diff --git a/Makefile b/Makefile
index ca6b4ceb..def6b518 100644
--- a/Makefile
+++ b/Makefile
@@ -15,6 +15,8 @@ CFLAGS += -DMCUBOOT_SIGN_RSA -DMCUBOOT_USE_MBED_TLS
 # ECDSA P-256
 #CONF_FILE = boot/zephyr/prj-p256.conf
 #CFLAGS += -DMCUBOOT_SIGN_EC256 -DMCUBOOT_USE_TINYCRYPT
+#NEED_TINYCRYPT = y
+#export NEED_TINYCRYPT
 
 # Enable this option to have the bootloader verify the signature of
 # the primary image upon every boot.  Without it, signature
diff --git a/boot/zephyr/Makefile b/boot/zephyr/Makefile
index b3f79f39..47892681 100644
--- a/boot/zephyr/Makefile
+++ b/boot/zephyr/Makefile
@@ -8,3 +8,6 @@ obj-y += flash_map.o hal_flash.o os.o
 obj-y += keys.o
 
 obj-y += ../bootutil/src/
+
+obj-$(NEED_TINYCRYPT) += ../../ext/tinycrypt/lib/source/
+include $(PROJECT)/ext/tinycrypt/lib/source/Makefile.inc
diff --git a/boot/zephyr/prj-p256.conf b/boot/zephyr/prj-p256.conf
index d4209cff..66aa66d0 100644
--- a/boot/zephyr/prj-p256.conf
+++ b/boot/zephyr/prj-p256.conf
@@ -7,9 +7,9 @@ CONFIG_MAIN_STACK_SIZE=10240
 CONFIG_MBEDTLS=y
 CONFIG_MBEDTLS_BUILTIN=y
 CONFIG_MBEDTLS_CFG_FILE="config-asn1.h"
-CONFIG_TINYCRYPT=y
-CONFIG_TINYCRYPT_ECC_DSA=y
-CONFIG_TINYCRYPT_SHA256=y
+# CONFIG_TINYCRYPT is not set
+# CONFIG_TINYCRYPT_ECC_DSA is not set
+# CONFIG_TINYCRYPT_SHA256 is not set
 
 ### mbedTLS wants a heap
 CONFIG_HEAP_MEM_POOL_SIZE=16384
diff --git a/ext/tinycrypt/lib/source/Makefile b/ext/tinycrypt/lib/source/Makefile
new file mode 100644
index 00000000..b61b05c7
--- /dev/null
+++ b/ext/tinycrypt/lib/source/Makefile
@@ -0,0 +1,4 @@
+# Zephyr makefile.
+# subdir-ccflags-y += -I$(PROJECT)/ext/tinycrypt/lib/include
+
+obj-y += ecc.o ecc_dsa.o sha256.o utils.o
diff --git a/ext/tinycrypt/lib/source/Makefile.inc b/ext/tinycrypt/lib/source/Makefile.inc
new file mode 100644
index 00000000..ebb101ad
--- /dev/null
+++ b/ext/tinycrypt/lib/source/Makefile.inc
@@ -0,0 +1,3 @@
+# vim: ft=make
+
+subdir-ccflags-$(NEED_TINYCRYPT) += -I$(PROJECT)/ext/tinycrypt/lib/include