diff --git a/scripts/config.py b/scripts/config.py
index b7a9a08..2557cf1 100755
--- a/scripts/config.py
+++ b/scripts/config.py
@@ -159,42 +159,44 @@
         return active
     return True
 
+EXCLUDE_FROM_FULL = frozenset([
+    'MBEDTLS_CTR_DRBG_USE_128_BIT_KEY',
+    'MBEDTLS_DEPRECATED_REMOVED',
+    'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED',
+    'MBEDTLS_ECP_RESTARTABLE',
+    'MBEDTLS_ENTROPY_FORCE_SHA256', # Variant toggle, tested separately
+    'MBEDTLS_HAVE_SSE2',
+    'MBEDTLS_MEMORY_BACKTRACE',
+    'MBEDTLS_MEMORY_BUFFER_ALLOC_C',
+    'MBEDTLS_MEMORY_DEBUG',
+    'MBEDTLS_NO_64BIT_MULTIPLICATION',
+    'MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES',
+    'MBEDTLS_NO_PLATFORM_ENTROPY',
+    'MBEDTLS_NO_UDBL_DIVISION',
+    'MBEDTLS_PKCS11_C',
+    'MBEDTLS_PLATFORM_NO_STD_FUNCTIONS',
+    'MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER',
+    'MBEDTLS_PSA_CRYPTO_SE_C',
+    'MBEDTLS_PSA_CRYPTO_SPM',
+    'MBEDTLS_PSA_INJECT_ENTROPY',
+    'MBEDTLS_REMOVE_3DES_CIPHERSUITES',
+    'MBEDTLS_REMOVE_ARC4_CIPHERSUITES',
+    'MBEDTLS_RSA_NO_CRT',
+    'MBEDTLS_SHA512_NO_SHA384',
+    'MBEDTLS_SSL_HW_RECORD_ACCEL',
+    'MBEDTLS_SSL_PROTO_SSL3',
+    'MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO',
+    'MBEDTLS_TEST_NULL_ENTROPY',
+    'MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3',
+    'MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION',
+    'MBEDTLS_ZLIB_SUPPORT',
+])
+
 def include_in_full(name):
     """Rules for symbols in the "full" configuration."""
     if re.search(r'PLATFORM_[A-Z0-9]+_ALT', name):
         return True
-    if name in [
-            'MBEDTLS_CTR_DRBG_USE_128_BIT_KEY',
-            'MBEDTLS_DEPRECATED_REMOVED',
-            'MBEDTLS_ECDH_VARIANT_EVEREST_ENABLED',
-            'MBEDTLS_ECP_RESTARTABLE',
-            'MBEDTLS_ENTROPY_FORCE_SHA256', # Variant toggle, tested separately
-            'MBEDTLS_HAVE_SSE2',
-            'MBEDTLS_MEMORY_BACKTRACE',
-            'MBEDTLS_MEMORY_BUFFER_ALLOC_C',
-            'MBEDTLS_MEMORY_DEBUG',
-            'MBEDTLS_NO_64BIT_MULTIPLICATION',
-            'MBEDTLS_NO_DEFAULT_ENTROPY_SOURCES',
-            'MBEDTLS_NO_PLATFORM_ENTROPY',
-            'MBEDTLS_NO_UDBL_DIVISION',
-            'MBEDTLS_PKCS11_C',
-            'MBEDTLS_PLATFORM_NO_STD_FUNCTIONS',
-            'MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER',
-            'MBEDTLS_PSA_CRYPTO_SE_C',
-            'MBEDTLS_PSA_CRYPTO_SPM',
-            'MBEDTLS_PSA_INJECT_ENTROPY',
-            'MBEDTLS_REMOVE_3DES_CIPHERSUITES',
-            'MBEDTLS_REMOVE_ARC4_CIPHERSUITES',
-            'MBEDTLS_RSA_NO_CRT',
-            'MBEDTLS_SHA512_NO_SHA384',
-            'MBEDTLS_SSL_HW_RECORD_ACCEL',
-            'MBEDTLS_SSL_PROTO_SSL3',
-            'MBEDTLS_SSL_SRV_SUPPORT_SSLV2_CLIENT_HELLO',
-            'MBEDTLS_TEST_NULL_ENTROPY',
-            'MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3',
-            'MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION',
-            'MBEDTLS_ZLIB_SUPPORT',
-    ]:
+    if name in EXCLUDE_FROM_FULL:
         return False
     if name.endswith('_ALT'):
         return False
@@ -206,25 +208,27 @@
         return active
     return include_in_full(name)
 
+EXCLUDE_FROM_BAREMETAL = frozenset([
+    'MBEDTLS_DEPRECATED_WARNING',
+    'MBEDTLS_ENTROPY_NV_SEED',
+    'MBEDTLS_FS_IO',
+    'MBEDTLS_HAVEGE_C',
+    'MBEDTLS_HAVE_TIME',
+    'MBEDTLS_HAVE_TIME_DATE',
+    'MBEDTLS_NET_C',
+    'MBEDTLS_PLATFORM_FPRINTF_ALT',
+    'MBEDTLS_PLATFORM_TIME_ALT',
+    'MBEDTLS_PSA_CRYPTO_SE_C',
+    'MBEDTLS_PSA_CRYPTO_STORAGE_C',
+    'MBEDTLS_PSA_ITS_FILE_C',
+    'MBEDTLS_THREADING_C',
+    'MBEDTLS_THREADING_PTHREAD',
+    'MBEDTLS_TIMING_C',
+])
+
 def keep_in_baremetal(name):
     """Rules for symbols in the "baremetal" configuration."""
-    if name in [
-            'MBEDTLS_DEPRECATED_WARNING',
-            'MBEDTLS_ENTROPY_NV_SEED',
-            'MBEDTLS_FS_IO',
-            'MBEDTLS_HAVEGE_C',
-            'MBEDTLS_HAVE_TIME',
-            'MBEDTLS_HAVE_TIME_DATE',
-            'MBEDTLS_NET_C',
-            'MBEDTLS_PLATFORM_FPRINTF_ALT',
-            'MBEDTLS_PLATFORM_TIME_ALT',
-            'MBEDTLS_PSA_CRYPTO_SE_C',
-            'MBEDTLS_PSA_CRYPTO_STORAGE_C',
-            'MBEDTLS_PSA_ITS_FILE_C',
-            'MBEDTLS_THREADING_C',
-            'MBEDTLS_THREADING_PTHREAD',
-            'MBEDTLS_TIMING_C',
-    ]:
+    if name in EXCLUDE_FROM_BAREMETAL:
         return False
     return True