diff --git a/crypto/mbedtls/CMakeLists.txt b/crypto/mbedtls/CMakeLists.txt
index 9a80ffab92c..ee3df94ae5b 100644
--- a/crypto/mbedtls/CMakeLists.txt
+++ b/crypto/mbedtls/CMakeLists.txt
@@ -129,18 +129,16 @@ if(CONFIG_CRYPTO_MBEDTLS)
   # Library Configuration
   # ############################################################################
 
-  set_property(
-    TARGET nuttx
-    APPEND
-    PROPERTY NUTTX_INCLUDE_DIRECTORIES ${INCDIR})
-  set_property(
-    TARGET nuttx
-    APPEND
-    PROPERTY NUTTX_CXX_INCLUDE_DIRECTORIES ${INCDIR})
-
   nuttx_add_library(mbedtls STATIC)
   target_sources(mbedtls PRIVATE ${CSRCS})
-  target_include_directories(mbedtls PRIVATE ${INCDIR})
+  target_include_directories(mbedtls PUBLIC ${INCDIR})
+  nuttx_export_header(TARGET mbedtls INCLUDE_DIRECTORIES ${MBEDTLS_DIR}/include)
+  # Overlay mbedtls_config.h cannot be in the same nuttx_export_header() as
+  # ${MBEDTLS_DIR}/include (duplicate path). Alt headers need no export; INCDIR
+  # supplies them for this library only.
+  file(CREATE_LINK ${CMAKE_CURRENT_LIST_DIR}/include/mbedtls/mbedtls_config.h
+       ${NUTTX_APPS_BINDIR}/include/mbedtls/mbedtls/mbedtls_config.h
+       COPY_ON_ERROR SYMBOLIC)
   target_compile_definitions(mbedtls PRIVATE unix)
 
   if(CONFIG_ARCH_SIM)
diff --git a/netutils/mqttc/CMakeLists.txt b/netutils/mqttc/CMakeLists.txt
index ae03435bef0..420c987b17b 100644
--- a/netutils/mqttc/CMakeLists.txt
+++ b/netutils/mqttc/CMakeLists.txt
@@ -33,7 +33,7 @@ if(CONFIG_NETUTILS_MQTTC)
     FetchContent_Declare(
       mqttc_fetch
       URL ${MQTTC_URL}/${CONFIG_NETUTILS_MQTTC_VERSION}.tar.gz SOURCE_DIR
-          ${MQTTC_DIR} BINARY_DIR ${CMAKE_BINARY_DIR}/apps/netutils/mqttc/MQTT-C
+          ${MQTTC_DIR} BINARY_DIR ${NUTTX_APPS_BINDIR}/netutils/mqttc/MQTT-C
       DOWNLOAD_NO_PROGRESS true
       TIMEOUT 30)
 
@@ -44,9 +44,8 @@ if(CONFIG_NETUTILS_MQTTC)
     endif()
 
     execute_process(
-      COMMAND
-        sh -c
-        "cat 0001_add_connection_status.patch | patch -s -N -d $(MQTTC_DIR) -p1"
+      COMMAND patch -s -N -d ${MQTTC_DIR} -p1 -i
+              ${CMAKE_CURRENT_LIST_DIR}/0001_add_connection_status.patch
       WORKING_DIRECTORY ${CMAKE_CURRENT_LIST_DIR})
   endif()
 
@@ -65,6 +64,10 @@ if(CONFIG_NETUTILS_MQTTC)
   target_sources(mqttc PRIVATE ${CSRCS})
   target_compile_options(mqttc PRIVATE ${CFLAGS})
 
+  if(CONFIG_NETUTILS_MQTTC_WITH_MBEDTLS AND CONFIG_CRYPTO_MBEDTLS)
+    nuttx_add_dependencies(TARGET mqttc DEPENDS mbedtls)
+  endif()
+
   if(CONFIG_NETUTILS_MQTTC_EXAMPLE)
     if(CONFIG_NETUTILS_MQTTC_WITH_MBEDTLS)
       nuttx_add_application(
@@ -79,7 +82,8 @@ if(CONFIG_NETUTILS_MQTTC)
         COMPILE_FLAGS
         ${CFLAGS}
         DEPENDS
-        mqttc)
+        mqttc
+        mbedtls)
     else()
       set(MQTT_PUB_CFLAGS
           ${CFLAGS}