diff --git a/ChangeLog.d/pk_internal_wundef.txt b/ChangeLog.d/pk_internal_wundef.txt
new file mode 100644
index 0000000000..c3251dcab0
--- /dev/null
+++ b/ChangeLog.d/pk_internal_wundef.txt
@@ -0,0 +1,4 @@
+Bugfix
+   * library/pk_internal.h: Fix 'MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH' and
+     'MBEDTLS_PSA_MAX_EC_KEY_PAIR_LENGTH' are not defined errors when
+     building in a configuration that does not enable PSA.
diff --git a/library/pk_internal.h b/library/pk_internal.h
index a57b5545bf..b77695b11e 100644
--- a/library/pk_internal.h
+++ b/library/pk_internal.h
@@ -61,13 +61,17 @@
 #endif
 
 #if defined(PK_EXPORT_KEYS_ON_THE_STACK)
-/* We know for ECC, pubkey are longer than privkeys, but double check.
- * Also, take the maximum size of legacy and PSA, as PSA might be disabled. */
+/* Take the maximum size of legacy ECP and PSA EC sizes.
+ * PSA might be disabled, so guard the PSA-specific macros. */
+#if defined(MBEDTLS_PSA_CRYPTO_CLIENT)
 #define PK_EXPORT_KEY_STACK_BUFFER_SIZE  MBEDTLS_PSA_MAX_EC_PUBKEY_LENGTH
 #if PK_EXPORT_KEY_STACK_BUFFER_SIZE < MBEDTLS_PSA_MAX_EC_KEY_PAIR_LENGTH
 #undef PK_EXPORT_KEY_STACK_BUFFER_SIZE
 #define PK_EXPORT_KEY_STACK_BUFFER_SIZE  MBEDTLS_PSA_MAX_EC_KEY_PAIR_LENGTH
 #endif
+#else
+#define PK_EXPORT_KEY_STACK_BUFFER_SIZE  0
+#endif /* MBEDTLS_PSA_CRYPTO_CLIENT */
 #if PK_EXPORT_KEY_STACK_BUFFER_SIZE < MBEDTLS_ECP_MAX_BYTES
 #undef PK_EXPORT_KEY_STACK_BUFFER_SIZE
 #define PK_EXPORT_KEY_STACK_BUFFER_SIZE  MBEDTLS_ECP_MAX_BYTES