diff --git a/tests/scripts/components-platform.sh b/tests/scripts/components-platform.sh
index 0d3f1bf2c4..835df0656c 100644
--- a/tests/scripts/components-platform.sh
+++ b/tests/scripts/components-platform.sh
@@ -316,6 +316,40 @@ component_build_sha_armce () {
     not grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s
 }
 
+support_build_sha_armce_gcc () {
+    # GCC >= 6 is required to build with SHA extensions
+    [ "$(gcc_version "${AARCH64_LINUX_GNU_GCC_PREFIX}gcc")" -ge 6 ]
+}
+
+component_build_sha_armce_gcc () {
+    # The SHA-256 crypto extensions must be added to the target of the build,
+    # not replace it: with -mcpu=cortex-a53 (which has CRC) GCC otherwise
+    # refuses to inline always_inline functions such as a fortified memset().
+    scripts/config.py unset MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT
+    for opt in MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_ONLY MBEDTLS_SHA256_USE_ARMV8_A_CRYPTO_IF_PRESENT; do
+        scripts/config.py set $opt
+            msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, -mcpu=cortex-a53 -D_FORTIFY_SOURCE=2"
+            $MAKE_COMMAND -B library/../${BUILTIN_SRC_PATH}/sha256.o library/../${BUILTIN_SRC_PATH}/sha256.s CC="${AARCH64_LINUX_GNU_GCC_PREFIX}gcc" CFLAGS="-std=c99 -Werror -O2 -mcpu=cortex-a53 -D_FORTIFY_SOURCE=2"
+            msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, test aarch64 crypto instructions built"
+            grep -E 'sha256[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha256.s
+        scripts/config.py unset $opt
+    done
+
+    # The same for the SHA-512 extensions with -mcpu=cortex-a76, which has
+    # extensions beyond Armv8.2-A. Before GCC 13, the SHA-512 intrinsics
+    # require Armv8.2-A, so this only builds with GCC 13 or later.
+    if [ "$(gcc_version "${AARCH64_LINUX_GNU_GCC_PREFIX}gcc")" -ge 13 ]; then
+        for opt in MBEDTLS_SHA512_USE_A64_CRYPTO_ONLY MBEDTLS_SHA512_USE_A64_CRYPTO_IF_PRESENT; do
+            scripts/config.py set $opt
+                msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, -mcpu=cortex-a76 -D_FORTIFY_SOURCE=2"
+                $MAKE_COMMAND -B library/../${BUILTIN_SRC_PATH}/sha512.o library/../${BUILTIN_SRC_PATH}/sha512.s CC="${AARCH64_LINUX_GNU_GCC_PREFIX}gcc" CFLAGS="-std=c99 -Werror -O2 -mcpu=cortex-a76 -D_FORTIFY_SOURCE=2"
+                msg "$opt ${AARCH64_LINUX_GNU_GCC_PREFIX}gcc, test aarch64 crypto instructions built"
+                grep -E 'sha512[a-z0-9]+\s+[qv]' ${BUILTIN_SRC_PATH}/sha512.s
+            scripts/config.py unset $opt
+        done
+    fi
+}
+
 component_test_arm_linux_gnueabi_gcc_arm5vte () {
     # Mimic Debian armel port
     msg "test: ${ARM_LINUX_GNUEABI_GCC_PREFIX}gcc -march=arm5vte, default config" # ~4m
diff --git a/tf-psa-crypto b/tf-psa-crypto
index 607ef78f93..a7d5707ee3 160000
--- a/tf-psa-crypto
+++ b/tf-psa-crypto
@@ -1 +1 @@
-Subproject commit 607ef78f93568d15d8f9b56d09401b4b9e177f93
+Subproject commit a7d5707ee38fb469ca5706b11abb15094cbc3b0b