diff --git a/boot/zephyr/include/mcuboot-mbedtls-cfg.h b/boot/zephyr/include/mcuboot-mbedtls-cfg.h
index 14cd9eb..00f90e8 100644
--- a/boot/zephyr/include/mcuboot-mbedtls-cfg.h
+++ b/boot/zephyr/include/mcuboot-mbedtls-cfg.h
@@ -21,7 +21,7 @@
  * the simulator build.rs accordingly.
  */
 
-#ifdef CONFIG_BOOT_SIGNATURE_TYPE_RSA
+#if defined(CONFIG_BOOT_SIGNATURE_TYPE_RSA) || defined(CONFIG_BOOT_ENCRYPT_RSA)
 #include "config-rsa.h"
 #elif defined(CONFIG_BOOT_SIGNATURE_TYPE_ECDSA_P256)
 #include "config-asn1.h"
diff --git a/boot/zephyr/os.c b/boot/zephyr/os.c
index dd0d7e4..48fb4de 100644
--- a/boot/zephyr/os.c
+++ b/boot/zephyr/os.c
@@ -29,10 +29,15 @@
 
 /*
  * This is the heap for mbed TLS.  The value needed depends on the key
- * size and algorithm used.  For RSA-2048, 6144 bytes seems to be
- * enough.
+ * size and algorithm used.  For RSA-2048 signing, 6144 bytes seems to be
+ * enough. When using RSA-2048-OAEP encryption + RSA-2048 signing, 10240
+ * bytes seem to be enough.
  */
+#if !defined(CONFIG_BOOT_ENCRYPT_RSA)
 #define CRYPTO_HEAP_SIZE 6144
+#else
+#define CRYPTO_HEAP_SIZE 10240
+#endif
 
 static unsigned char mempool[CRYPTO_HEAP_SIZE];