diff --git a/.github/workflows/symbol-prefixes.yml b/.github/workflows/symbol-prefixes.yml
index 8c8ab7821..84a0e75e9 100644
--- a/.github/workflows/symbol-prefixes.yml
+++ b/.github/workflows/symbol-prefixes.yml
@@ -17,7 +17,7 @@ jobs:
     strategy:
       matrix:
         config: [
-          '--enable-all CFLAGS=-DWOLFSSL_API_PREFIX_MAP'
+          '--enable-all --enable-mlkem --enable-mldsa --enable-xmss --enable-lms --enable-acert --with-sys-crypto-policy CFLAGS=-DWOLFSSL_API_PREFIX_MAP'
         ]
     name: make and analyze
     if: github.repository_owner == 'wolfssl'
diff --git a/wolfssl/ssl.h b/wolfssl/ssl.h
index 8c0c0d1d8..d503aeac7 100644
--- a/wolfssl/ssl.h
+++ b/wolfssl/ssl.h
@@ -45,6 +45,14 @@
 #include "wolfssl/wolfcrypt/asn.h"
 #endif
 
+#if defined(NO_TLS) && !defined(WOLFSSL_NO_TLS12)
+    /* in NO_TLS builds, WOLFSSL_NO_TLS12 must be defined in the TLS layer, but
+     * must not be defined in the crypto layer, to allow building the TLS12
+     * KDFs.
+     */
+    #define WOLFSSL_NO_TLS12
+#endif
+
 /* For the types */
 #if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
 #include <wolfssl/openssl/compat_types.h>