diff --git a/boot/zephyr/os.c b/boot/zephyr/os.c
index 0a5abbd..158d52c 100644
--- a/boot/zephyr/os.c
+++ b/boot/zephyr/os.c
@@ -24,29 +24,21 @@
 
 #define MBEDTLS_CONFIG_FILE CONFIG_MBEDTLS_CFG_FILE
 #include <mbedtls/platform.h>
+#include <mbedtls/memory_buffer_alloc.h>
 
-/* D(void *os_malloc(size_t size)) */
-void *os_calloc(size_t nelem, size_t size)
-{
-    /* Note that this doesn't check for overflow.  Assume the
-     * calls only come from within the app. */
-    size_t total = nelem * size;
-    void *buf = k_malloc(total);
-    if (buf) {
-        memset(buf, 0, total);
-    }
-    return buf;
-}
+/*
+ * This is the heap for mbed TLS.  The value needed depends on the key
+ * size and algorithm used.  For RSA-2048, 6144 bytes seems to be
+ * enough.
+ */
+#define CRYPTO_HEAP_SIZE 6144
 
-void os_free(void *ptr)
-{
-    k_free(ptr);
-}
+static unsigned char mempool[CRYPTO_HEAP_SIZE];
 
 /*
  * Initialize mbedtls to be able to use the local heap.
  */
 void os_heap_init(void)
 {
-    mbedtls_platform_set_calloc_free(os_calloc, os_free);
+    mbedtls_memory_buffer_alloc_init(mempool, sizeof(mempool));
 }
diff --git a/boot/zephyr/prj-p256.conf b/boot/zephyr/prj-p256.conf
index 66aa66d..8879bf4 100644
--- a/boot/zephyr/prj-p256.conf
+++ b/boot/zephyr/prj-p256.conf
@@ -11,8 +11,8 @@
 # CONFIG_TINYCRYPT_ECC_DSA is not set
 # CONFIG_TINYCRYPT_SHA256 is not set
 
-### mbedTLS wants a heap
-CONFIG_HEAP_MEM_POOL_SIZE=16384
+### mbedTLS has its own heap
+# CONFIG_HEAP_MEM_POOL_SIZE is not set
 
 CONFIG_FLASH=y
 CONFIG_MPU_ALLOW_FLASH_WRITE=y
diff --git a/boot/zephyr/prj.conf b/boot/zephyr/prj.conf
index 27efab5..c60c590 100644
--- a/boot/zephyr/prj.conf
+++ b/boot/zephyr/prj.conf
@@ -8,8 +8,8 @@
 CONFIG_MBEDTLS_BUILTIN=y
 CONFIG_MBEDTLS_CFG_FILE="config-boot.h"
 
-### mbedTLS wants a heap
-CONFIG_HEAP_MEM_POOL_SIZE=16384
+### mbedTLS has its own heap
+# CONFIG_HEAP_MEM_POOL_SIZE is not set
 
 CONFIG_FLASH=y
 CONFIG_MPU_ALLOW_FLASH_WRITE=y