diff --git a/lib/extensions/pauth/pauth.c b/lib/extensions/pauth/pauth.c
new file mode 100644
index 0000000..c6c6e10
--- /dev/null
+++ b/lib/extensions/pauth/pauth.c
@@ -0,0 +1,79 @@
+/*
+ * Copyright (c) 2025, Arm Limited and Contributors. All rights reserved.
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+#include <arch.h>
+#include <arch_features.h>
+#include <arch_helpers.h>
+#include <lib/extensions/pauth.h>
+
+void __no_pauth pauth_init_enable_el3(void)
+{
+	if (is_feat_pauth_supported()) {
+		pauth_init();
+		pauth_enable_el3();
+	}
+}
+
+void __no_pauth pauth_init_enable_el1(void)
+{
+	if (is_feat_pauth_supported()) {
+		pauth_init();
+		pauth_enable_el1();
+	}
+}
+
+void pauth_init(void)
+{
+	uint128_t keys = plat_init_apkey();
+	uint64_t key_lo = LO_64(keys);
+	uint64_t key_hi = HI_64(keys);
+
+	/* Program instruction key A used by the Trusted Firmware */
+	write_apiakeylo_el1(key_lo);
+	write_apiakeyhi_el1(key_hi);
+}
+
+/*
+ * Begin checking function calls at the current EL. This function must not have
+ * PAuth guards because the signing will be a NOP and attempting to authenticate
+ * will fail. Includes an ISB to avoid accidental failures.
+ */
+void __no_pauth pauth_enable_el3(void)
+{
+	write_sctlr_el3(read_sctlr_el3() | SCTLR_EnIA_BIT);
+	isb();
+}
+
+void __no_pauth pauth_enable_el1(void)
+{
+	write_sctlr_el1(read_sctlr_el1() | SCTLR_EnIA_BIT);
+	isb();
+}
+
+/* Enable PAuth for EL2 */
+void pauth_enable_el2(void)
+{
+	u_register_t hcr_el2 = read_hcr_el2();
+	/*
+	 * For Armv8.3 pointer authentication feature, disable traps to EL2 when
+	 * accessing key registers or using pointer authentication instructions
+	 * from lower ELs.
+	 */
+	hcr_el2 |= (HCR_API_BIT | HCR_APK_BIT);
+
+	write_hcr_el2(hcr_el2);
+}
+
+void __no_pauth pauth_disable_el1(void)
+{
+	write_sctlr_el1(read_sctlr_el1() & ~SCTLR_EnIA_BIT);
+	isb(); /* usually called by caller, here it's for compatibility */
+}
+
+void __no_pauth pauth_disable_el3(void)
+{
+	write_sctlr_el3(read_sctlr_el3() & ~SCTLR_EnIA_BIT);
+	isb(); /* usually called by caller, here it's for compatibility */
+}
diff --git a/lib/extensions/pauth/pauth_helpers.S b/lib/extensions/pauth/pauth_helpers.S
index 1f0e2e0..f9777bb 100644
--- a/lib/extensions/pauth/pauth_helpers.S
+++ b/lib/extensions/pauth/pauth_helpers.S
@@ -8,86 +8,10 @@
 #include <asm_macros.S>
 #include <lib/el3_runtime/cpu_data.h>
 
-	.global	pauth_init_enable_el1
-	.global	pauth_disable_el1
-	.global	pauth_init_enable_el3
-	.global	pauth_disable_el3
 	.globl	pauth_load_bl31_apiakey
 	.globl	pauth_load_bl1_apiakey_enable
 
 /* -------------------------------------------------------------
- * Program APIAKey_EL1 and enable pointer authentication in EL1
- * -------------------------------------------------------------
- */
-func pauth_init_enable_el1
-	stp	x29, x30, [sp, #-16]!
-
-	/* Initialize platform key */
-	bl	plat_init_apkey
-
-	/* Program instruction key A used by the Trusted Firmware */
-	msr	APIAKeyLo_EL1, x0
-	msr	APIAKeyHi_EL1, x1
-
-	/* Enable pointer authentication */
-	mrs	x0, sctlr_el1
-	orr	x0, x0, #SCTLR_EnIA_BIT
-	msr	sctlr_el1, x0
-	isb
-
-	ldp	x29, x30, [sp], #16
-	ret
-endfunc pauth_init_enable_el1
-
-/* -------------------------------------------------------------
- * Disable pointer authentication in EL1
- * -------------------------------------------------------------
- */
-func pauth_disable_el1
-	mrs	x0, sctlr_el1
-	bic	x0, x0, #SCTLR_EnIA_BIT
-	msr	sctlr_el1, x0
-	isb
-	ret
-endfunc pauth_disable_el1
-
-/* -------------------------------------------------------------
- * Program APIAKey_EL1 and enable pointer authentication in EL3
- * -------------------------------------------------------------
- */
-func pauth_init_enable_el3
-	stp	x29, x30, [sp, #-16]!
-
-	/* Initialize platform key */
-	bl	plat_init_apkey
-
-	/* Program instruction key A used by the Trusted Firmware */
-	msr	APIAKeyLo_EL1, x0
-	msr	APIAKeyHi_EL1, x1
-
-	/* Enable pointer authentication */
-	mrs	x0, sctlr_el3
-	orr	x0, x0, #SCTLR_EnIA_BIT
-	msr	sctlr_el3, x0
-	isb
-
-	ldp	x29, x30, [sp], #16
-	ret
-endfunc pauth_init_enable_el3
-
-/* -------------------------------------------------------------
- * Disable pointer authentication in EL3
- * -------------------------------------------------------------
- */
-func pauth_disable_el3
-	mrs	x0, sctlr_el3
-	bic	x0, x0, #SCTLR_EnIA_BIT
-	msr	sctlr_el3, x0
-	isb
-	ret
-endfunc pauth_disable_el3
-
-/* -------------------------------------------------------------
  * The following functions strictly follow the AArch64 PCS
  * to use x9-x17 (temporary caller-saved registers) to load
  * the APIAKey_EL1 and enable pointer authentication.