INSTALL_PSA_CRYPTO_HEADERS "Install PSA Crypto headers." ON)
-
-if(INSTALL_PSA_CRYPTO_HEADERS)
+option(INSTALL_TF_PSA_CRYPTO_HEADERS "Install TF PSA Crypto headers." ON)
 
+if(INSTALL_TF_PSA_CRYPTO_HEADERS)
     file(GLOB psa_headers "psa/*.h")
+    file(GLOB mbedtls_crypto_headers "../drivers/builtin/include/mbedtls/*.h")
 
     install(FILES ${psa_headers}
         DESTINATION include/psa
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 
-endif(INSTALL_PSA_CRYPTO_HEADERS)
+    install(FILES ${mbedtls_crypto_headers}
+        DESTINATION include/mbedtls
+        PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
+endif(INSTALL_TF_PSA_CRYPTO_HEADERS)
 
 # Make includes available in an out-of-source build. ssl-opt.sh requires it.
 if (ENABLE_TESTING AND NOT ${CMAKE_CURRENT_BINARY_DIR} STREQUAL ${CMAKE_CURRENT_SOURCE_DIR})