diff --git a/.github/configs/os-check-linux.json b/.github/configs/os-check-linux.json
index 9492cebc9a1..42002c42af1 100644
--- a/.github/configs/os-check-linux.json
+++ b/.github/configs/os-check-linux.json
@@ -521,6 +521,11 @@
  "configure": ["--enable-cryptonly", "--enable-cryptocb", "--enable-curve25519",
   "--enable-keygen", "--disable-examples",
   "CPPFLAGS=-DNO_CURVE25519_KEY_EXPORT"]},
+{"name": "cryptonly-rsavfy-sp-math-eccsi-sakke", "minutes": 0.3,
+ "comment": "RSA verify-only with sp-math (not sp-math-all) and ECCSI/SAKKE. This is the shape where the ECCSI/SAKKE calls to mp_montgomery_reduce are the only users of sp_mont_red_ex, so a guard on it that leaves them out fails to link (with DH) or leaves _sp_mont_red unreferenced (with --disable-dh).",
+ "configure": ["--enable-cryptonly", "--disable-dh", "--enable-eccsi",
+  "--enable-sakke", "--enable-rsavfy", "--enable-sp-math", "--enable-sp",
+  "--disable-examples"]},
 {"name": "cryptonly-no-asn-rsa", "minutes": 0.2, "check": false,
  "comment": "RSA with ASN.1 disabled. Build only, since wolfcrypt test and benchmark do not support this combination.",
  "configure": ["--enable-cryptonly", "--disable-asn", "--enable-lowresource",
diff --git a/wolfcrypt/src/sp_int.c b/wolfcrypt/src/sp_int.c
index d6a4bebd4e1..a7ec2f47889 100644
--- a/wolfcrypt/src/sp_int.c
+++ b/wolfcrypt/src/sp_int.c
@@ -18115,7 +18115,8 @@ static int _sp_mont_red(sp_int* a, const sp_int* m, sp_int_digit mp, int ct)
 }
 
 #if !defined(WOLFSSL_RSA_VERIFY_ONLY) || \
-    (defined(WOLFSSL_SP_MATH_ALL) && defined(HAVE_ECC))
+    (defined(WOLFSSL_SP_MATH_ALL) && defined(HAVE_ECC)) || \
+    defined(WOLFCRYPT_HAVE_ECCSI) || defined(WOLFCRYPT_HAVE_SAKKE)
 /* Reduce a number in Montgomery form.
  *
  * @param [in, out] a   SP integer to Montgomery reduce.