diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index 2348b888182..b928a5ee248 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -1145,6 +1145,7 @@ WOLFSSL_OLD_SET_CURVES_LIST
 WOLFSSL_OLD_TIMINGPADVERIFY
 WOLFSSL_OLD_UNSUPPORTED_EXTENSION
 WOLFSSL_OPENSSL_NO_BUILD_DATE
+WOLFSSL_OPTEE
 WOLFSSL_OPTIONS_IGNORE_SYS
 WOLFSSL_PASSTHRU_ERR
 WOLFSSL_PB
diff --git a/wolfcrypt/src/wc_port.c b/wolfcrypt/src/wc_port.c
index 27fbc7ad197..b4de2c06561 100644
--- a/wolfcrypt/src/wc_port.c
+++ b/wolfcrypt/src/wc_port.c
@@ -6144,7 +6144,7 @@ char* wolfSSL_strnstr(const char* s1, const char* s2, size_t n)
 
 #if (defined(__unix__) || defined(__APPLE__)) && \
     !defined(WOLFSSL_KERNEL_MODE) && !defined(WOLFSSL_ZEPHYR) && \
-    !defined(WOLFSSL_SGX)
+    !defined(WOLFSSL_SGX) && !defined(WOLFSSL_OPTEE)
 
 #include <fcntl.h>
 #include <errno.h>
diff --git a/wolfssl/wolfcrypt/settings.h b/wolfssl/wolfcrypt/settings.h
index 685ec0d90ea..0400501fcb6 100644
--- a/wolfssl/wolfcrypt/settings.h
+++ b/wolfssl/wolfcrypt/settings.h
@@ -3515,6 +3515,20 @@
     #define USE_CERT_BUFFERS_2048
 #endif /* WOLFSSL_SGX */
 
+/* OP-TEE trusted application. Runs against libutee rather than a C library,
+ * so there are no file descriptors, sockets, directories or wall clock, and
+ * a TA is single threaded. The TA toolchain is a Linux cross compiler and
+ * still predefines __unix__, so the environment has to be named explicitly. */
+#ifdef WOLFSSL_OPTEE
+    #define NO_FILESYSTEM
+    #define NO_WOLFSSL_DIR
+    #define NO_WRITEV
+    #define NO_MAIN_DRIVER
+    #define SINGLE_THREADED
+    #define NO_ASN_TIME /* no wall clock in a TA */
+    #define USER_TICKS
+#endif /* WOLFSSL_OPTEE */
+
 /* FreeScale MMCAU hardware crypto has 4 byte alignment.
    However, KSDK fsl_mmcau.h gives API with no alignment
    requirements (4 byte alignment is managed internally by fsl_mmcau.c) */