diff --git a/plat/arm/common/arm_bl1_setup.c b/plat/arm/common/arm_bl1_setup.c
index 6b66be5..b8e5027 100644
--- a/plat/arm/common/arm_bl1_setup.c
+++ b/plat/arm/common/arm_bl1_setup.c
@@ -162,7 +162,7 @@
 
 	image_desc_t *desc;
 
-	int err = -1;
+	int err __unused = 1;
 
 	/* Initialise the IO layer and register platform IO devices */
 	plat_arm_io_setup();
@@ -175,27 +175,24 @@
 	}
 
 #if TRANSFER_LIST
-	te = transfer_list_add(secure_tl, TL_TAG_TB_FW_CONFIG,
-			       ARM_TB_FW_CONFIG_MAX_SIZE, NULL);
+#if CRYPTO_SUPPORT
+	te = transfer_list_add(secure_tl, TL_TAG_MBEDTLS_HEAP_INFO,
+			       sizeof(struct crypto_heap_info), NULL);
 	assert(te != NULL);
 
+	struct crypto_heap_info *heap_info =
+		(struct crypto_heap_info *)transfer_list_entry_data(te);
+	arm_get_mbedtls_heap(&heap_info->addr, &heap_info->size);
+#endif /* CRYPTO_SUPPORT */
+
+	desc = bl1_plat_get_image_desc(BL2_IMAGE_ID);
+
 	/*
-	 * Set the load address of TB_FW_CONFIG in the data section of the TE just
-	 * allocated in the secure transfer list.
+	 * The event log might have been updated prior to this, make sure we have an
+	 * up to date tl before setting the handoff arguments.
 	 */
-	SET_PARAM_HEAD(&config_image_info, PARAM_IMAGE_BINARY, VERSION_2, 0);
-	config_image_info.image_base = (uintptr_t)transfer_list_entry_data(te);
-	config_image_info.image_max_size = te->data_size;
-
-	VERBOSE("FCONF: Loading config with image ID: %u\n", TB_FW_CONFIG_ID);
-	err = load_auth_image(TB_FW_CONFIG_ID, &config_image_info);
-	if (err != 0) {
-		VERBOSE("Failed to load config %u\n", TB_FW_CONFIG_ID);
-		plat_error_handler(err);
-	}
-
 	transfer_list_update_checksum(secure_tl);
-	fconf_populate("TB_FW", (uintptr_t)transfer_list_entry_data(te));
+	transfer_list_set_handoff_args(secure_tl, &desc->ep_info);
 #else
 	/* Set global DTB info for fixed fw_config information */
 	fw_config_max_size = ARM_FW_CONFIG_LIMIT - ARM_FW_CONFIG_BASE;
@@ -230,22 +227,18 @@
 		ERROR("Invalid FW_CONFIG address\n");
 		plat_error_handler(err);
 	}
-#endif /* TRANSFER_LIST */
 
 	desc = bl1_plat_get_image_desc(BL2_IMAGE_ID);
 
-#if TRANSFER_LIST
-	transfer_list_set_handoff_args(secure_tl, &desc->ep_info);
-#else
 	/* The BL2 ep_info arg0 is modified to point to FW_CONFIG */
 	assert(desc != NULL);
 	desc->ep_info.args.arg0 = config_info->config_addr;
-#endif /* TRANSFER_LIST */
 
 #if CRYPTO_SUPPORT
 	/* Share the Mbed TLS heap info with other images */
 	arm_bl1_set_mbedtls_heap();
 #endif /* CRYPTO_SUPPORT */
+#endif /* TRANSFER_LIST */
 
 	/*
 	 * Allow access to the System counter timer module and program
diff --git a/plat/arm/common/arm_bl2_setup.c b/plat/arm/common/arm_bl2_setup.c
index 63bf957..07b3b62 100644
--- a/plat/arm/common/arm_bl2_setup.c
+++ b/plat/arm/common/arm_bl2_setup.c
@@ -230,11 +230,10 @@
 	arm_bl2_plat_arch_setup();
 
