diff --git a/library/ssl_cli.c b/library/ssl_cli.c
index 882dc711ae..e69aa27491 100644
--- a/library/ssl_cli.c
+++ b/library/ssl_cli.c
@@ -3315,9 +3315,9 @@ static int ssl_write_client_key_exchange( mbedtls_ssl_context *ssl )
         ssl->handshake->pmslen =
             MBEDTLS_PSA_ECC_KEY_BYTES_OF_CURVE( handshake->ecdh_psa_curve );
 
-        status = psa_generator_read( &generator,
-                                     ssl->handshake->premaster,
-                                     ssl->handshake->pmslen );
+        status = psa_key_derivation_output_bytes( &generator,
+                                                  ssl->handshake->premaster,
+                                                  ssl->handshake->pmslen );
         if( status != PSA_SUCCESS )
         {
             psa_generator_abort( &generator );
diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 465ca06057..4b36c4c294 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -668,7 +668,7 @@ static int tls_prf_generic( mbedtls_md_type_t md_type,
         return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
     }
 
-    status = psa_generator_read( &generator, dstbuf, dlen );
+    status = psa_key_derivation_output_bytes( &generator, dstbuf, dlen );
     if( status != PSA_SUCCESS )
     {
         psa_generator_abort( &generator );
@@ -1135,8 +1135,9 @@ int mbedtls_ssl_derive_keys( mbedtls_ssl_context *ssl )
                 return( MBEDTLS_ERR_SSL_HW_ACCEL_FAILED );
             }
 
-            status = psa_generator_read( &generator, session->master,
-                                         master_secret_len );
+            status = psa_key_derivation_output_bytes( &generator,
+                                                      session->master,
+                                                      master_secret_len );
             if( status != PSA_SUCCESS )
             {
                 psa_generator_abort( &generator );