diff --git a/tests/scripts/components-basic-checks.sh b/tests/scripts/components-basic-checks.sh
index 272efe2ae5..a1d1b5756b 100644
--- a/tests/scripts/components-basic-checks.sh
+++ b/tests/scripts/components-basic-checks.sh
@@ -100,6 +100,66 @@ component_check_test_cases () {
     unset opt
 }
 
+component_check_test_dependencies () {
+    msg "Check: test cases dependencies: no crypto internals"
+    # The purpose of this component is to catch unjustified dependencies from
+    # mbedtls test on crypto internal feature macros.
+    #
+    # Most of the time, use of crypto internal feature macros are mistakes,
+    # which this component is maeant to catch. However a few of them are
+    # justified, or known issues yet to be resolved, so this component includes
+    # a list of expected exceptions.
+
+    crypto="check-test-deps-crypto-$$"
+    used="check-test-deps-used-$$"
+    found="check-test-deps-found-$$"
+    expected="check-test-deps-expected-$$"
+
+    (
+        cd tf-psa-crypto
+        PYTHONPATH=framework/scripts python \
+            -c 'from mbedtls_framework import config_macros; \
+                print("\n".join(config_macros.Current().internal()))'
+    ) | sort -u > $crypto
+
+    (
+        grep depends_on tests/suites/test_suite_* |
+            sed -e 's/.*depends_on:\([^ ]*\).*/\1/' -e's/!//g' |
+            tr ':' '\n'
+        egrep -oh '(PSA|MBEDTLS)_[A-Z0-9_]*' tests/ssl-opt.sh tests/opt-testcases/*.sh
+    ) | sort -u > $used
+
+    # Find macros that are both used in mbedtls tests and crypto-internal.
+    comm -12 $crypto $used > $found
+
+    # Expected ones with justification - keep in sorted order!
+    rm -f $expected
+    # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10618
+    echo "MBEDTLS_PKCS1_V15" >> $expected
+    echo "MBEDTLS_PKCS1_V21" >> $expected
+    # Temporary, see https://github.com/Mbed-TLS/mbedtls/issues/10619
+    echo "MBEDTLS_RSA_C" >> $expected
+    # Acceptable: these are light wrappers around official PSA_WANT macros,
+    # to hide the fact that ECDSA could be randomized or deterministic.
+    echo "PSA_HAVE_ALG_ECDSA_SIGN" >> $expected
+    echo "PSA_HAVE_ALG_ECDSA_VERIFY" >> $expected
+    echo "PSA_HAVE_ALG_SOME_ECDSA" >> $expected
+    echo "PSA_WANT_ALG_ECDSA_ANY" >> $expected
+
+    # Compare reality with expectation.
+    # We want an exact match, to ensure the above list remains up-to-date.
+    #
+    # The output should be empty. When it's not:
+    # - Each '+' line is a macro that was found but not expected. You want to
+    # find where that macro occurs, and either replace it with PSA macros, or
+    # add it to the exceptions list above with a justification.
+    # - Each '-' line is a macro that was expected but not found; it means the
+    # exceptions list above should be updated by removing that macro.
+    diff -U0 $expected $found
+
+    rm $found $expected $crypto $used
+}
+
 component_check_doxygen_warnings () {
     msg "Check: doxygen warnings (builds the documentation)" # ~ 3s
     ./framework/scripts/doxygen.sh