 #if TRANSFER_LIST
-	te = transfer_list_find(secure_tl, TL_TAG_TB_FW_CONFIG);
-	assert(te != NULL);
-
-	fconf_populate("TB_FW", (uintptr_t)transfer_list_entry_data(te));
+#if CRYPTO_SUPPORT
+	te = arm_transfer_list_set_heap_info(secure_tl);
 	transfer_list_rem(secure_tl, te);
+#endif /* CRYPTO_SUPPORT */
 #else
 	/* Fill the properties struct with the info from the config dtb */
 	fconf_populate("FW_CONFIG", config_base);
@@ -244,7 +243,7 @@
 	assert(tb_fw_config_info != NULL);
 
 	fconf_populate("TB_FW", tb_fw_config_info->config_addr);
-#endif
+#endif /* TRANSFER_LIST */
 }
 
 int arm_bl2_handle_post_image_load(unsigned int image_id)
diff --git a/plat/arm/common/arm_dyn_cfg.c b/plat/arm/common/arm_dyn_cfg.c
index 18ab5be..a827f05 100644
--- a/plat/arm/common/arm_dyn_cfg.c
+++ b/plat/arm/common/arm_dyn_cfg.c
@@ -23,7 +23,7 @@
 #include <plat/arm/common/plat_arm.h>
 #include <platform_def.h>
 
-#if CRYPTO_SUPPORT
+#if CRYPTO_SUPPORT && !TRANSFER_LIST
 
 static void *mbedtls_heap_addr;
 static size_t mbedtls_heap_size;
@@ -118,7 +118,7 @@
 #endif /* !MEASURED_BOOT */
 	}
 }
-#endif /* CRYPTO_SUPPORT */
+#endif /* CRYPTO_SUPPORT && !TRANSFER_LIST */
 
 #if IMAGE_BL2
 /*
diff --git a/plat/arm/common/arm_transfer_list.c b/plat/arm/common/arm_transfer_list.c
index 3f8460d..6847591 100644
--- a/plat/arm/common/arm_transfer_list.c
+++ b/plat/arm/common/arm_transfer_list.c
@@ -4,9 +4,48 @@
  * SPDX-License-Identifier: BSD-3-Clause
  */
 
+#if CRYPTO_SUPPORT
+#include <mbedtls/version.h>
+#endif /* CRYPTO_SUPPORT */
+
 #include <plat/arm/common/plat_arm.h>
 #include <platform_def.h>
 
+#if CRYPTO_SUPPORT
+#if defined(IMAGE_BL1) || RESET_TO_BL2 || defined(IMAGE_BL31)
+static unsigned char heap[TF_MBEDTLS_HEAP_SIZE];
+
+#define MBEDTLS_HEAP_ADDR heap
+#define MBEDTLS_HEAP_SIZE sizeof(heap)
+#else
+static struct crypto_heap_info heap_info;
+
+#define MBEDTLS_HEAP_ADDR heap_info.addr
+#define MBEDTLS_HEAP_SIZE heap_info.size
+
+struct transfer_list_entry *
+arm_transfer_list_set_heap_info(struct transfer_list_header *tl)
+{
+	struct transfer_list_entry *te =
+		transfer_list_find(tl, TL_TAG_MBEDTLS_HEAP_INFO);
+	assert(te != NULL);
+
+	heap_info = *(struct crypto_heap_info *)transfer_list_entry_data(te);
+	return te;
+}
+#endif /* defined(IMAGE_BL1) || RESET_TO_BL2 || defined(IMAGE_BL31) */
+
+int __init arm_get_mbedtls_heap(void **heap_addr, size_t *heap_size)
+{
+	assert(heap_addr != NULL);
+	assert(heap_size != NULL);
+	*heap_addr = MBEDTLS_HEAP_ADDR;
+	*heap_size = MBEDTLS_HEAP_SIZE;
+
+	return 0;
+}
+#endif /* CRYPTO_SUPPORT */
+
 void arm_transfer_list_dyn_cfg_init(struct transfer_list_header *tl)
 {
 	struct transfer_list_entry *te;