diff --git a/config/nrfconnect/chip-gn/args.gni b/config/nrfconnect/chip-gn/args.gni
index 0ac19884ce2e5e..0963be64b3b289 100644
--- a/config/nrfconnect/chip-gn/args.gni
+++ b/config/nrfconnect/chip-gn/args.gni
@@ -14,6 +14,8 @@
 
 import("//build_overrides/chip.gni")
 
+import("${chip_root}/src/crypto/crypto.gni")
+
 chip_device_platform = "nrfconnect"
 
 chip_build_tests = false
@@ -22,6 +24,9 @@ chip_project_config_include = ""
 chip_system_project_config_include = ""
 chip_ble_project_config_include = ""
 
+chip_crypto = "mbedtls"
+chip_external_mbedtls = true
+
 custom_toolchain = "${chip_root}/config/nrfconnect/chip-gn/toolchain:zephyr"
 
 pw_build_PIP_CONSTRAINTS = [ "${chip_root}/scripts/constraints.txt" ]
diff --git a/config/telink/chip-gn/args.gni b/config/telink/chip-gn/args.gni
index 713a3fd231c159..a84cc321a4bb88 100644
--- a/config/telink/chip-gn/args.gni
+++ b/config/telink/chip-gn/args.gni
@@ -14,6 +14,8 @@
 
 import("//build_overrides/chip.gni")
 
+import("${chip_root}/src/crypto/crypto.gni")
+
 chip_device_platform = "telink"
 
 chip_build_tests = false
@@ -22,6 +24,9 @@ chip_project_config_include = ""
 chip_system_project_config_include = ""
 chip_ble_project_config_include = ""
 
+chip_crypto = "mbedtls"
+chip_external_mbedtls = true
+
 custom_toolchain = "${chip_root}/config/telink/chip-gn/toolchain:zephyr"
 
 pw_build_PIP_CONSTRAINTS = [ "${chip_root}/scripts/constraints.txt" ]
diff --git a/config/zephyr/chip-gn/args.gni b/config/zephyr/chip-gn/args.gni
index e5d5aedf5bc17d..1421e79aa80edd 100644
--- a/config/zephyr/chip-gn/args.gni
+++ b/config/zephyr/chip-gn/args.gni
@@ -14,6 +14,8 @@
 
 import("//build_overrides/chip.gni")
 
+import("${chip_root}/src/crypto/crypto.gni")
+
 chip_device_platform = "zephyr"
 
 chip_build_tests = false
@@ -22,6 +24,9 @@ chip_project_config_include = ""
 chip_system_project_config_include = ""
 chip_ble_project_config_include = ""
 
+chip_crypto = "mbedtls"
+chip_external_mbedtls = true
+
 custom_toolchain = "${chip_root}/config/zephyr/chip-gn/toolchain:zephyr"
 
 pw_build_PIP_CONSTRAINTS = [ "${chip_root}/scripts/constraints.txt" ]
diff --git a/src/crypto/BUILD.gn b/src/crypto/BUILD.gn
index ced579399a3b06..5d0e0f4198d012 100644
--- a/src/crypto/BUILD.gn
+++ b/src/crypto/BUILD.gn
@@ -107,9 +107,7 @@ if (chip_crypto == "openssl") {
     sources = [ "CHIPCryptoPALmbedTLS.cpp" ]
     public_deps = [ ":public_headers" ]
 
-    external_mbedtls = current_os == "zephyr"
-
-    if (!external_mbedtls) {
+    if (!chip_external_mbedtls) {
       public_deps += [ "${mbedtls_root}:mbedtls" ]
     }
   }
diff --git a/src/crypto/crypto.gni b/src/crypto/crypto.gni
index 1c99fb9c85d2cd..6ca932212d5ca3 100644
--- a/src/crypto/crypto.gni
+++ b/src/crypto/crypto.gni
@@ -16,4 +16,10 @@ declare_args() {
   # Crypto implementation: mbedtls, openssl, tinycrypt, boringssl, platform.
   chip_crypto = ""
   chip_with_se05x = 0
+
+  # Compile mbedtls externally. Only used if chip_crypto == "mbedtls"
+  chip_external_mbedtls = false
 }
+
+assert(!chip_external_mbedtls || chip_crypto == "mbedtls",
+       "Use of external mbedtls requires the mbedtls crypto impl")