diff --git a/tf-psa-crypto/programs/test/cmake_package_install/.gitignore b/tf-psa-crypto/programs/test/cmake_package_install/.gitignore
new file mode 100644
index 0000000000..b8bcb62f05
--- /dev/null
+++ b/tf-psa-crypto/programs/test/cmake_package_install/.gitignore
@@ -0,0 +1,4 @@
+build
+Makefile
+cmake_package_install
+tf-psa-crypto
diff --git a/tf-psa-crypto/programs/test/cmake_package_install/CMakeLists.txt b/tf-psa-crypto/programs/test/cmake_package_install/CMakeLists.txt
new file mode 100644
index 0000000000..a6d82a6dad
--- /dev/null
+++ b/tf-psa-crypto/programs/test/cmake_package_install/CMakeLists.txt
@@ -0,0 +1,40 @@
+cmake_minimum_required(VERSION 3.5.1)
+
+#
+# Simulate configuring and building Mbed TLS as the user might do it. We'll
+# install into a directory inside our own build directory.
+#
+
+set(TF-PSA-Crypto_SOURCE_DIR "${CMAKE_CURRENT_SOURCE_DIR}/../../..")
+set(TF-PSA-Crypto_INSTALL_DIR "${CMAKE_CURRENT_BINARY_DIR}/tf-psa-crypto")
+set(TF-PSA-Crypto_BINARY_DIR "${TF-PSA-Crypto_INSTALL_DIR}${CMAKE_FILES_DIRECTORY}")
+
+execute_process(
+    COMMAND "${CMAKE_COMMAND}"
+        "-H${TF-PSA-Crypto_SOURCE_DIR}"
+        "-B${TF-PSA-Crypto_BINARY_DIR}"
+        "-DENABLE_PROGRAMS=NO"
+        "-DENABLE_TESTING=NO"
+        # Turn on generated files explicitly in case this is a release
+        "-DGEN_FILES=ON"
+        "-DCMAKE_INSTALL_PREFIX=${TF-PSA-Crypto_INSTALL_DIR}")
+
+execute_process(
+    COMMAND "${CMAKE_COMMAND}"
+        --build "${TF-PSA-Crypto_BINARY_DIR}"
+        --target install)
+
+#
+# Locate the package.
+#
+
+list(INSERT CMAKE_PREFIX_PATH 0 "${TF-PSA-Crypto_INSTALL_DIR}")
+find_package(TF-PSA-Crypto REQUIRED)
+
+#
+# At this point, the TF-PSA-Crypto targets should have been imported, and we
+# can now link to them from our own program.
+#
+
+add_executable(cmake_package_install cmake_package_install.c)
+target_link_libraries(cmake_package_install TF-PSA-Crypto::tfpsacrypto)
diff --git a/tf-psa-crypto/programs/test/cmake_package_install/cmake_package_install.c b/tf-psa-crypto/programs/test/cmake_package_install/cmake_package_install.c
new file mode 100644
index 0000000000..082ca27e7f
--- /dev/null
+++ b/tf-psa-crypto/programs/test/cmake_package_install/cmake_package_install.c
@@ -0,0 +1,19 @@
+/*
+ * Simple program to test that TF-PSA-Crypto builds correctly as an installable
+ * CMake package.
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include <psa/crypto.h>
+
+/* The main reason to build this is for testing the CMake build, so the program
+ * doesn't need to do very much. It calls a PSA cryptography API to ensure
+ * linkage works, but that is all. */
+int main()
+{
+    psa_crypto_init();
+
+    return 0;
+}
diff --git a/tf-psa-crypto/tests/scripts/components-build-system.sh b/tf-psa-crypto/tests/scripts/components-build-system.sh
index 5de9dc7876..5dd7869ba6 100644
--- a/tf-psa-crypto/tests/scripts/components-build-system.sh
+++ b/tf-psa-crypto/tests/scripts/components-build-system.sh
@@ -31,3 +31,12 @@ component_test_tf_psa_crypto_cmake_as_subdirectory () {
     make
     ./cmake_subproject
 }
+
+component_test_tf_psa_crypto_cmake_as_package_install () {
+    msg "build: cmake 'as-installed-package' build"
+    cd programs/test/cmake_package_install
+    # Note: Explicitly generate files as these are turned off in releases
+    cmake .
+    make
+    ./cmake_package_install
+}