diff --git a/.github/workflows/test-configs.yml b/.github/workflows/test-configs.yml
index 91d517fa..13503fd2 100644
--- a/.github/workflows/test-configs.yml
+++ b/.github/workflows/test-configs.yml
@@ -518,6 +518,18 @@ jobs:
       arch: arm
       config-file: ./config/examples/stm32h5-tz-tpm.config
 
+  stm32h5_tz_tpm_mfgid_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32h5-tz-tpm-mfgid.config
+
+  stm32h5_tz_tpm_mfgid_precomputed_test:
+    uses: ./.github/workflows/test-build.yml
+    with:
+      arch: arm
+      config-file: ./config/examples/stm32h5-tz-tpm-mfgid-precomputed.config
+
   stm32h5_tz_dualbank_test:
     uses: ./.github/workflows/test-build.yml
     with:
diff --git a/config/examples/stm32h5-tz-tpm-mfgid-precomputed.config b/config/examples/stm32h5-tz-tpm-mfgid-precomputed.config
new file mode 100644
index 00000000..2a661e4c
--- /dev/null
+++ b/config/examples/stm32h5-tz-tpm-mfgid-precomputed.config
@@ -0,0 +1,44 @@
+ARCH?=ARM
+TZEN?=1
+TARGET?=stm32h5
+SIGN?=ECC256
+HASH?=SHA256
+DEBUG?=0
+VTOR?=1
+CORTEX_M0?=0
+CORTEX_M33?=1
+NO_ASM?=0
+NO_MPU=1
+EXT_FLASH?=0
+SPI_FLASH?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=1
+WOLFBOOT_VERSION?=1
+V?=0
+SPMATH?=1
+RAM_CODE?=1
+DUALBANK_SWAP?=0
+WOLFBOOT_PARTITION_SIZE?=0xA0000
+WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
+FLAGS_HOME=0
+DISABLE_BACKUP=0
+WOLFCRYPT_TZ=1
+WOLFCRYPT_TZ_PKCS11=1
+IMAGE_HEADER_SIZE?=1024
+ARMORED=1
+WOLFTPM=1
+# Exercise the pre-provisioned ST33KTPM identity keys (IAK/IDevID).
+# ST33 vendor support is required (wolfTPM2_SetIdentityAuth -> TPM2_GetProductInfo).
+CFLAGS_EXTRA+=-DWOLFTPM_ST33
+CFLAGS_EXTRA+=-DWOLFTPM_MFG_IDENTITY
+# Default precomputed mode (WOLFBOOT_TPM_MFG_AUTH_DERIVE unset): the per-device
+# authValue is set directly from the WOLFBOOT_TPM_MFG_AIK_AUTH/EH_AUTH macros.
+# Ships a 0xFF placeholder that fails TPM auth until provisioned per-device; this
+# config exists to build-test the precomputed branch in CI.