diff --git a/ChangeLog.d/fix-dtls-connection-id-compat-build.txt b/ChangeLog.d/fix-dtls-connection-id-compat-build.txt
new file mode 100644
index 0000000000..2f4becd393
--- /dev/null
+++ b/ChangeLog.d/fix-dtls-connection-id-compat-build.txt
@@ -0,0 +1,3 @@
+Bugfix
+   * Fix a compilation warning in ssl.h when MBEDTLS_SSL_DTLS_CONNECTION_ID
+     and MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT are not defined. Fixes #10207.
diff --git a/include/mbedtls/ssl.h b/include/mbedtls/ssl.h
index f9b103e382..86ab0cf142 100644
--- a/include/mbedtls/ssl.h
+++ b/include/mbedtls/ssl.h
@@ -656,11 +656,17 @@
 #define MBEDTLS_TLS_EXT_SIG_ALG_CERT                50 /* RFC 8446 TLS 1.3 */
 #define MBEDTLS_TLS_EXT_KEY_SHARE                   51 /* RFC 8446 TLS 1.3 */
 
+/*
+ * MBEDTLS_TLS_EXT_CID is required only when
+ * MBEDTLS_SSL_DTLS_CONNECTION_ID is defined.
+ */
+#if defined(MBEDTLS_SSL_DTLS_CONNECTION_ID)
 #if MBEDTLS_SSL_DTLS_CONNECTION_ID_COMPAT == 0
 #define MBEDTLS_TLS_EXT_CID                         54 /* RFC 9146 DTLS 1.2 CID */
 #else
 #define MBEDTLS_TLS_EXT_CID                        254 /* Pre-RFC 9146 DTLS 1.2 CID */
 #endif
+#endif
 
 #define MBEDTLS_TLS_EXT_ECJPAKE_KKPP               256 /* experimental */