diff --git a/scripts/all-helpers.sh b/scripts/all-helpers.sh
index aaa55dc9b..5bc6286d8 100644
--- a/scripts/all-helpers.sh
+++ b/scripts/all-helpers.sh
@@ -149,6 +149,9 @@ helper_psasim_config() {
         scripts/config.py unset MBEDTLS_KEY_EXCHANGE_ECDHE_RSA_ENABLED
         scripts/config.py unset MBEDTLS_ECP_RESTARTABLE
         scripts/config.py unset MBEDTLS_PSA_CRYPTO_KEY_ID_ENCODES_OWNER
+
+        scripts/config.py unset-all MBEDTLS_SHA256_USE_.*_CRYPTO_
+        scripts/config.py unset-all MBEDTLS_SHA512_USE_.*_CRYPTO_
     else
         scripts/config.py crypto_full
         scripts/config.py unset MBEDTLS_PSA_CRYPTO_BUILTIN_KEYS
diff --git a/scripts/check_names.py b/scripts/check_names.py
index 57d2e1104..ef48e2ac9 100755
--- a/scripts/check_names.py
+++ b/scripts/check_names.py
@@ -812,9 +812,6 @@ class TFPSACryptoCodeParser(CodeParser):
 
             # Perform object file analysis using nm
             symbols = self.parse_symbols_from_nm([
-                build_dir + "/drivers/builtin/libbuiltin.a",
-                build_dir + "/drivers/p256-m/libp256m.a",
-                build_dir + "/drivers/everest/libeverest.a",
                 build_dir + "/core/libtfpsacrypto.a"
             ])
 
diff --git a/scripts/generate_config_tests.py b/scripts/generate_config_tests.py
index dcc73c30c..3f6a77abb 100755
--- a/scripts/generate_config_tests.py
+++ b/scripts/generate_config_tests.py
@@ -68,6 +68,13 @@ SIMPLE_DEPENDENCIES = {
 if build_tree.is_mbedtls_3_6():
     SIMPLE_DEPENDENCIES['MBEDTLS_NO_PLATFORM_ENTROPY'] = 'MBEDTLS_ENTROPY_C'
 
+BUILTIN_MODULE_ENABLEMENT_MACROS = [
+    'MBEDTLS_AES_C', 'MBEDTLS_CAMELLIA_C', 'MBEDTLS_CIPHER_C', 'MBEDTLS_GCM_C',
+    'MBEDTLS_ECDH_C', 'MBEDTLS_ECDSA_C', 'MBEDTLS_ECP_C',
+    'MBEDTLS_RSA_C',
+    'MBEDTLS_SHA256_C', 'MBEDTLS_SHA512_C',
+]
+
 def dependencies_of_setting(cfg: config_common.Config,
                             setting: config_common.Setting) -> Optional[str]:
     """Return dependencies without which a setting is not meaningful.
@@ -113,6 +120,11 @@ def dependencies_of_setting(cfg: config_common.Config,
             super_name = name[:pos.start()] + '_C'
             if cfg.known(super_name):
                 return super_name
+            # If super_name refers to a macro that still enables a
+            # cryptographic module, but is no longer exposed as a configuration
+            # option in 4.0/1.0, return it as a dependency.
+            if super_name in BUILTIN_MODULE_ENABLEMENT_MACROS:
+                return super_name
     if name.startswith('PSA_WANT_'):
         deps = 'MBEDTLS_PSA_CRYPTO_CLIENT'
         m = PSA_WANT_KEY_TYPE_KEY_PAIR_RE.match(name)