diff --git a/tests/scripts/all.sh b/tests/scripts/all.sh
index 8e978ac727..fea4e0f1f9 100755
--- a/tests/scripts/all.sh
+++ b/tests/scripts/all.sh
@@ -4166,6 +4166,29 @@ component_test_aes_fewer_tables_and_rom_tables () {
     make test
 }
 
+component_test_cipher_encrypt_only () {
+    msg "build: default config + PSA_CRYPTO_CONFIG + implicitly enable CIPHER_ENCRYPT_ONLY"
+    scripts/config.py set MBEDTLS_PSA_CRYPTO_CONFIG
+    scripts/config.py unset MBEDTLS_CIPHER_MODE_CBC
+    scripts/config.py unset MBEDTLS_CIPHER_MODE_XTS
+    scripts/config.py unset MBEDTLS_NIST_KW_C
+
+    echo '#undef PSA_WANT_ALG_CBC_NO_PADDING' >> psa_cipher_encrypt_only.h
+    echo '#undef PSA_WANT_ALG_CBC_PKCS7' >> psa_cipher_encrypt_only.h
+    echo '#undef PSA_WANT_ALG_ECB_NO_PADDING' >> psa_cipher_encrypt_only.h
+
+    make CC=gcc CFLAGS="-Werror -Wall -Wextra -I '$PWD' \
+        -DMBEDTLS_PSA_CRYPTO_USER_CONFIG_FILE='\"psa_cipher_encrypt_only.h\"'"
+
+    msg "test: default config + PSA_CRYPTO_CONFIG + implicitly enable CIPER_ENCRYPT_ONLY"
+    make test
+
+    msg "selftest: default config + PSA_CRYPTO_CONFIG + implicitly enable CIPER_ENCRYPT_ONLY"
+    programs/test/selftest
+
+    rm -f psa_cipher_encrypt_only.h
+}
+
 component_test_ctr_drbg_aes_256_sha_256 () {
     msg "build: full + MBEDTLS_ENTROPY_FORCE_SHA256 (ASan build)"
     scripts/config.py full