diff --git a/config/examples/stm32h5-tz-tpm-mfgid.config b/config/examples/stm32h5-tz-tpm-mfgid.config
new file mode 100644
index 00000000..aec830f0
--- /dev/null
+++ b/config/examples/stm32h5-tz-tpm-mfgid.config
@@ -0,0 +1,44 @@
+ARCH?=ARM
+TZEN?=1
+TARGET?=stm32h5
+SIGN?=ECC256
+HASH?=SHA256
+DEBUG?=0
+VTOR?=1
+CORTEX_M0?=0
+CORTEX_M33?=1
+NO_ASM?=0
+NO_MPU=1
+EXT_FLASH?=0
+SPI_FLASH?=0
+ALLOW_DOWNGRADE?=0
+NVM_FLASH_WRITEONCE?=1
+WOLFBOOT_VERSION?=1
+V?=0
+SPMATH?=1
+RAM_CODE?=1
+DUALBANK_SWAP?=0
+WOLFBOOT_PARTITION_SIZE?=0xA0000
+WOLFBOOT_SECTOR_SIZE?=0x2000
+WOLFBOOT_KEYVAULT_ADDRESS?=0x0C040000
+WOLFBOOT_KEYVAULT_SIZE?=0x1C000
+WOLFBOOT_NSC_ADDRESS?=0x0C05C000
+WOLFBOOT_NSC_SIZE?=0x4000
+WOLFBOOT_PARTITION_BOOT_ADDRESS?=0x08060000
+WOLFBOOT_PARTITION_UPDATE_ADDRESS?=0x0C100000
+WOLFBOOT_PARTITION_SWAP_ADDRESS?=0x0C1A0000
+FLAGS_HOME=0
+DISABLE_BACKUP=0
+WOLFCRYPT_TZ=1
+WOLFCRYPT_TZ_PKCS11=1
+IMAGE_HEADER_SIZE?=1024
+ARMORED=1
+WOLFTPM=1
+# Exercise the pre-provisioned ST33KTPM identity keys (IAK/IDevID).
+# ST33 vendor support is required (wolfTPM2_SetIdentityAuth -> TPM2_GetProductInfo).
+CFLAGS_EXTRA+=-DWOLFTPM_ST33
+CFLAGS_EXTRA+=-DWOLFTPM_MFG_IDENTITY
+# Derive the authValue on-device so the test-app works on a sample TPM. The
+# default precomputed mode ships a 0xFF placeholder that must be provisioned
+# per-device first.
+WOLFBOOT_TPM_MFG_AUTH_DERIVE=1