diff --git a/include/psa/crypto_extra.h b/include/psa/crypto_extra.h
index ea3cfd8..ba43c72 100644
--- a/include/psa/crypto_extra.h
+++ b/include/psa/crypto_extra.h
@@ -434,9 +434,6 @@
 #define PSA_PAKE_OPERATION_STAGE_COLLECT_INPUTS 1
 #define PSA_PAKE_OPERATION_STAGE_COMPUTATION 2
 
-/** JPAKE user/peer ids. */
-#define PSA_JPAKE_SERVER_ID "server"
-#define PSA_JPAKE_CLIENT_ID "client"
 /**
  * \brief Set domain parameters for a key.
  *
diff --git a/library/psa_crypto.c b/library/psa_crypto.c
index d21a823..dea2a36 100644
--- a/library/psa_crypto.c
+++ b/library/psa_crypto.c
@@ -91,6 +91,10 @@
 #define BUILTIN_ALG_ANY_HKDF 1
 #endif
 
+/* JPAKE user/peer ids. */
+#define JPAKE_SERVER_ID "server"
+#define JPAKE_CLIENT_ID "client"
+
 /****************************************************************/
 /* Global data, support functions and library management */
 /****************************************************************/
@@ -7402,8 +7406,8 @@
     }
 
     /* Allow only "client" or "server" values (temporary restriction). */
-    if (memcmp(peer_id, PSA_JPAKE_SERVER_ID, peer_id_len) != 0 &&
-        memcmp(peer_id, PSA_JPAKE_CLIENT_ID, peer_id_len) != 0) {
+    if (memcmp(user_id, JPAKE_SERVER_ID, user_id_len) != 0 &&
+        memcmp(user_id, JPAKE_CLIENT_ID, user_id_len) != 0) {
         status = PSA_ERROR_NOT_SUPPORTED;
         goto exit;
     }
@@ -7446,8 +7450,8 @@
     }
 
     /* Allow only "client" or "server" values (temporary restriction). */
-    if (memcmp(user_id, PSA_JPAKE_SERVER_ID, user_id_len) != 0 &&
-        memcmp(user_id, PSA_JPAKE_CLIENT_ID, user_id_len) != 0) {
+    if (memcmp(peer_id, JPAKE_SERVER_ID, peer_id_len) != 0 &&
+        memcmp(peer_id, JPAKE_CLIENT_ID, peer_id_len) != 0) {
         status = PSA_ERROR_NOT_SUPPORTED;
         goto exit;
     }
@@ -7568,12 +7572,12 @@
     }
 
     if (operation->alg == PSA_ALG_JPAKE) {
-        if (memcmp(inputs.user, PSA_JPAKE_CLIENT_ID, inputs.user_len) == 0 &&
-            memcmp(inputs.peer, PSA_JPAKE_SERVER_ID, inputs.peer_len) == 0) {
+        if (memcmp(inputs.user, JPAKE_CLIENT_ID, inputs.user_len) == 0 &&
+            memcmp(inputs.peer, JPAKE_SERVER_ID, inputs.peer_len) == 0) {
             inputs.role = PSA_PAKE_ROLE_CLIENT;
         } else
-        if (memcmp(inputs.user, PSA_JPAKE_SERVER_ID, inputs.user_len) == 0 &&
-            memcmp(inputs.peer, PSA_JPAKE_CLIENT_ID, inputs.peer_len) == 0) {
+        if (memcmp(inputs.user, JPAKE_SERVER_ID, inputs.user_len) == 0 &&
+            memcmp(inputs.peer, JPAKE_CLIENT_ID, inputs.peer_len) == 0) {
             inputs.role = PSA_PAKE_ROLE_SERVER;
         }
 
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 2d5d529..4a351f3 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -61,6 +61,10 @@
                                                       psa_generic_status_to_mbedtls)
 #endif
 
+/* JPAKE user/peer ids. */
+#define JPAKE_SERVER_ID "server"
+#define JPAKE_CLIENT_ID "client"
+
 #if defined(MBEDTLS_TEST_HOOKS)
 static mbedtls_ssl_chk_buf_ptr_args chk_buf_ptr_fail_args;
 
@@ -1972,15 +1976,15 @@
     }
 
     if (ssl->conf->endpoint == MBEDTLS_SSL_IS_SERVER) {
-        user = (uint8_t *) PSA_JPAKE_SERVER_ID;
-        user_len = strlen(PSA_JPAKE_SERVER_ID);
-        peer = (uint8_t *) PSA_JPAKE_CLIENT_ID;
-        peer_len = strlen(PSA_JPAKE_CLIENT_ID);
+        user = (uint8_t *) JPAKE_SERVER_ID;
+        user_len = strlen(JPAKE_SERVER_ID);
+        peer = (uint8_t *) JPAKE_CLIENT_ID;
+        peer_len = strlen(JPAKE_CLIENT_ID);
     } else {
-        user = (uint8_t *) PSA_JPAKE_CLIENT_ID;
-        user_len = strlen(PSA_JPAKE_CLIENT_ID);
-        peer = (uint8_t *) PSA_JPAKE_SERVER_ID;
-        peer_len = strlen(PSA_JPAKE_SERVER_ID);
+        user = (uint8_t *) JPAKE_CLIENT_ID;
+        user_len = strlen(JPAKE_CLIENT_ID);
+        peer = (uint8_t *) JPAKE_SERVER_ID;
+        peer_len = strlen(JPAKE_SERVER_ID);
     }
 
