diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h
index 7c92162..0780ece 100644
--- a/include/mbedtls/aes.h
+++ b/include/mbedtls/aes.h
@@ -167,6 +167,7 @@
 int mbedtls_aes_setkey_enc(mbedtls_aes_context *ctx, const unsigned char *key,
                            unsigned int keybits);
 
+#if !defined(MBEDTLS_CIPHER_ENCRYPT_ONLY)
 /**
  * \brief          This function sets the decryption key.
  *
@@ -185,6 +186,7 @@
 MBEDTLS_CHECK_RETURN_TYPICAL
 int mbedtls_aes_setkey_dec(mbedtls_aes_context *ctx, const unsigned char *key,
                            unsigned int keybits);
+#endif /* !MBEDTLS_CIPHER_ENCRYPT_ONLY */
 
 #if defined(MBEDTLS_CIPHER_MODE_XTS)
 /**
@@ -604,6 +606,7 @@
                                  const unsigned char input[16],
                                  unsigned char output[16]);
 
+#if !defined(MBEDTLS_CIPHER_ENCRYPT_ONLY)
 /**
  * \brief           Internal AES block decryption function. This is only
  *                  exposed to allow overriding it using see
@@ -619,6 +622,7 @@
 int mbedtls_internal_aes_decrypt(mbedtls_aes_context *ctx,
                                  const unsigned char input[16],
                                  unsigned char output[16]);
+#endif /* !MBEDTLS_CIPHER_ENCRYPT_ONLY */
 
 #if defined(MBEDTLS_SELF_TEST)
 /**