diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 39d76ba..f70dcd9 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -1855,10 +1855,17 @@
     scripts/config.py unset MBEDTLS_MD5_C
     scripts/config.py unset MBEDTLS_RIPEMD160_C
     scripts/config.py unset MBEDTLS_SHA1_C
-    # Don't unset MBEDTLS_SHA256_C as it is needed by PSA crypto core.
+    scripts/config.py unset MBEDTLS_SHA224_C
+    scripts/config.py unset MBEDTLS_SHA256_C # see external RNG below
     scripts/config.py unset MBEDTLS_SHA384_C
     scripts/config.py unset MBEDTLS_SHA512_C
-    # Also unset MD_C and things that depend on it, see test_crypto_full_no_md
+    # Use an external RNG as currently internal RNGs depend on entropy.c
+    # which in turn hard-depends on SHA256_C (or SHA512_C).
+    # See component_test_psa_external_rng_no_drbg_use_psa.
+    scripts/config.py set MBEDTLS_PSA_CRYPTO_EXTERNAL_RNG
+    scripts/config.py unset MBEDTLS_ENTROPY_C
+    # Also unset MD_C and things that depend on it;
+    # see component_test_crypto_full_no_md.
     scripts/config.py unset MBEDTLS_MD_C
     scripts/config.py unset MBEDTLS_ECJPAKE_C
     scripts/config.py unset MBEDTLS_HKDF_C
@@ -1892,6 +1899,18 @@
     scripts/config.py unset MBEDTLS_SSL_SERVER_NAME_INDICATION
     scripts/config.py unset MBEDTLS_SSL_SRV_C
     scripts/config.py unset MBEDTLS_SSL_TLS_C
+    # TLS 1.2 currently depends on SHA1_C || SHA256_C || SHA512_C
+    scripts/config.py unset MBEDTLS_SSL_PROTO_TLS1_2
+    scripts/config.py unset MBEDTLS_SSL_ENCRYPT_THEN_MAC
+    scripts/config.py unset MBEDTLS_SSL_EXTENDED_MASTER_SECRET
+    scripts/config.py unset MBEDTLS_SSL_PROTO_DTLS
+    scripts/config.py unset MBEDTLS_SSL_DTLS_ANTI_REPLAY
+    scripts/config.py unset MBEDTLS_SSL_DTLS_HELLO_VERIFY
+    scripts/config.py unset MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
+    # DTLS cookies currently depend on SHA1_C || SHA224_C || SHA384_C
+    scripts/config.py unset MBEDTLS_SSL_COOKIE_C
+    # TLS 1.3 currently depends on SHA256_C || SHA384_C
+    # but is already disabled in the default config
 
     loc_accel_flags="$loc_accel_flags $( echo "$loc_accel_list" | sed 's/[^ ]* */-DMBEDTLS_PSA_ACCEL_&/g' )"
     make CFLAGS="$ASAN_CFLAGS -Werror -I../tests/include -I../tests -DPSA_CRYPTO_DRIVER_TEST -DMBEDTLS_TEST_LIBTESTDRIVER1 $loc_accel_flags" LDFLAGS="-ltestdriver1 $ASAN_CFLAGS" tests
@@ -1901,7 +1920,7 @@
     not grep mbedtls_md library/md.o
     not grep mbedtls_md5 library/md5.o
     not grep mbedtls_sha1 library/sha1.o
-    #not grep mbedtls_sha256 library/sha256.o
+    not grep mbedtls_sha256 library/sha256.o
     not grep mbedtls_sha512 library/sha512.o
     not grep mbedtls_ripemd160 library/ripemd160.o