     status = psa_pake_set_user(&ssl->handshake->psa_pake_ctx, user, user_len);
diff --git a/tests/suites/test_suite_psa_crypto_driver_wrappers.function b/tests/suites/test_suite_psa_crypto_driver_wrappers.function
index cb5d202..c235ff6 100644
--- a/tests/suites/test_suite_psa_crypto_driver_wrappers.function
+++ b/tests/suites/test_suite_psa_crypto_driver_wrappers.function
@@ -5,6 +5,11 @@
    Global to silent the compiler when unused. */
 size_t pake_expected_hit_count = 0;
 int pake_in_driver = 0;
+
+/* JPAKE user/peer ids. */
+#define JPAKE_SERVER_ID "server"
+#define JPAKE_CLIENT_ID "client"
+
 #if defined(PSA_WANT_ALG_JPAKE) && defined(PSA_WANT_KEY_TYPE_ECC_KEY_PAIR) && \
     defined(PSA_WANT_ECC_SECP_R1_256) && defined(PSA_WANT_ALG_SHA_256)
 static void ecjpake_do_round(psa_algorithm_t alg, unsigned int primitive,
@@ -2994,10 +2999,10 @@
         PSA_ECC_FAMILY_SECP_R1, 256);
     psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
     unsigned char *input_buffer = NULL;
-    const uint8_t server_id[] = PSA_JPAKE_SERVER_ID;
-    const uint8_t client_id[] = PSA_JPAKE_CLIENT_ID;
-    const size_t server_id_len = strlen(PSA_JPAKE_SERVER_ID);
-    const size_t client_id_len = strlen(PSA_JPAKE_CLIENT_ID);
+    const uint8_t server_id[] = JPAKE_SERVER_ID;
+    const uint8_t client_id[] = JPAKE_CLIENT_ID;
+    const size_t server_id_len = strlen(JPAKE_SERVER_ID);
+    const size_t client_id_len = strlen(JPAKE_CLIENT_ID);
     const size_t size_key_share = PSA_PAKE_INPUT_SIZE(PSA_ALG_JPAKE, primitive,
                                                       PSA_PAKE_STEP_KEY_SHARE);
     unsigned char *output_buffer = NULL;
@@ -3188,10 +3193,10 @@
         PSA_KEY_DERIVATION_OPERATION_INIT;
     psa_key_derivation_operation_t client_derive =
         PSA_KEY_DERIVATION_OPERATION_INIT;
-    const uint8_t server_id[] = PSA_JPAKE_SERVER_ID;
-    const uint8_t client_id[] = PSA_JPAKE_CLIENT_ID;
-    const size_t server_id_len = strlen(PSA_JPAKE_SERVER_ID);
-    const size_t client_id_len = strlen(PSA_JPAKE_CLIENT_ID);
+    const uint8_t server_id[] = JPAKE_SERVER_ID;
+    const uint8_t client_id[] = JPAKE_CLIENT_ID;
+    const size_t server_id_len = strlen(JPAKE_SERVER_ID);
+    const size_t client_id_len = strlen(JPAKE_CLIENT_ID);
     pake_in_driver = in_driver;
     /* driver setup is called indirectly through pake_output/pake_input */
     if (pake_in_driver) {
diff --git a/tests/suites/test_suite_psa_crypto_pake.function b/tests/suites/test_suite_psa_crypto_pake.function
index 8df28f7..d8b1035 100644
--- a/tests/suites/test_suite_psa_crypto_pake.function
+++ b/tests/suites/test_suite_psa_crypto_pake.function
@@ -53,6 +53,10 @@
     PAKE_ROUND_TWO
 } pake_round_t;
 
+/* JPAKE user/peer ids. */
+#define JPAKE_SERVER_ID "server"
+#define JPAKE_CLIENT_ID "client"
+
 /*
  * Inject an error on the specified buffer ONLY it this is the correct stage.
  * Offset 7 is arbitrary, but chosen because it's "in the middle" of the part
@@ -733,10 +737,10 @@
     mbedtls_svc_key_id_t key = MBEDTLS_SVC_KEY_ID_INIT;
     psa_key_attributes_t attributes = PSA_KEY_ATTRIBUTES_INIT;
     ecjpake_error_stage_t err_stage = err_stage_arg;
-    const uint8_t server_id[] = PSA_JPAKE_SERVER_ID;
-    const uint8_t client_id[] = PSA_JPAKE_CLIENT_ID;
-    const size_t server_id_len = strlen(PSA_JPAKE_SERVER_ID);
-    const size_t client_id_len = strlen(PSA_JPAKE_CLIENT_ID);
+    const uint8_t server_id[] = JPAKE_SERVER_ID;
+    const uint8_t client_id[] = JPAKE_CLIENT_ID;
+    const size_t server_id_len = strlen(JPAKE_SERVER_ID);
+    const size_t client_id_len = strlen(JPAKE_CLIENT_ID);
 
     PSA_INIT();
 
@@ -801,10 +805,10 @@
     psa_key_derivation_operation_t client_derive =
         PSA_KEY_DERIVATION_OPERATION_INIT;
     ecjpake_error_stage_t err_stage = err_stage_arg;
-    const uint8_t server_id[] = PSA_JPAKE_SERVER_ID;
-    const uint8_t client_id[] = PSA_JPAKE_CLIENT_ID;
-    const size_t server_id_len = strlen(PSA_JPAKE_SERVER_ID);
-    const size_t client_id_len = strlen(PSA_JPAKE_CLIENT_ID);
+    const uint8_t server_id[] = JPAKE_SERVER_ID;
+    const uint8_t client_id[] = JPAKE_CLIENT_ID;
+    const size_t server_id_len = strlen(JPAKE_SERVER_ID);
+    const size_t client_id_len = strlen(JPAKE_CLIENT_ID);
 
     PSA_INIT();