diff --git a/docs/compile.md b/docs/compile.md
index bb7d3afb..2351bf0a 100644
--- a/docs/compile.md
+++ b/docs/compile.md
@@ -162,6 +162,15 @@ is created at compile time to assist the allocation of the object needed by the
 When compiled with `WOLFBOOT_SMALL_STACK=1`, wolfBoot reduces the stack usage considerably, and simulates dynamic
 memory allocations by assigning dedicated, statically allocated, pre-sized memory areas.
 
+### Allow bigger stack size allocation
+
+Some combinations of authentication algorithms, key sizes and math configuration in wolfCrypt require
+a large amount of memory to be allocated in the stack at runtime. By default, if your configuration
+falls in one of these cases, wolfBoot compilation will terminate with an explicit error.
+
+In some cases you might have enough memory available to allow large stack allocations. 
+To circumvent the compile-time checks on the maximum allowed stack size, use `WOLFBOOT_HUGE_STACK=1`.
+
 ### Disable Backup of current running firmware
 
 Optionally, it is possible to disable the backup copy of the current running firmware upon the installation of the
diff --git a/include/user_settings.h b/include/user_settings.h
index 69844be7..b2f02b3f 100644
--- a/include/user_settings.h
+++ b/include/user_settings.h
@@ -266,6 +266,9 @@
 #   endif
 #   define WOLFSSL_NO_MALLOC
 #else
+#   if defined(WOLFBOOT_HUGE_STACK)
+#       error "Cannot use SMALL_STACK=1 with HUGE_STACK=1"
+#endif
 #   define WOLFSSL_SMALL_STACK
 #endif
 
diff --git a/options.mk b/options.mk
index fec8a8b6..f2853262 100644
--- a/options.mk
+++ b/options.mk
@@ -411,6 +411,10 @@ ifeq ($(ARMORED),1)
   CFLAGS+=-DWOLFBOOT_ARMORED
 endif
 
+ifeq ($(WOLFBOOT_HUGE_STACK),1)
+  CFLAGS+=-DWOLFBOOT_HUGE_STACK
+endif
+
 OBJS+=$(PUBLIC_KEY_OBJS)
 OBJS+=$(UPDATE_OBJS)
 
diff --git a/src/image.c b/src/image.c
index 5747cbc7..a55923e7 100644
--- a/src/image.c
+++ b/src/image.c
@@ -179,12 +179,20 @@ static void wolfBoot_verify_signature(uint8_t key_slot,
 }
 #endif /* WOLFBOOT_SIGN_ECC256 */
 
+
 #if defined(WOLFBOOT_SIGN_RSA2048) || \
         defined (WOLFBOOT_SIGN_RSA3072) || \
         defined (WOLFBOOT_SIGN_RSA4096)
 #include <wolfssl/wolfcrypt/asn.h>
 #include <wolfssl/wolfcrypt/rsa.h>
 
+#if defined(WOLFBOOT_SIGN_RSA4096) && \
+    (defined(USE_FAST_MATH) && \
+     !defined(WOLFSSL_SMALL_STACK) && !defined(WOLFBOOT_HUGE_STACK))
+#   error "TFM will allocate 70+ KB in the stack with this configuration." \
+   "If this is OK, please compile with WOLFBOOT_HUGE_STACK=1"
+#endif
+
 #ifndef NO_RSA_SIG_ENCODING /* option to reduce code size */
 static inline int DecodeAsn1Tag(const uint8_t* input, int inputSz, int* inOutIdx,
     int* tag_len, uint8_t tag)
diff --git a/tools/config.mk b/tools/config.mk
index 656d847f..4a8fb863 100644
--- a/tools/config.mk
+++ b/tools/config.mk
@@ -56,6 +56,7 @@ ifeq ($(ARCH),)
   WOLFBOOT_SMALL_STACK?=0
   DELTA_UPDATES?=0
   DELTA_BLOCK_SIZE?=256
+  WOLFBOOT_HUGE_STACK?=0
   ARMORED?=0
 endif
 
@@ -69,5 +70,6 @@ CONFIG_VARS:= ARCH TARGET SIGN HASH MCUXPRESSO MCUXPRESSO_CPU MCUXPRESSO_DRIVERS
 	WOLFBOOT_PARTITION_SWAP_ADDRESS WOLFBOOT_LOAD_ADDRESS \
 	WOLFBOOT_LOAD_DTS_ADDRESS WOLFBOOT_DTS_BOOT_ADDRESS WOLFBOOT_DTS_UPDATE_ADDRESS \
 	WOLFBOOT_SMALL_STACK DELTA_UPDATES DELTA_BLOCK_SIZE \
+	WOLFBOOT_HUGE_STACK \
 	ENCRYPT_WITH_CHAHA ENCRYPT_WITH_AES128 ENCRYPT_WITH_AES256 ARMORED