diff --git a/.gitmodules b/.gitmodules
index 4a844598..2b5f02c1 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -1,3 +1,3 @@
 [submodule "sim/mbedtls"]
-	path = sim/mcuboot-sys/mbedtls
+	path = ext/mbedtls
 	url = https://github.com/ARMmbed/mbedtls
diff --git a/sim/mcuboot-sys/mbedtls b/ext/mbedtls
similarity index 100%
rename from sim/mcuboot-sys/mbedtls
rename to ext/mbedtls
diff --git a/sim/mcuboot-sys/build.rs b/sim/mcuboot-sys/build.rs
index 7c1db9e5..7d82c484 100644
--- a/sim/mcuboot-sys/build.rs
+++ b/sim/mcuboot-sys/build.rs
@@ -56,15 +56,15 @@ fn main() {
         }
         conf.define("MCUBOOT_USE_MBED_TLS", None);
 
-        conf.include("mbedtls/include");
-        conf.file("mbedtls/library/sha256.c");
+        conf.include("../../ext/mbedtls/include");
+        conf.file("../../ext/mbedtls/library/sha256.c");
         conf.file("csupport/keys.c");
 
-        conf.file("mbedtls/library/rsa.c");
-        conf.file("mbedtls/library/bignum.c");
-        conf.file("mbedtls/library/platform.c");
-        conf.file("mbedtls/library/platform_util.c");
-        conf.file("mbedtls/library/asn1parse.c");
+        conf.file("../../ext/mbedtls/library/rsa.c");
+        conf.file("../../ext/mbedtls/library/bignum.c");
+        conf.file("../../ext/mbedtls/library/platform.c");
+        conf.file("../../ext/mbedtls/library/platform_util.c");
+        conf.file("../../ext/mbedtls/library/asn1parse.c");
     } else if sig_ecdsa {
         conf.define("MCUBOOT_SIGN_EC256", None);
         conf.define("MCUBOOT_USE_TINYCRYPT", None);
@@ -88,20 +88,20 @@ fn main() {
         conf.define("MCUBOOT_SIGN_ED25519", None);
         conf.define("MCUBOOT_USE_MBED_TLS", None);
 
-        conf.include("mbedtls/include");
-        conf.file("mbedtls/library/sha256.c");
-        conf.file("mbedtls/library/sha512.c");
+        conf.include("../../ext/mbedtls/include");
+        conf.file("../../ext/mbedtls/library/sha256.c");
+        conf.file("../../ext/mbedtls/library/sha512.c");
         conf.file("csupport/keys.c");
         conf.file("../../ext/fiat/src/curve25519.c");
-        conf.file("mbedtls/library/platform.c");
-        conf.file("mbedtls/library/platform_util.c");
-        conf.file("mbedtls/library/asn1parse.c");
+        conf.file("../../ext/mbedtls/library/platform.c");
+        conf.file("../../ext/mbedtls/library/platform_util.c");
+        conf.file("../../ext/mbedtls/library/asn1parse.c");
     } else {
         // Neither signature type, only verify sha256. The default
         // configuration file bundled with mbedTLS is sufficient.
         conf.define("MCUBOOT_USE_MBED_TLS", None);
-        conf.include("mbedtls/include");
-        conf.file("mbedtls/library/sha256.c");
+        conf.include("../../ext/mbedtls/include");
+        conf.file("../../ext/mbedtls/library/sha256.c");
     }
 
     if overwrite_only {
@@ -117,18 +117,18 @@ fn main() {
         conf.file("../../boot/bootutil/src/encrypted.c");
         conf.file("csupport/keys.c");
 
-        conf.include("mbedtls/include");
-        conf.file("mbedtls/library/sha256.c");
+        conf.include("../../ext/mbedtls/include");
+        conf.file("../../ext/mbedtls/library/sha256.c");
 
-        conf.file("mbedtls/library/platform.c");
-        conf.file("mbedtls/library/platform_util.c");
-        conf.file("mbedtls/library/rsa.c");
-        conf.file("mbedtls/library/rsa_internal.c");
-        conf.file("mbedtls/library/md.c");
-        conf.file("mbedtls/library/md_wrap.c");
-        conf.file("mbedtls/library/aes.c");
-        conf.file("mbedtls/library/bignum.c");
-        conf.file("mbedtls/library/asn1parse.c");
+        conf.file("../../ext/mbedtls/library/platform.c");
+        conf.file("../../ext/mbedtls/library/platform_util.c");
+        conf.file("../../ext/mbedtls/library/rsa.c");
+        conf.file("../../ext/mbedtls/library/rsa_internal.c");
+        conf.file("../../ext/mbedtls/library/md.c");
+        conf.file("../../ext/mbedtls/library/md_wrap.c");
+        conf.file("../../ext/mbedtls/library/aes.c");
+        conf.file("../../ext/mbedtls/library/bignum.c");
+        conf.file("../../ext/mbedtls/library/asn1parse.c");
     }
 
     if enc_kw {
@@ -139,17 +139,17 @@ fn main() {
         conf.file("csupport/keys.c");
 
         if sig_rsa || sig_rsa3072 {
-            conf.file("mbedtls/library/sha256.c");
+            conf.file("../../ext/mbedtls/library/sha256.c");
         }
 
         /* Simulator uses Mbed-TLS to wrap keys */
-        conf.include("mbedtls/include");
-        conf.file("mbedtls/library/platform.c");
-        conf.file("mbedtls/library/platform_util.c");
-        conf.file("mbedtls/library/nist_kw.c");
-        conf.file("mbedtls/library/cipher.c");
-        conf.file("mbedtls/library/cipher_wrap.c");
-        conf.file("mbedtls/library/aes.c");
+        conf.include("../../ext/mbedtls/include");
+        conf.file("../../ext/mbedtls/library/platform.c");
+        conf.file("../../ext/mbedtls/library/platform_util.c");
+        conf.file("../../ext/mbedtls/library/nist_kw.c");
+        conf.file("../../ext/mbedtls/library/cipher.c");
+        conf.file("../../ext/mbedtls/library/cipher_wrap.c");
+        conf.file("../../ext/mbedtls/library/aes.c");
 
         if sig_ecdsa {
             conf.define("MCUBOOT_USE_TINYCRYPT", None);
@@ -210,8 +210,8 @@ fn main() {
     walk_dir("../../ext/tinycrypt/lib/source").unwrap();
     walk_dir("../../ext/mbedtls-asn1").unwrap();
     walk_dir("csupport").unwrap();
-    walk_dir("mbedtls/include").unwrap();
-    walk_dir("mbedtls/library").unwrap();
+    walk_dir("../../ext/mbedtls/include").unwrap();
+    walk_dir("../../ext/mbedtls/library").unwrap();
 }
 
 // Output the names of all files within a directory so that Cargo knows when to rebuild.