diff --git a/configs/config-tfm.h b/configs/config-tfm.h
index 64dce48..7ca83b6 100644
--- a/configs/config-tfm.h
+++ b/configs/config-tfm.h
@@ -1,7 +1,7 @@
 /**
  * \file config-tfm.h
  *
- * \brief TF-M configuration with tweaks for a successful build and test.
+ * \brief TF-M medium profile, adapted to work on other platforms.
  */
 /*
  *  Copyright The Mbed TLS Contributors
@@ -20,19 +20,26 @@
  *  limitations under the License.
  */
 
-/* TF-M Configuration Options */
-#include "../configs/ext/tfm_mbedcrypto_config_profile_medium.h"
+/* TF-M medium profile: mbedtls legacy configuration */
+#include "ext/tfm_mbedcrypto_config_profile_medium.h"
 
-/* TF-M PSA Crypto Configuration */
+/* TF-M medium profile: PSA crypto configuration */
 #define MBEDTLS_PSA_CRYPTO_CONFIG_FILE "../configs/ext/crypto_config_profile_medium.h"
 
-/*****************************************************************************/
-/* Tweak configuration based on TF-M config for a successful build and test. */
-/*****************************************************************************/
+/***********************************************************/
+/* Tweak the configuration to remove dependencies on TF-M. */
+/***********************************************************/
 
-/* MBEDTLS_PSA_CRYPTO_SPM needs third party files, so disable it. */
+/* MBEDTLS_PSA_CRYPTO_SPM needs third-party files, so disable it. */
 #undef MBEDTLS_PSA_CRYPTO_SPM
-/* TF-M provides its own (dummy) implemenations which Mbed TLS doesn't need. */
+
+/* TF-M provides its own dummy implementations to save code size.
+ * We don't have any way to disable the tests that need these feature,
+ * so we just keep AES decryption enabled. We will resolve this though
+ * an official way to disable AES decryption, then this deviation
+ * will no longer be needed:
+ * https://github.com/Mbed-TLS/mbedtls/issues/7368
+ */
 #undef MBEDTLS_AES_SETKEY_DEC_ALT
 #undef MBEDTLS_AES_DECRYPT_ALT
 /* The configuration we have enables MBEDTLS_PK_PARSE_C and MBEDTLS_PK_WRITE_C
@@ -47,7 +54,10 @@
 #undef MBEDTLS_PK_PARSE_C
 #undef MBEDTLS_PK_WRITE_C
 
-/* Use built-in platform entropy functions. */
+/* Use built-in platform entropy functions (TF-M provides its own). */
 #undef MBEDTLS_NO_PLATFORM_ENTROPY
-/* Disable buffer-based memory allocator */
+
+/* Disable buffer-based memory allocator. This isn't strictly required,
+ * but using the native allocator is faster and works better with
+ * memory management analysis frameworks such as ASan. */
 #undef MBEDTLS_MEMORY_BUFFER_ALLOC_C