diff --git a/src/core/crypto/storage.cpp b/src/core/crypto/storage.cpp
index ec0a373e0..bdcfb9eed 100644
--- a/src/core/crypto/storage.cpp
+++ b/src/core/crypto/storage.cpp
@@ -57,6 +57,8 @@ exit:
     return error;
 }
 
+#if OPENTHREAD_FTD || OPENTHREAD_MTD
+
 void Storage::KeyRefManager::DestroyPersistentKeys(void)
 {
     DestroyKey(KeyRefFor(kNetworkKey));
@@ -68,6 +70,8 @@ void Storage::KeyRefManager::DestroyPersistentKeys(void)
     DestroyKey(KeyRefFor(kEcdsa));
 }
 
+#endif
+
 #endif // OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
 
 LiteralKey::LiteralKey(const Key &aKey)
diff --git a/src/core/crypto/storage.hpp b/src/core/crypto/storage.hpp
index b86bbd7ed..5649c08d2 100644
--- a/src/core/crypto/storage.hpp
+++ b/src/core/crypto/storage.hpp
@@ -97,6 +97,8 @@ typedef otCryptoKeyRef KeyRef;
 
 constexpr KeyRef kInvalidKeyRef = 0x80000000; ///< Invalid `KeyRef` value (PSA_KEY_ID_VENDOR_MAX + 1).
 
+#if OPENTHREAD_FTD || OPENTHREAD_MTD
+
 /**
  * Manages and selects the `KeyRef` values.
  */
@@ -174,6 +176,8 @@ private:
 #endif
 };
 
+#endif // OPENTHREAD_FTD || OPENTHREAD_MTD
+
 /**
  * Determine if a given `KeyRef` is valid or not.
  *
diff --git a/src/core/instance/instance.cpp b/src/core/instance/instance.cpp
index 94b930289..48f341526 100644
--- a/src/core/instance/instance.cpp
+++ b/src/core/instance/instance.cpp
@@ -75,9 +75,6 @@ Instance::Instance(void)
     : mTimerMilliScheduler(*this)
 #if OPENTHREAD_CONFIG_PLATFORM_USEC_TIMER_ENABLE
     , mTimerMicroScheduler(*this)
-#endif
-#if OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
-    , mCryptoStorageKeyRefManager(*this)
 #endif
     , mRadio(*this)
 #if OPENTHREAD_CONFIG_UPTIME_ENABLE
@@ -93,6 +90,9 @@ Instance::Instance(void)
     // DNS-SD (mDNS) platform is initialized early to
     // allow other modules to use it.
     , mDnssd(*this)
+#endif
+#if OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
+    , mCryptoStorageKeyRefManager(*this)
 #endif
     , mIp6(*this)
     , mThreadNetif(*this)
diff --git a/src/core/instance/instance.hpp b/src/core/instance/instance.hpp
index 3cbf72832..ec143cb53 100644
--- a/src/core/instance/instance.hpp
+++ b/src/core/instance/instance.hpp
@@ -465,10 +465,6 @@ private:
 
     Random::Manager mRandomManager;
 
-#if OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
-    Crypto::Storage::KeyRefManager mCryptoStorageKeyRefManager;
-#endif
-
     // Radio is initialized before other member variables
     // (particularly, SubMac and Mac) to allow them to use its methods
     // from their constructor.
@@ -494,6 +490,10 @@ private:
     Dnssd mDnssd;
 #endif
 
+#if OPENTHREAD_CONFIG_PLATFORM_KEY_REFERENCES_ENABLE
+    Crypto::Storage::KeyRefManager mCryptoStorageKeyRefManager;
+#endif
+
     Ip6::Ip6    mIp6;
     ThreadNetif mThreadNetif;
     Tmf::Agent  mTmfAgent;