diff --git a/CMakeLists.txt b/CMakeLists.txt
index fff0c55597..36e1e6dd13 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -229,12 +229,14 @@ if(NOT "${MBEDTLS_CONFIG_BASE_FILE}" STREQUAL "" OR
         endif()
     endforeach(option)
 
-    set(MBEDTLS_CONFIG_FILE "${MBEDTLS_GENERATED_CONFIG_FILE}")
+    set(MBEDTLS_CONFIG_FILE
+        "$<BUILD_INTERFACE:${MBEDTLS_GENERATED_CONFIG_FILE}>$<INSTALL_INTERFACE:mbedtls/mbedtls_config.h>")
     if("${TF_PSA_CRYPTO_CONFIG_FILE}" STREQUAL "" AND
        "${TF_PSA_CRYPTO_CONFIG_NAME}" STREQUAL "")
         # Named configurations can adjust both configuration files.
-        set(TF_PSA_CRYPTO_CONFIG_FILE "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}"
-            CACHE FILEPATH "TF-PSA-Crypto config file (overrides default)." FORCE)
+        set(TF_PSA_CRYPTO_CONFIG_FILE
+            "$<BUILD_INTERFACE:${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}>$<INSTALL_INTERFACE:psa/crypto_config_mbedtls.h>"
+            CACHE STRING "TF-PSA-Crypto config file (overrides default)." FORCE)
     endif()
 endif()
 
@@ -454,6 +456,15 @@ set(USE_STATIC_TF_PSA_CRYPTO_LIBRARY ${USE_STATIC_MBEDTLS_LIBRARY} CACHE BOOL ""
 set(USE_SHARED_TF_PSA_CRYPTO_LIBRARY ${USE_SHARED_MBEDTLS_LIBRARY} CACHE BOOL "")
 add_subdirectory(tf-psa-crypto)
 
+# Keep the generated configuration distinct from TF-PSA-Crypto's default
+# configuration header, which is installed by the subproject.
+if(NOT "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}" STREQUAL "" AND
+   INSTALL_TF_PSA_CRYPTO_HEADERS)
+    install(FILES "${MBEDTLS_GENERATED_CRYPTO_CONFIG_FILE}"
+        DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/psa
+        RENAME crypto_config_mbedtls.h)
+endif()
+
 set(tfpsacrypto_target "${TF_PSA_CRYPTO_TARGET_PREFIX}tfpsacrypto")
 if (USE_STATIC_MBEDTLS_LIBRARY)
     set(tfpsacrypto_static_target ${tfpsacrypto_target})
diff --git a/include/CMakeLists.txt b/include/CMakeLists.txt
index f76977fbab..6a53a184b2 100644
--- a/include/CMakeLists.txt
+++ b/include/CMakeLists.txt
@@ -4,10 +4,21 @@ if(INSTALL_MBEDTLS_HEADERS)
 
     file(GLOB headers "mbedtls/*.h")
 
+    if(NOT "${MBEDTLS_GENERATED_CONFIG_FILE}" STREQUAL "")
+        list(REMOVE_ITEM headers
+            "${CMAKE_CURRENT_SOURCE_DIR}/mbedtls/mbedtls_config.h")
+    endif()
+
     install(FILES ${headers}
         DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls
         PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
 
+    if(NOT "${MBEDTLS_GENERATED_CONFIG_FILE}" STREQUAL "")
+        install(FILES "${MBEDTLS_GENERATED_CONFIG_FILE}"
+            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/mbedtls
+            PERMISSIONS OWNER_READ OWNER_WRITE GROUP_READ WORLD_READ)
+    endif()
+
     file(GLOB private_headers "mbedtls/private/*.h")
 
     install(FILES ${private_headers}
diff --git a/programs/test/cmake_package_install/cmake_package_config.c b/programs/test/cmake_package_install/cmake_package_config.c
new file mode 100644
index 0000000000..a5cb9016a3
--- /dev/null
+++ b/programs/test/cmake_package_install/cmake_package_config.c
@@ -0,0 +1,13 @@
+/*
+ *  Simple program to test an installed Mbed TLS configuration.
+ *
+ *  Copyright The Mbed TLS Contributors
+ *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
+ */
+
+#include "mbedtls/build_info.h"
+
+int main(void)
+{
+    return 0;
+}
diff --git a/tests/scripts/components-build-system.sh b/tests/scripts/components-build-system.sh
index 105be8d8ae..f0bca734bc 100644
--- a/tests/scripts/components-build-system.sh
+++ b/tests/scripts/components-build-system.sh
@@ -357,6 +357,32 @@ component_build_cmake_config_options () {
     cmp base_config.before \
         "$MBEDTLS_ROOT_DIR/configs/config-ccm-psk-tls1_2.h"
 
+    msg "install: generated configurations are relocatable"
+    install_dir="$OUT_OF_SOURCE_DIR/install"
+    cmake -DCMAKE_INSTALL_PREFIX="$install_dir" .
+    cmake --build . --target install
+    cmp generated/include/mbedtls/mbedtls_config.h \
+        "$install_dir/include/mbedtls/mbedtls_config.h"
+    cmp generated/include/psa/crypto_config.h \
+        "$install_dir/include/psa/crypto_config_mbedtls.h"
+
+    # The installed targets must not refer to configuration headers in the
+    # build tree.
+    mv generated generated.moved
+    mkdir consumer
+    cat >consumer/CMakeLists.txt <<EOF
+cmake_minimum_required(VERSION 3.10)
+project(consumer C)
+find_package(MbedTLS REQUIRED CONFIG)
+add_executable(consumer
+    "$MBEDTLS_ROOT_DIR/programs/test/cmake_package_install/cmake_package_config.c")
+target_link_libraries(consumer PRIVATE
+    MbedTLS::mbedtls MbedTLS::mbedx509 MbedTLS::tfpsacrypto)
+EOF
+    cmake -S consumer -B consumer-build \
+          -DCMAKE_PREFIX_PATH="$install_dir"
+    cmake --build consumer-build
+
     cd "$MBEDTLS_ROOT_DIR"
     rm -rf "$OUT_OF_SOURCE_DIR"