diff --git a/subsys/nrf_security/cmake/extensions.cmake b/subsys/nrf_security/cmake/extensions.cmake
index 3987e797ad8f..29df5dd937b4 100644
--- a/subsys/nrf_security/cmake/extensions.cmake
+++ b/subsys/nrf_security/cmake/extensions.cmake
@@ -56,6 +56,7 @@ macro(kconfig_check_and_set_base_to_val_depends base val)
   if(_argn_all_true)
     nrf_security_debug("Setting ${base} to True because all depends are set")
     set(${base} ${val})
+    set(CONFIG_${base} ${val})
   else()
     nrf_security_debug("Not setting ${base} because ${_argn_false_arg} is not set")
   endif()
diff --git a/subsys/nrf_security/cmake/legacy_crypto_config.cmake b/subsys/nrf_security/cmake/legacy_crypto_config.cmake
index 4f950847fd29..da7d5412ee6a 100644
--- a/subsys/nrf_security/cmake/legacy_crypto_config.cmake
+++ b/subsys/nrf_security/cmake/legacy_crypto_config.cmake
@@ -189,11 +189,6 @@ if (CONFIG_CC3XX_BACKEND)
   endif()
 endif()
 
-# Ensure that MBEDTLS_SHA224_C is set if MBEDTLS_SHA256_C
-# to prevent build errors.
-kconfig_check_and_set_base_depends(MBEDTLS_SHA224_C
-  MBEDTLS_SHA256_C
-)
 
 # Convert defines required even in PSA mode
 kconfig_check_and_set_base_depends(MBEDTLS_SHA1_C
@@ -281,6 +276,11 @@ Kconfig_check_and_set_base_depends(MBEDTLS_ECP_DP_CURVE448_ENABLED
   PSA_WANT_ECC_MONTGOMERY_448
 )
 
+# Ensure that MBEDTLS_SHA224_C is set if MBEDTLS_SHA256_C
+# to prevent build errors.
+kconfig_check_and_set_base_depends(MBEDTLS_SHA224_C
+  MBEDTLS_SHA256_C
+)
 
 if(CONFIG_GENERATE_MBEDTLS_CFG_FILE)
   # Generate the mbed TLS config file (default nrf-config.h)