diff --git a/ChangeLog.d/extend-query_compile_time_config-to-psa_want.txt b/ChangeLog.d/extend-query_compile_time_config-to-psa_want.txt
new file mode 100644
index 0000000..b268fd4
--- /dev/null
+++ b/ChangeLog.d/extend-query_compile_time_config-to-psa_want.txt
@@ -0,0 +1,2 @@
+Changes
+   * Add the ability to query PSA_WANT_xxx macros to query_compile_time_config
diff --git a/scripts/data_files/query_config.fmt b/scripts/data_files/query_config.fmt
index fa124f0..59eb168 100644
--- a/scripts/data_files/query_config.fmt
+++ b/scripts/data_files/query_config.fmt
@@ -30,8 +30,12 @@
 
 /*
  * Include all the headers with public APIs in case they define a macro to its
- * default value when that configuration is not set in the mbedtls_config.h.
+ * default value when that configuration is not set in mbedtls_config.h, or
+ * for PSA_WANT macros, in case they're auto-defined based on mbedtls_config.h
+ * rather than defined directly in crypto_config.h.
  */
+#include "psa/crypto.h"
+
 #include "mbedtls/aes.h"
 #include "mbedtls/aria.h"
 #include "mbedtls/asn1.h"
diff --git a/scripts/generate_query_config.pl b/scripts/generate_query_config.pl
index b2ce8fc..ddbebfa 100755
--- a/scripts/generate_query_config.pl
+++ b/scripts/generate_query_config.pl
@@ -15,7 +15,7 @@
 # function by using the template in scripts/data_files/query_config.fmt.
 #
 # Usage: scripts/generate_query_config.pl without arguments, or
-# generate_query_config.pl config_file template_file output_file
+# generate_query_config.pl mbedtls_config_file template_file output_file [psa_crypto_config_file]
 #
 # Copyright The Mbed TLS Contributors
 # SPDX-License-Identifier: Apache-2.0
@@ -34,22 +34,33 @@
 
 use strict;
 
-my ($config_file, $query_config_format_file, $query_config_file);
+my ($mbedtls_config_file, $query_config_format_file, $query_config_file, $psa_crypto_config_file);
+
+my $default_mbedtls_config_file = "./include/mbedtls/mbedtls_config.h";
+my $default_query_config_format_file = "./scripts/data_files/query_config.fmt";
+my $default_query_config_file = "./programs/test/query_config.c";
+my $default_psa_crypto_config_file = "./include/psa/crypto_config.h";
 
 if( @ARGV ) {
     die "Invalid number of arguments - usage: $0 [CONFIG_FILE TEMPLATE_FILE OUTPUT_FILE]" if scalar @ARGV != 3;
-    ($config_file, $query_config_format_file, $query_config_file) = @ARGV;
+    ($mbedtls_config_file, $query_config_format_file, $query_config_file) = @ARGV;
 
-    -f $config_file or die "No such file: $config_file";
+    -f $mbedtls_config_file or die "No such file: $mbedtls_config_file";
     -f $query_config_format_file or die "No such file: $query_config_format_file";
+    if (defined($psa_crypto_config_file) && length($psa_crypto_config_file)) {
+        -f $psa_crypto_config_file or die "No such file: $psa_crypto_config_file";
+    } else {
+        $psa_crypto_config_file = (-f $default_psa_crypto_config_file) ? $default_psa_crypto_config_file : undef;
+    }
 } else {
-    $config_file = "./include/mbedtls/mbedtls_config.h";
-    $query_config_format_file = "./scripts/data_files/query_config.fmt";
-    $query_config_file = "./programs/test/query_config.c";
+    $mbedtls_config_file = $default_mbedtls_config_file;
+    $query_config_format_file = $default_query_config_format_file;
+    $query_config_file = $default_query_config_file;
+    $psa_crypto_config_file = $default_psa_crypto_config_file;
 
-    unless( -f $config_file && -f $query_config_format_file ) {
+    unless(-f $mbedtls_config_file && -f $query_config_format_file  && -f $psa_crypto_config_file) {
         chdir '..' or die;
-        -f $config_file && -f $query_config_format_file
+        -f $mbedtls_config_file && -f $query_config_format_file && -f $psa_crypto_config_file
           or die "No arguments supplied, must be run from project root or a first-level subdirectory\n";
     }
 }
@@ -63,39 +74,50 @@
 );
 my $excluded_re = join '|', @excluded;
 
-open(CONFIG_FILE, "$config_file") or die "Opening config file '$config_file': $!";
-
 # This variable will contain the string to replace in the CHECK_CONFIG of the
 # format file
 my $config_check = "";
 my $list_config = "";
 
-while (my $line = <CONFIG_FILE>) {
-    if ($line =~ /^(\/\/)?\s*#\s*define\s+(MBEDTLS_\w+).*/) {
-        my $name = $2;
+for my $config_file ($mbedtls_config_file, $psa_crypto_config_file) {
 
-        # Skip over the macro if it is in the ecluded list
-        next if $name =~ /$excluded_re/;
+    next unless defined($config_file);  # we might not have been given a PSA crypto config file
 
-        $config_check .= "#if defined($name)\n";
-        $config_check .= "    if( strcmp( \"$name\", config ) == 0 )\n";
-        $config_check .= "    {\n";
-        $config_check .= "        MACRO_EXPANSION_TO_STR( $name );\n";
-        $config_check .= "        return( 0 );\n";
-        $config_check .= "    }\n";
-        $config_check .= "#endif /* $name */\n";
-        $config_check .= "\n";
+    open(CONFIG_FILE, "<", $config_file) or die "Opening config file '$config_file': $!";
 
-        $list_config .= "#if defined($name)\n";
-        $list_config .= "    OUTPUT_MACRO_NAME_VALUE($name);\n";
-        $list_config .= "#endif /* $name */\n";
-        $list_config .= "\n";
+    while (my $line = <CONFIG_FILE>) {
+        if ($line =~ /^(\/\/)?\s*#\s*define\s+(MBEDTLS_\w+|PSA_WANT_\w+).*/) {
+            my $name = $2;
+
+            # Skip over the macro if it is in the excluded list
+            next if $name =~ /$excluded_re/;
+
+            $config_check .= <<EOT;
+#if defined($name)
+    if( strcmp( "$name", config ) == 0 )
+    {
+        MACRO_EXPANSION_TO_STR( $name );
+        return( 0 );
     }
+#endif /* $name */
+
+EOT
+
+            $list_config .= <<EOT;
+#if defined($name)
+    OUTPUT_MACRO_NAME_VALUE($name);
+#endif /* $name */
+
+EOT
+        }
+    }
+
+    close(CONFIG_FILE);
 }
 
 # Read the full format file into a string
 local $/;
-open(FORMAT_FILE, "$query_config_format_file") or die "Opening query config format file '$query_config_format_file': $!";
+open(FORMAT_FILE, "<", $query_config_format_file) or die "Opening query config format file '$query_config_format_file': $!";
 my $query_config_format = <FORMAT_FILE>;
 close(FORMAT_FILE);
 
@@ -104,6 +126,6 @@
 $query_config_format =~ s/LIST_CONFIG/$list_config/g;
 
 # Rewrite the query_config.c file
-open(QUERY_CONFIG_FILE, ">$query_config_file") or die "Opening destination file '$query_config_file': $!";
+open(QUERY_CONFIG_FILE, ">", $query_config_file) or die "Opening destination file '$query_config_file': $!";
 print QUERY_CONFIG_FILE $query_config_format;
 close(QUERY_CONFIG_FILE);