diff --git a/lib/jose/jwe/jwe-rsa-aesgcm.c b/lib/jose/jwe/jwe-rsa-aesgcm.c
index aa9f64174..42eb0b2b5 100644
--- a/lib/jose/jwe/jwe-rsa-aesgcm.c
+++ b/lib/jose/jwe/jwe-rsa-aesgcm.c
@@ -170,12 +170,14 @@ lws_jwe_auth_and_decrypt_rsa_aes_gcm(struct lws_jwe *jwe)
 		return -1;
 	}
 
+#if defined(LWS_WITH_MBEDTLS) && defined(LWS_PLAT_OPTEE)
 	/* strip padding */
 
 	n = jwe->jws.map.buf[LJWE_CTXT][jwe->jws.map.len[LJWE_CTXT] - 1];
 	if (n > 16)
 		return -1;
 	jwe->jws.map.len[LJWE_CTXT] -= n;
+#endif
 
 	return jwe->jws.map.len[LJWE_CTXT];
 }
diff --git a/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c b/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c
index f2f6f20f9..d8fae9923 100644
--- a/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c
+++ b/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c
@@ -549,6 +549,9 @@ bail:
 
 #endif
 
+#if defined(MBEDTLS_CONFIG_H) && !defined(MBEDTLS_CIPHER_MODE_XTS)
+#else
+
 static const uint8_t
 	/*
 	 * Fedora openssl tool doesn't support xts... this data produced
@@ -633,6 +636,7 @@ bail:
 
 	return -1;
 }
+#endif
 
 static const uint8_t
 	/*