diff --git a/programs/pkey/dh_server.c b/programs/pkey/dh_server.c
index 54165dcf92..b883653eb7 100644
--- a/programs/pkey/dh_server.c
+++ b/programs/pkey/dh_server.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if defined(MBEDTLS_AES_C) && defined(MBEDTLS_DHM_C) && \
diff --git a/programs/pkey/pk_sign.c b/programs/pkey/pk_sign.c
index 3335575e26..2e9b2d8378 100644
--- a/programs/pkey/pk_sign.c
+++ b/programs/pkey/pk_sign.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_ENTROPY_C) ||  \
diff --git a/programs/pkey/pk_verify.c b/programs/pkey/pk_verify.c
index a6d34816bb..bdeb559eb0 100644
--- a/programs/pkey/pk_verify.c
+++ b/programs/pkey/pk_verify.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_MD_C) || \
diff --git a/programs/pkey/rsa_sign.c b/programs/pkey/rsa_sign.c
index 1308be28bd..8ba3e7d1f2 100644
--- a/programs/pkey/rsa_sign.c
+++ b/programs/pkey/rsa_sign.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_RSA_C) ||  \
diff --git a/programs/pkey/rsa_sign_pss.c b/programs/pkey/rsa_sign_pss.c
index 643ac47aa8..fe3de0309a 100644
--- a/programs/pkey/rsa_sign_pss.c
+++ b/programs/pkey/rsa_sign_pss.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_MD_C) || !defined(MBEDTLS_ENTROPY_C) ||  \
diff --git a/programs/pkey/rsa_verify.c b/programs/pkey/rsa_verify.c
index f65883df6a..ccdf13eb48 100644
--- a/programs/pkey/rsa_verify.c
+++ b/programs/pkey/rsa_verify.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_BIGNUM_C) || !defined(MBEDTLS_RSA_C) ||  \
diff --git a/programs/pkey/rsa_verify_pss.c b/programs/pkey/rsa_verify_pss.c
index bc2ea64a37..d7efa6549d 100644
--- a/programs/pkey/rsa_verify_pss.c
+++ b/programs/pkey/rsa_verify_pss.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_MD_C) || !defined(MBEDTLS_ENTROPY_C) ||  \
diff --git a/programs/psa/key_ladder_demo.c b/programs/psa/key_ladder_demo.c
index 084beb8903..6059fb132f 100644
--- a/programs/psa/key_ladder_demo.c
+++ b/programs/psa/key_ladder_demo.c
@@ -58,6 +58,7 @@
 
 #include "mbedtls/platform.h" // for mbedtls_setbuf
 #include "mbedtls/platform_util.h" // for mbedtls_platform_zeroize
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #include <psa/crypto.h>
diff --git a/programs/x509/cert_req.c b/programs/x509/cert_req.c
index e651f3c8b7..f35d62963a 100644
--- a/programs/x509/cert_req.c
+++ b/programs/x509/cert_req.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_X509_CSR_WRITE_C) || !defined(MBEDTLS_FS_IO) ||  \
diff --git a/programs/x509/cert_write.c b/programs/x509/cert_write.c
index 9ff9488f66..5c911ca758 100644
--- a/programs/x509/cert_write.c
+++ b/programs/x509/cert_write.c
@@ -20,6 +20,7 @@
 #include "mbedtls/build_info.h"
 
 #include "mbedtls/platform.h"
+// md.h is included this early since MD_CAN_XXX macros are defined there.
 #include "mbedtls/md.h"
 
 #if !defined(MBEDTLS_X509_CRT_WRITE_C) || \