diff --git a/include/mbedtls/aes.h b/include/mbedtls/aes.h
index 0780ece..c53f817 100644
--- a/include/mbedtls/aes.h
+++ b/include/mbedtls/aes.h
@@ -167,7 +167,7 @@
 int mbedtls_aes_setkey_enc(mbedtls_aes_context *ctx, const unsigned char *key,
                            unsigned int keybits);
 
-#if !defined(MBEDTLS_CIPHER_ENCRYPT_ONLY)
+#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT)
 /**
  * \brief          This function sets the decryption key.
  *
@@ -186,7 +186,7 @@
 MBEDTLS_CHECK_RETURN_TYPICAL
 int mbedtls_aes_setkey_dec(mbedtls_aes_context *ctx, const unsigned char *key,
                            unsigned int keybits);
-#endif /* !MBEDTLS_CIPHER_ENCRYPT_ONLY */
+#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */
 
 #if defined(MBEDTLS_CIPHER_MODE_XTS)
 /**
@@ -606,7 +606,7 @@
                                  const unsigned char input[16],
                                  unsigned char output[16]);
 
-#if !defined(MBEDTLS_CIPHER_ENCRYPT_ONLY)
+#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT)
 /**
  * \brief           Internal AES block decryption function. This is only
  *                  exposed to allow overriding it using see
@@ -622,7 +622,7 @@
 int mbedtls_internal_aes_decrypt(mbedtls_aes_context *ctx,
                                  const unsigned char input[16],
                                  unsigned char output[16]);
-#endif /* !MBEDTLS_CIPHER_ENCRYPT_ONLY */
+#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */
 
 #if defined(MBEDTLS_SELF_TEST)
 /**
diff --git a/include/mbedtls/aria.h b/include/mbedtls/aria.h
index e725ea0..2750840 100644
--- a/include/mbedtls/aria.h
+++ b/include/mbedtls/aria.h
@@ -110,7 +110,7 @@
                             const unsigned char *key,
                             unsigned int keybits);
 
-#if !defined(MBEDTLS_CIPHER_ENCRYPT_ONLY)
+#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT)
 /**
  * \brief          This function sets the decryption key.
  *
@@ -129,7 +129,7 @@
 int mbedtls_aria_setkey_dec(mbedtls_aria_context *ctx,
                             const unsigned char *key,
                             unsigned int keybits);
-#endif /* !MBEDTLS_CIPHER_ENCRYPT_ONLY */
+#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */
 
 /**
  * \brief          This function performs an ARIA single-block encryption or
diff --git a/include/mbedtls/camellia.h b/include/mbedtls/camellia.h
index 74a8e34..f9e488d 100644
--- a/include/mbedtls/camellia.h
+++ b/include/mbedtls/camellia.h
@@ -93,7 +93,7 @@
                                 const unsigned char *key,
                                 unsigned int keybits);
 
-#if !defined(MBEDTLS_CIPHER_ENCRYPT_ONLY)
+#if !defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT)
 /**
  * \brief          Perform a CAMELLIA key schedule operation for decryption.
  *
@@ -109,7 +109,7 @@
 int mbedtls_camellia_setkey_dec(mbedtls_camellia_context *ctx,
                                 const unsigned char *key,
                                 unsigned int keybits);
-#endif /* !MBEDTLS_CIPHER_ENCRYPT_ONLY */
+#endif /* !MBEDTLS_BLOCK_CIPHER_NO_DECRYPT */
 
 /**
  * \brief          Perform a CAMELLIA-ECB block encryption/decryption operation.
diff --git a/include/mbedtls/check_config.h b/include/mbedtls/check_config.h
index 5de8eb3..c580bf7 100644
--- a/include/mbedtls/check_config.h
+++ b/include/mbedtls/check_config.h
@@ -183,12 +183,12 @@
 #error "MBEDTLS_NIST_KW_C defined, but not all prerequisites"
 #endif
 
-#if defined(MBEDTLS_CIPHER_ENCRYPT_ONLY) && \
+#if defined(MBEDTLS_BLOCK_CIPHER_NO_DECRYPT) && \
     (!defined(MBEDTLS_PSA_CRYPTO_CONFIG) || \
     (defined(MBEDTLS_CIPHER_MODE_CBC) || \
      defined(MBEDTLS_CIPHER_MODE_XTS) || \
      defined(MBEDTLS_NIST_KW_C)))
-#error "MBEDTLS_CIPHER_ENCRYPT_ONLY defined, but not all prerequisites"
+#error "MBEDTLS_BLOCK_CIPHER_NO_DECRYPT defined, but not all prerequisites"
 #endif
 
 #if defined(MBEDTLS_ECDH_C) && !defined(MBEDTLS_ECP_C)
diff --git a/include/mbedtls/config_adjust_legacy_crypto.h b/include/mbedtls/config_adjust_legacy_crypto.h
index 2ac522e..6777721 100644
--- a/include/mbedtls/config_adjust_legacy_crypto.h
+++ b/include/mbedtls/config_adjust_legacy_crypto.h
@@ -36,11 +36,11 @@
 
 /*
  * ECB, CBC, XTS, KW modes require both ENCRYPT and DECRYPT directions.
- * MBEDTLS_CIPHER_ENCRYPT_ONLY is only enabled when those modes
+ * MBEDTLS_BLOCK_CIPHER_NO_DECRYPT is only enabled when those modes
  * are not requested via the PSA API and are not enabled in the legacy API.
  *
  * DES only supports ECB and CBC modes in Mbed TLS. As it's a deprecated and
- * insecure block cipher, MBEDTLS_CIPHER_ENCRYPT_ONLY is enabled when DES
+ * insecure block cipher, MBEDTLS_BLOCK_CIPHER_NO_DECRYPT is enabled when DES
  * is not requested via the PSA API and is not enabled in the legacy API.
  *
  * Note: XTS, KW are not yet supported via the PSA API in Mbed TLS.
@@ -54,7 +54,7 @@
     !defined(MBEDTLS_CIPHER_MODE_XTS) && \
     !defined(MBEDTLS_DES_C) && \
     !defined(MBEDTLS_NIST_KW_C)
-#define MBEDTLS_CIPHER_ENCRYPT_ONLY 1
+#define MBEDTLS_BLOCK_CIPHER_NO_DECRYPT 1
 #endif
 #endif /* MBEDTLS_PSA_CRYPTO_CONFIG */