diff --git a/src/core/meshcop/secure_transport.cpp b/src/core/meshcop/secure_transport.cpp
index 0116c22eb..043362d82 100644
--- a/src/core/meshcop/secure_transport.cpp
+++ b/src/core/meshcop/secure_transport.cpp
@@ -247,7 +247,7 @@ Error SecureSession::Setup(void)
 #endif
     }
 
-#if defined(MBEDTLS_SSL_EXPORT_KEYS) && (MBEDTLS_VERSION_NUMBER < 0x03000000)
+#if (MBEDTLS_VERSION_NUMBER < 0x03000000)
     mbedtls_ssl_conf_export_keys_cb(&mConf, SecureTransport::HandleMbedtlsExportKeys, &mTransport);
 #endif
 
@@ -301,7 +301,7 @@ Error SecureSession::Setup(void)
         mbedtls_ssl_set_timer_cb(&mSsl, this, HandleMbedtlsSetTimer, HandleMbedtlsGetTimer);
     }
 
-#if defined(MBEDTLS_SSL_EXPORT_KEYS) && (MBEDTLS_VERSION_NUMBER >= 0x03000000)
+#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
     mbedtls_ssl_set_export_keys_cb(&mSsl, SecureTransport::HandleMbedtlsExportKeys, &mTransport);
 #endif
 
@@ -898,9 +898,7 @@ exit:
     return rval;
 }
 
-#ifdef MBEDTLS_SSL_EXPORT_KEYS
-#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
-
+#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
 void SecureTransport::HandleMbedtlsExportKeys(void                       *aContext,
                                               mbedtls_ssl_key_export_type aType,
                                               const unsigned char        *aMasterSecret,
@@ -981,8 +979,7 @@ exit:
     return 0;
 }
 
-#endif // (MBEDTLS_VERSION_NUMBER >= 0x03000000)
-#endif // MBEDTLS_SSL_EXPORT_KEYS
+#endif // OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
 
 void SecureTransport::HandleUpdateTask(Tasklet &aTasklet)
 {
diff --git a/src/core/meshcop/secure_transport.hpp b/src/core/meshcop/secure_transport.hpp
index fa3cb3591..bc868bc78 100644
--- a/src/core/meshcop/secure_transport.hpp
+++ b/src/core/meshcop/secure_transport.hpp
@@ -53,6 +53,18 @@
 #endif
 #include <mbedtls/version.h>
 
+#ifdef OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
+#error \
+    "OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT MUST NOT be defined directly. It is derived from other configs."
+#endif
+
+#if ((defined(MBEDTLS_SSL_EXPORT_KEYS) && (MBEDTLS_VERSION_NUMBER >= 0x03000000)) || \
+     (MBEDTLS_VERSION_NUMBER >= 0x03010000))
+#define OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT 1
+#else
+#define OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT 0
+#endif
+
 #if OPENTHREAD_CONFIG_BLE_TCAT_ENABLE
 #ifndef MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
 #error OPENTHREAD_CONFIG_BLE_TCAT_ENABLE requires MBEDTLS_KEY_EXCHANGE_ECDHE_ECDSA_ENABLED
@@ -755,8 +767,7 @@ private:
     static void HandleMbedtlsDebug(void *aContext, int aLevel, const char *aFile, int aLine, const char *aStr);
     void        HandleMbedtlsDebug(int aLevel, const char *aFile, int aLine, const char *aStr);
 
-#ifdef MBEDTLS_SSL_EXPORT_KEYS
-#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
+#if OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
 
     static void HandleMbedtlsExportKeys(void                       *aContext,
                                         mbedtls_ssl_key_export_type aType,
@@ -787,8 +798,7 @@ private:
                                        size_t               aKeyLength,
                                        size_t               aIvLength);
 
-#endif // (MBEDTLS_VERSION_NUMBER >= 0x03000000)
-#endif // MBEDTLS_SSL_EXPORT_KEYS
+#endif // OPENTHREAD_CONFIG_MBEDTLS_PROVIDES_SSL_KEY_EXPORT
 
     static void HandleUpdateTask(Tasklet &aTasklet);
     void        HandleUpdateTask(void);